@icure/api 8.6.18 → 8.7.0

package/test/icc-x-api/auth/smart-auth-provider-test.js

@@ -1,224 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const types_1 = require("@icure/test-setup/types");
-const mocha_1 = require("mocha");
-const test_utils_1 = require("../../utils/test_utils");
-const icc_x_api_1 = require("../../../icc-x-api");
-const icc_api_1 = require("../../../icc-api");
-require("isomorphic-fetch");
-const SmartAuthProvider_1 = require("../../../icc-x-api/auth/SmartAuthProvider");
-const chai_1 = require("chai");
-const crypto_1 = require("crypto");
-var initMasterApi = test_utils_1.TestUtils.initMasterApi;
-const assert_1 = require("assert");
-const otpauth_1 = require("otpauth");
-(0, test_utils_1.setLocalStorage)(fetch);
-let env;
-let authApi;
-describe('Smart authentication provider', () => {
-    (0, mocha_1.before)(function () {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.timeout(600000);
-            const initializer = yield (0, test_utils_1.getEnvironmentInitializer)();
-            env = yield initializer.execute((0, types_1.getEnvVariables)());
-            authApi = new icc_api_1.IccAuthApi(env.iCureUrl, {}, new icc_x_api_1.NoAuthenticationProvider(), fetch);
-        });
-    });
-    function userApiWithProvider(authProvider) {
-        return new icc_api_1.IccUserApi(env.iCureUrl, {}, authProvider, fetch);
-    }
-    it('Should automatically ask for secret to get a new token, and reasks the secret if it is not valid', () => __awaiter(void 0, void 0, void 0, function* () {
-        const { credentials } = yield (0, test_utils_1.createNewHcpApi)(env);
-        let calls = 0;
-        const authProvider = yield SmartAuthProvider_1.SmartAuthProvider.initialise(authApi, credentials.user, {
-            getSecret: (acceptedSecrets, previousAttempts) => __awaiter(void 0, void 0, void 0, function* () {
-                (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.PASSWORD);
-                (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.LONG_LIVED_TOKEN);
-                (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.SHORT_LIVED_TOKEN);
-                (0, chai_1.expect)(acceptedSecrets).to.not.include(SmartAuthProvider_1.AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN);
-                if (calls == 0) {
-                    (0, chai_1.expect)(previousAttempts).to.be.empty;
-                }
-                else if (calls == 1) {
-                    (0, chai_1.expect)(previousAttempts).to.have.length(1);
-                    (0, chai_1.expect)(previousAttempts[0].value).to.equal('wrong');
-                    (0, chai_1.expect)(previousAttempts[0].secretType).to.equal(SmartAuthProvider_1.AuthSecretType.LONG_LIVED_TOKEN);
-                }
-                else
-                    (0, assert_1.fail)(`Unexpected number of calls: ${calls}`);
-                return calls++ == 0
-                    ? { value: 'wrong', secretType: SmartAuthProvider_1.AuthSecretType.LONG_LIVED_TOKEN } // pragma: allowlist secret
-                    : { value: credentials.password, secretType: SmartAuthProvider_1.AuthSecretType.LONG_LIVED_TOKEN };
-            }),
-        });
-        const userApi = userApiWithProvider(authProvider);
-        const user = yield userApi.getCurrentUser();
-        (0, chai_1.expect)(user.healthcarePartyId).to.equal(credentials.dataOwnerId);
-        (0, chai_1.expect)(calls).to.equal(2);
-    }));
-    (0, test_utils_1.itNoLite)('Should automatically ask for a more powerful secret to perform elevated-security operations if the available secret/token is not good enough', () => __awaiter(void 0, void 0, void 0, function* () {
-        const { credentials, api } = yield (0, test_utils_1.createNewHcpApi)(env);
-        const initialUser = yield api.userApi.getCurrentUser();
-        const masterApi = yield initMasterApi(env);
-        const userToken = (0, crypto_1.randomUUID)();
-        const userPw = (0, crypto_1.randomUUID)();
-        const userWithLongTokenAndPw = yield masterApi.userApi.modifyUser(Object.assign(Object.assign({}, initialUser), { passwordHash: userPw, authenticationTokens: {
-                'test-long-lived-token': {
-                    token: userToken,
-                    creationTime: Date.now(),
-                    validity: 60 * 60 * 24 * 7,
-                },
-            } }));
-        let calls = 0;
-        const authProvider = yield SmartAuthProvider_1.SmartAuthProvider.initialise(authApi, credentials.user, {
-            getSecret: (acceptedSecrets, previousAttempts) => __awaiter(void 0, void 0, void 0, function* () {
-                if (calls == 0) {
-                    (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.PASSWORD);
-                    (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.LONG_LIVED_TOKEN);
-                    (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.SHORT_LIVED_TOKEN);
-                    (0, chai_1.expect)(acceptedSecrets).to.not.include(SmartAuthProvider_1.AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN);
-                    (0, chai_1.expect)(previousAttempts).to.be.empty;
-                    calls++;
-                    return { value: userToken, secretType: SmartAuthProvider_1.AuthSecretType.LONG_LIVED_TOKEN };
-                }
-                else if (calls == 1) {
-                    (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.PASSWORD);
-                    (0, chai_1.expect)(acceptedSecrets).to.not.include(SmartAuthProvider_1.AuthSecretType.LONG_LIVED_TOKEN);
-                    (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.SHORT_LIVED_TOKEN);
-                    (0, chai_1.expect)(acceptedSecrets).to.not.include(SmartAuthProvider_1.AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN);
-                    (0, chai_1.expect)(previousAttempts).to.be.empty;
-                    calls++;
-                    return { value: userPw, secretType: SmartAuthProvider_1.AuthSecretType.PASSWORD };
-                }
-                else
-                    throw new Error(`Unexpected number of calls: ${calls}`);
-            }),
-        });
-        const userApi = userApiWithProvider(authProvider);
-        (0, chai_1.expect)((yield userApi.getCurrentUser()).rev).to.equal(userWithLongTokenAndPw.rev);
-        (0, chai_1.expect)(calls).to.equal(1);
-        const newPw = (0, crypto_1.randomUUID)();
-        const userWithNewPw = yield userApi.modifyUser(Object.assign(Object.assign({}, userWithLongTokenAndPw), { passwordHash: newPw }));
-        (0, chai_1.expect)(userWithNewPw.rev).to.not.equal(userWithLongTokenAndPw.rev);
-        (0, chai_1.expect)(calls).to.equal(2);
-        const retrievedWithNewPw = yield userApiWithProvider(new icc_x_api_1.BasicAuthenticationProvider(credentials.user, newPw)).getCurrentUser();
-        (0, chai_1.expect)(retrievedWithNewPw.rev).to.equal(userWithNewPw.rev);
-        const couldRetrieveWithOldPw = yield userApiWithProvider(new icc_x_api_1.BasicAuthenticationProvider(credentials.user, userPw))
-            .getCurrentUser()
-            .then(() => true, () => false);
-        (0, chai_1.expect)(couldRetrieveWithOldPw).to.be.false;
-    }));
-    (0, test_utils_1.itNoLite)('Should automatically ask for TOTP after password if user has 2fa enabled', () => __awaiter(void 0, void 0, void 0, function* () {
-        const { credentials, api } = yield (0, test_utils_1.createNewHcpApi)(env);
-        const initialUser = yield api.userApi.getCurrentUser();
-        const masterApi = yield initMasterApi(env);
-        const totpSecret = 'AAPX7PW2RJIGZ3D4'; // pragma: allowlist secret (fake secret generated only for test)
-        const totp = new otpauth_1.TOTP({
-            algorithm: 'SHA1',
-            digits: 6,
-            period: 30,
-            secret: totpSecret,
-        });
-        const userPw = (0, crypto_1.randomUUID)();
-        yield masterApi.userApi.enable2fa(initialUser.id, totpSecret);
-        const userWithPwAnd2fa = yield masterApi.userApi.modifyUser(Object.assign(Object.assign({}, initialUser), { passwordHash: userPw }));
-        let calls = 0;
-        const authProvider = yield SmartAuthProvider_1.SmartAuthProvider.initialise(authApi, credentials.user, {
-            getSecret: (acceptedSecrets, previousAttempts) => __awaiter(void 0, void 0, void 0, function* () {
-                if (calls == 0) {
-                    (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.PASSWORD);
-                    (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.LONG_LIVED_TOKEN);
-                    (0, chai_1.expect)(acceptedSecrets).to.include(SmartAuthProvider_1.AuthSecretType.SHORT_LIVED_TOKEN);
-                    (0, chai_1.expect)(acceptedSecrets).to.not.include(SmartAuthProvider_1.AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN);
-                    (0, chai_1.expect)(previousAttempts).to.be.empty;
-                    calls++;
-                    return { value: userPw, secretType: SmartAuthProvider_1.AuthSecretType.PASSWORD };
-                }
-                else if (calls == 1 || calls == 2) {
-                    (0, chai_1.expect)(acceptedSecrets).to.have.members([SmartAuthProvider_1.AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN]);
-                    if (calls == 1)
-                        (0, chai_1.expect)(previousAttempts).to.be.empty;
-                    if (calls == 2)
-                        (0, chai_1.expect)(previousAttempts).to.have.length(1);
-                    return calls++ == 1
-                        ? { value: totp.generate() + '13', secretType: SmartAuthProvider_1.AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN }
-                        : { value: totp.generate(), secretType: SmartAuthProvider_1.AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN };
-                }
-                else
-                    throw new Error(`Unexpected number of calls: ${calls}`);
-            }),
-        });
-        const userApi = userApiWithProvider(authProvider);
-        (0, chai_1.expect)((yield userApi.getCurrentUser()).rev).to.equal(userWithPwAnd2fa.rev);
-        (0, chai_1.expect)(calls).to.equal(3);
-    }));
-    (0, test_utils_1.itNoLite)('Should ask for TOTP directly if password is cached', () => __awaiter(void 0, void 0, void 0, function* () {
-        const { credentials, api } = yield (0, test_utils_1.createNewHcpApi)(env);
-        const initialUser = yield api.userApi.getCurrentUser();
-        const masterApi = yield initMasterApi(env);
-        const totpSecret = 'AAPX7PW2RJIGZ3D4'; // pragma: allowlist secret (fake secret generated only for test)
-        const totp = new otpauth_1.TOTP({
-            algorithm: 'SHA1',
-            digits: 6,
-            period: 30,
-            secret: totpSecret,
-        });
-        const userPw = (0, crypto_1.randomUUID)();
-        yield masterApi.userApi.enable2fa(initialUser.id, totpSecret);
-        const userWithPwAnd2fa = yield masterApi.userApi.modifyUser(Object.assign(Object.assign({}, initialUser), { passwordHash: userPw }));
-        let calls = 0;
-        const authProvider = yield SmartAuthProvider_1.SmartAuthProvider.initialise(authApi, credentials.user, {
-            getSecret: (acceptedSecrets, previousAttempts) => __awaiter(void 0, void 0, void 0, function* () {
-                (0, chai_1.expect)(acceptedSecrets).to.have.members([SmartAuthProvider_1.AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN]);
-                (0, chai_1.expect)(previousAttempts).to.be.empty;
-                (0, chai_1.expect)(calls++).to.equal(0);
-                return { value: totp.generate(), secretType: SmartAuthProvider_1.AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN };
-            }),
-        }, {
-            initialSecret: { password: userPw },
-        });
-        const userApi = userApiWithProvider(authProvider);
-        (0, chai_1.expect)((yield userApi.getCurrentUser()).rev).to.equal(userWithPwAnd2fa.rev);
-        (0, chai_1.expect)(calls).to.equal(1);
-    }));
-    (0, test_utils_1.itNoLite)('Switched provider should keep cached secrets and should be able to have elevated security context', () => __awaiter(void 0, void 0, void 0, function* () {
-        var _a;
-        const details = yield (0, test_utils_1.createUserInMultipleGroups)(env);
-        let calls = 0;
-        const authProvider = yield SmartAuthProvider_1.SmartAuthProvider.initialise(authApi, details.userLogin, {
-            getSecret: (acceptedSecrets, previousAttempts) => __awaiter(void 0, void 0, void 0, function* () {
-                (0, chai_1.expect)(acceptedSecrets).to.have.include(SmartAuthProvider_1.AuthSecretType.PASSWORD);
-                (0, chai_1.expect)(previousAttempts).to.be.empty;
-                (0, chai_1.expect)(calls++).to.equal(0);
-                return { value: details.userPw12, secretType: SmartAuthProvider_1.AuthSecretType.PASSWORD };
-            }),
-        });
-        const defaultGroupUserApi = userApiWithProvider(authProvider);
-        const defaultGroupUser = yield defaultGroupUserApi.getCurrentUser();
-        const otherGroupId = details.group1.id == defaultGroupUser.groupId ? details.group2.id : details.group1.id;
-        const matches = yield defaultGroupUserApi.getMatchingUsers();
-        const switchedUserApi = userApiWithProvider(yield authProvider.switchGroup(otherGroupId, matches));
-        const switchedUser = yield switchedUserApi.getCurrentUser();
-        (0, chai_1.expect)(switchedUser.id).to.not.equal(defaultGroupUser.id);
-        (0, chai_1.expect)(switchedUser.groupId).to.equal(otherGroupId);
-        const updatedDefault = yield switchedUserApi.modifyUser(Object.assign(Object.assign({}, switchedUser), { authenticationTokens: {
-                'new-token': {
-                    token: (0, crypto_1.randomUUID)(),
-                    creationTime: Date.now(),
-                    validity: 60 * 60 * 24 * 7,
-                },
-            } }));
-        (0, chai_1.expect)(updatedDefault.rev).to.not.equal(switchedUser.rev);
-        (0, chai_1.expect)(Object.keys((_a = updatedDefault.authenticationTokens) !== null && _a !== void 0 ? _a : {})).to.not.be.empty;
-    }));
-});
-//# sourceMappingURL=smart-auth-provider-test.js.map

package/test/icc-x-api/auth/smart-auth-provider-test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"smart-auth-provider-test.js","sourceRoot":"","sources":["../../../../test/icc-x-api/auth/smart-auth-provider-test.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,mDAAmE;AACnE,iCAA8B;AAC9B,uDAAqJ;AACrJ,kDAAkH;AAClH,8CAAyD;AACzD,4BAAyB;AACzB,iFAAgH;AAChH,+BAA6B;AAC7B,mCAAmC;AACnC,IAAO,aAAa,GAAG,sBAAS,CAAC,aAAa,CAAA;AAC9C,mCAA6B;AAC7B,qCAA8B;AAC9B,IAAA,4BAAe,EAAC,KAAK,CAAC,CAAA;AAEtB,IAAI,GAAa,CAAA;AACjB,IAAI,OAAmB,CAAA;AAEvB,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,IAAA,cAAM,EAAC;;YACL,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACpB,MAAM,WAAW,GAAG,MAAM,IAAA,sCAAyB,GAAE,CAAA;YACrD,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAA,uBAAe,GAAE,CAAC,CAAA;YAClD,OAAO,GAAG,IAAI,oBAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,oCAAwB,EAAE,EAAE,KAAK,CAAC,CAAA;QACnF,CAAC;KAAA,CAAC,CAAA;IAEF,SAAS,mBAAmB,CAAC,YAAoC;QAC/D,OAAO,IAAI,oBAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;IAC9D,CAAC;IAED,EAAE,CAAC,kGAAkG,EAAE,GAAS,EAAE;QAChH,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,4BAAe,EAAC,GAAG,CAAC,CAAA;QAClD,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,MAAM,YAAY,GAAG,MAAM,qCAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE;YACjF,SAAS,EAAE,CAAO,eAAiC,EAAE,gBAAqC,EAAE,EAAE;gBAC5F,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,QAAQ,CAAC,CAAA;gBAC3D,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,gBAAgB,CAAC,CAAA;gBACnE,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,iBAAiB,CAAC,CAAA;gBACpE,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,kCAAc,CAAC,+BAA+B,CAAC,CAAA;gBACtF,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBACf,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAA;gBACtC,CAAC;qBAAM,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBACtB,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;oBAC1C,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;oBACnD,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,kCAAc,CAAC,gBAAgB,CAAC,CAAA;gBAClF,CAAC;;oBAAM,IAAA,aAAI,EAAC,+BAA+B,KAAK,EAAE,CAAC,CAAA;gBACnD,OAAO,KAAK,EAAE,IAAI,CAAC;oBACjB,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,kCAAc,CAAC,gBAAgB,EAAE,CAAC,2BAA2B;oBAC7F,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,UAAU,EAAE,kCAAc,CAAC,gBAAgB,EAAE,CAAA;YAClF,CAAC,CAAA;SACF,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAA;QACjD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,CAAA;QAC3C,IAAA,aAAM,EAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA;QAChE,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC,CAAA,CAAC,CAAA;IAEF,IAAA,qBAAQ,EACN,8IAA8I,EAC9I,GAAS,EAAE;QACT,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,4BAAe,EAAC,GAAG,CAAC,CAAA;QACvD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACtD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,IAAA,mBAAU,GAAE,CAAA;QAC9B,MAAM,MAAM,GAAG,IAAA,mBAAU,GAAE,CAAA;QAC3B,MAAM,sBAAsB,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,iCAC5D,WAAW,KACd,YAAY,EAAE,MAAM,EACpB,oBAAoB,EAAE;gBACpB,uBAAuB,EAAE;oBACvB,KAAK,EAAE,SAAS;oBAChB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;oBACxB,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;iBAC3B;aACF,IACD,CAAA;QACF,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,MAAM,YAAY,GAAG,MAAM,qCAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE;YACjF,SAAS,EAAE,CAAO,eAAiC,EAAE,gBAAqC,EAAE,EAAE;gBAC5F,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBACf,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,QAAQ,CAAC,CAAA;oBAC3D,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,gBAAgB,CAAC,CAAA;oBACnE,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,iBAAiB,CAAC,CAAA;oBACpE,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,kCAAc,CAAC,+BAA+B,CAAC,CAAA;oBACtF,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAA;oBACpC,KAAK,EAAE,CAAA;oBACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,kCAAc,CAAC,gBAAgB,EAAE,CAAA;gBAC1E,CAAC;qBAAM,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBACtB,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,QAAQ,CAAC,CAAA;oBAC3D,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,kCAAc,CAAC,gBAAgB,CAAC,CAAA;oBACvE,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,iBAAiB,CAAC,CAAA;oBACpE,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,kCAAc,CAAC,+BAA+B,CAAC,CAAA;oBACtF,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAA;oBACpC,KAAK,EAAE,CAAA;oBACP,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,kCAAc,CAAC,QAAQ,EAAE,CAAA;gBAC/D,CAAC;;oBAAM,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAA;YAChE,CAAC,CAAA;SACF,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAA;QACjD,IAAA,aAAM,EAAC,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAA;QACjF,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,KAAK,GAAG,IAAA,mBAAU,GAAE,CAAA;QAC1B,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,UAAU,iCAAM,sBAAsB,KAAE,YAAY,EAAE,KAAK,IAAG,CAAA;QAClG,IAAA,aAAM,EAAC,aAAa,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAA;QAClE,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,kBAAkB,GAAG,MAAM,mBAAmB,CAAC,IAAI,uCAA2B,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,cAAc,EAAE,CAAA;QAC/H,IAAA,aAAM,EAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QAC1D,MAAM,sBAAsB,GAAG,MAAM,mBAAmB,CAAC,IAAI,uCAA2B,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;aAChH,cAAc,EAAE;aAChB,IAAI,CACH,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAA;QACH,IAAA,aAAM,EAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAA;IAC5C,CAAC,CAAA,CACF,CAAA;IAED,IAAA,qBAAQ,EAAC,0EAA0E,EAAE,GAAS,EAAE;QAC9F,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,4BAAe,EAAC,GAAG,CAAC,CAAA;QACvD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACtD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,UAAU,GAAG,kBAAkB,CAAA,CAAC,iEAAiE;QACvG,MAAM,IAAI,GAAG,IAAI,cAAI,CAAC;YACpB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU;SACnB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,IAAA,mBAAU,GAAE,CAAA;QAC3B,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAG,EAAE,UAAU,CAAC,CAAA;QAC9D,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,iCACtD,WAAW,KACd,YAAY,EAAE,MAAM,IACpB,CAAA;QACF,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,MAAM,YAAY,GAAG,MAAM,qCAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,EAAE;YACjF,SAAS,EAAE,CAAO,eAAiC,EAAE,gBAAqC,EAAE,EAAE;gBAC5F,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBACf,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,QAAQ,CAAC,CAAA;oBAC3D,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,gBAAgB,CAAC,CAAA;oBACnE,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,kCAAc,CAAC,iBAAiB,CAAC,CAAA;oBACpE,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,kCAAc,CAAC,+BAA+B,CAAC,CAAA;oBACtF,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAA;oBACpC,KAAK,EAAE,CAAA;oBACP,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,kCAAc,CAAC,QAAQ,EAAE,CAAA;gBAC/D,CAAC;qBAAM,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBACpC,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,kCAAc,CAAC,+BAA+B,CAAC,CAAC,CAAA;oBACzF,IAAI,KAAK,IAAI,CAAC;wBAAE,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAA;oBACpD,IAAI,KAAK,IAAI,CAAC;wBAAE,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;oBAC1D,OAAO,KAAK,EAAE,IAAI,CAAC;wBACjB,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,kCAAc,CAAC,+BAA+B,EAAE;wBAC/F,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,kCAAc,CAAC,+BAA+B,EAAE,CAAA;gBAC5F,CAAC;;oBAAM,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAA;YAChE,CAAC,CAAA;SACF,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAA;QACjD,IAAA,aAAM,EAAC,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC3E,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC,CAAA,CAAC,CAAA;IAEF,IAAA,qBAAQ,EAAC,oDAAoD,EAAE,GAAS,EAAE;QACxE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,4BAAe,EAAC,GAAG,CAAC,CAAA;QACvD,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;QACtD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,UAAU,GAAG,kBAAkB,CAAA,CAAC,iEAAiE;QACvG,MAAM,IAAI,GAAG,IAAI,cAAI,CAAC;YACpB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU;SACnB,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,IAAA,mBAAU,GAAE,CAAA;QAC3B,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,EAAG,EAAE,UAAU,CAAC,CAAA;QAC9D,MAAM,gBAAgB,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,UAAU,iCACtD,WAAW,KACd,YAAY,EAAE,MAAM,IACpB,CAAA;QACF,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,MAAM,YAAY,GAAG,MAAM,qCAAiB,CAAC,UAAU,CACrD,OAAO,EACP,WAAW,CAAC,IAAI,EAChB;YACE,SAAS,EAAE,CAAO,eAAiC,EAAE,gBAAqC,EAAE,EAAE;gBAC5F,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,kCAAc,CAAC,+BAA+B,CAAC,CAAC,CAAA;gBACzF,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAA;gBACpC,IAAA,aAAM,EAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAC3B,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,kCAAc,CAAC,+BAA+B,EAAE,CAAA;YAC/F,CAAC,CAAA;SACF,EACD;YACE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;SACpC,CACF,CAAA;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAA;QACjD,IAAA,aAAM,EAAC,CAAC,MAAM,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC3E,IAAA,aAAM,EAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC,CAAA,CAAC,CAAA;IAEF,IAAA,qBAAQ,EAAC,mGAAmG,EAAE,GAAS,EAAE;;QACvH,MAAM,OAAO,GAAG,MAAM,IAAA,uCAA0B,EAAC,GAAG,CAAC,CAAA;QACrD,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,MAAM,YAAY,GAAG,MAAM,qCAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE;YAClF,SAAS,EAAE,CAAO,eAAiC,EAAE,gBAAqC,EAAE,EAAE;gBAC5F,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,kCAAc,CAAC,QAAQ,CAAC,CAAA;gBAChE,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAA;gBACpC,IAAA,aAAM,EAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;gBAC3B,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,kCAAc,CAAC,QAAQ,EAAE,CAAA;YACzE,CAAC,CAAA;SACF,CAAC,CAAA;QACF,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAC7D,MAAM,gBAAgB,GAAG,MAAM,mBAAmB,CAAC,cAAc,EAAE,CAAA;QACnE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAA;QAC1G,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,gBAAgB,EAAE,CAAA;QAC5D,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,YAAa,EAAE,OAAO,CAAC,CAAC,CAAA;QACnG,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,cAAc,EAAE,CAAA;QAC3D,IAAA,aAAM,EAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;QACzD,IAAA,aAAM,EAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QACnD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,UAAU,iCAClD,YAAY,KACf,oBAAoB,EAAE;gBACpB,WAAW,EAAE;oBACX,KAAK,EAAE,IAAA,mBAAU,GAAE;oBACnB,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE;oBACxB,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;iBAC3B;aACF,IACD,CAAA;QACF,IAAA,aAAM,EAAC,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QACzD,IAAA,aAAM,EAAC,MAAM,CAAC,IAAI,CAAC,MAAA,cAAc,CAAC,oBAAoB,mCAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAA;IAChF,CAAC,CAAA,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { getEnvVariables, TestVars } from '@icure/test-setup/types'\nimport { before } from 'mocha'\nimport { createNewHcpApi, createUserInMultipleGroups, getEnvironmentInitializer, itNoLite, setLocalStorage, TestUtils } from '../../utils/test_utils'\nimport { AuthenticationProvider, BasicAuthenticationProvider, NoAuthenticationProvider } from '../../../icc-x-api'\nimport { IccAuthApi, IccUserApi } from '../../../icc-api'\nimport 'isomorphic-fetch'\nimport { AuthSecretDetails, AuthSecretType, SmartAuthProvider } from '../../../icc-x-api/auth/SmartAuthProvider'\nimport { expect } from 'chai'\nimport { randomUUID } from 'crypto'\nimport initMasterApi = TestUtils.initMasterApi\nimport { fail } from 'assert'\nimport { TOTP } from 'otpauth'\nsetLocalStorage(fetch)\n\nlet env: TestVars\nlet authApi: IccAuthApi\n\ndescribe('Smart authentication provider', () => {\n  before(async function () {\n    this.timeout(600000)\n    const initializer = await getEnvironmentInitializer()\n    env = await initializer.execute(getEnvVariables())\n    authApi = new IccAuthApi(env.iCureUrl, {}, new NoAuthenticationProvider(), fetch)\n  })\n\n  function userApiWithProvider(authProvider: AuthenticationProvider): IccUserApi {\n    return new IccUserApi(env.iCureUrl, {}, authProvider, fetch)\n  }\n\n  it('Should automatically ask for secret to get a new token, and reasks the secret if it is not valid', async () => {\n    const { credentials } = await createNewHcpApi(env)\n    let calls = 0\n    const authProvider = await SmartAuthProvider.initialise(authApi, credentials.user, {\n      getSecret: async (acceptedSecrets: AuthSecretType[], previousAttempts: AuthSecretDetails[]) => {\n        expect(acceptedSecrets).to.include(AuthSecretType.PASSWORD)\n        expect(acceptedSecrets).to.include(AuthSecretType.LONG_LIVED_TOKEN)\n        expect(acceptedSecrets).to.include(AuthSecretType.SHORT_LIVED_TOKEN)\n        expect(acceptedSecrets).to.not.include(AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN)\n        if (calls == 0) {\n          expect(previousAttempts).to.be.empty\n        } else if (calls == 1) {\n          expect(previousAttempts).to.have.length(1)\n          expect(previousAttempts[0].value).to.equal('wrong')\n          expect(previousAttempts[0].secretType).to.equal(AuthSecretType.LONG_LIVED_TOKEN)\n        } else fail(`Unexpected number of calls: ${calls}`)\n        return calls++ == 0\n          ? { value: 'wrong', secretType: AuthSecretType.LONG_LIVED_TOKEN } // pragma: allowlist secret\n          : { value: credentials.password, secretType: AuthSecretType.LONG_LIVED_TOKEN }\n      },\n    })\n    const userApi = userApiWithProvider(authProvider)\n    const user = await userApi.getCurrentUser()\n    expect(user.healthcarePartyId).to.equal(credentials.dataOwnerId)\n    expect(calls).to.equal(2)\n  })\n\n  itNoLite(\n    'Should automatically ask for a more powerful secret to perform elevated-security operations if the available secret/token is not good enough',\n    async () => {\n      const { credentials, api } = await createNewHcpApi(env)\n      const initialUser = await api.userApi.getCurrentUser()\n      const masterApi = await initMasterApi(env)\n      const userToken = randomUUID()\n      const userPw = randomUUID()\n      const userWithLongTokenAndPw = await masterApi.userApi.modifyUser({\n        ...initialUser,\n        passwordHash: userPw,\n        authenticationTokens: {\n          'test-long-lived-token': {\n            token: userToken,\n            creationTime: Date.now(),\n            validity: 60 * 60 * 24 * 7,\n          },\n        },\n      })\n      let calls = 0\n      const authProvider = await SmartAuthProvider.initialise(authApi, credentials.user, {\n        getSecret: async (acceptedSecrets: AuthSecretType[], previousAttempts: AuthSecretDetails[]) => {\n          if (calls == 0) {\n            expect(acceptedSecrets).to.include(AuthSecretType.PASSWORD)\n            expect(acceptedSecrets).to.include(AuthSecretType.LONG_LIVED_TOKEN)\n            expect(acceptedSecrets).to.include(AuthSecretType.SHORT_LIVED_TOKEN)\n            expect(acceptedSecrets).to.not.include(AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN)\n            expect(previousAttempts).to.be.empty\n            calls++\n            return { value: userToken, secretType: AuthSecretType.LONG_LIVED_TOKEN }\n          } else if (calls == 1) {\n            expect(acceptedSecrets).to.include(AuthSecretType.PASSWORD)\n            expect(acceptedSecrets).to.not.include(AuthSecretType.LONG_LIVED_TOKEN)\n            expect(acceptedSecrets).to.include(AuthSecretType.SHORT_LIVED_TOKEN)\n            expect(acceptedSecrets).to.not.include(AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN)\n            expect(previousAttempts).to.be.empty\n            calls++\n            return { value: userPw, secretType: AuthSecretType.PASSWORD }\n          } else throw new Error(`Unexpected number of calls: ${calls}`)\n        },\n      })\n      const userApi = userApiWithProvider(authProvider)\n      expect((await userApi.getCurrentUser()).rev).to.equal(userWithLongTokenAndPw.rev)\n      expect(calls).to.equal(1)\n      const newPw = randomUUID()\n      const userWithNewPw = await userApi.modifyUser({ ...userWithLongTokenAndPw, passwordHash: newPw })\n      expect(userWithNewPw.rev).to.not.equal(userWithLongTokenAndPw.rev)\n      expect(calls).to.equal(2)\n      const retrievedWithNewPw = await userApiWithProvider(new BasicAuthenticationProvider(credentials.user, newPw)).getCurrentUser()\n      expect(retrievedWithNewPw.rev).to.equal(userWithNewPw.rev)\n      const couldRetrieveWithOldPw = await userApiWithProvider(new BasicAuthenticationProvider(credentials.user, userPw))\n        .getCurrentUser()\n        .then(\n          () => true,\n          () => false\n        )\n      expect(couldRetrieveWithOldPw).to.be.false\n    }\n  )\n\n  itNoLite('Should automatically ask for TOTP after password if user has 2fa enabled', async () => {\n    const { credentials, api } = await createNewHcpApi(env)\n    const initialUser = await api.userApi.getCurrentUser()\n    const masterApi = await initMasterApi(env)\n    const totpSecret = 'AAPX7PW2RJIGZ3D4' // pragma: allowlist secret (fake secret generated only for test)\n    const totp = new TOTP({\n      algorithm: 'SHA1',\n      digits: 6,\n      period: 30,\n      secret: totpSecret,\n    })\n    const userPw = randomUUID()\n    await masterApi.userApi.enable2fa(initialUser.id!, totpSecret)\n    const userWithPwAnd2fa = await masterApi.userApi.modifyUser({\n      ...initialUser,\n      passwordHash: userPw,\n    })\n    let calls = 0\n    const authProvider = await SmartAuthProvider.initialise(authApi, credentials.user, {\n      getSecret: async (acceptedSecrets: AuthSecretType[], previousAttempts: AuthSecretDetails[]) => {\n        if (calls == 0) {\n          expect(acceptedSecrets).to.include(AuthSecretType.PASSWORD)\n          expect(acceptedSecrets).to.include(AuthSecretType.LONG_LIVED_TOKEN)\n          expect(acceptedSecrets).to.include(AuthSecretType.SHORT_LIVED_TOKEN)\n          expect(acceptedSecrets).to.not.include(AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN)\n          expect(previousAttempts).to.be.empty\n          calls++\n          return { value: userPw, secretType: AuthSecretType.PASSWORD }\n        } else if (calls == 1 || calls == 2) {\n          expect(acceptedSecrets).to.have.members([AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN])\n          if (calls == 1) expect(previousAttempts).to.be.empty\n          if (calls == 2) expect(previousAttempts).to.have.length(1)\n          return calls++ == 1\n            ? { value: totp.generate() + '13', secretType: AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN }\n            : { value: totp.generate(), secretType: AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN }\n        } else throw new Error(`Unexpected number of calls: ${calls}`)\n      },\n    })\n    const userApi = userApiWithProvider(authProvider)\n    expect((await userApi.getCurrentUser()).rev).to.equal(userWithPwAnd2fa.rev)\n    expect(calls).to.equal(3)\n  })\n\n  itNoLite('Should ask for TOTP directly if password is cached', async () => {\n    const { credentials, api } = await createNewHcpApi(env)\n    const initialUser = await api.userApi.getCurrentUser()\n    const masterApi = await initMasterApi(env)\n    const totpSecret = 'AAPX7PW2RJIGZ3D4' // pragma: allowlist secret (fake secret generated only for test)\n    const totp = new TOTP({\n      algorithm: 'SHA1',\n      digits: 6,\n      period: 30,\n      secret: totpSecret,\n    })\n    const userPw = randomUUID()\n    await masterApi.userApi.enable2fa(initialUser.id!, totpSecret)\n    const userWithPwAnd2fa = await masterApi.userApi.modifyUser({\n      ...initialUser,\n      passwordHash: userPw,\n    })\n    let calls = 0\n    const authProvider = await SmartAuthProvider.initialise(\n      authApi,\n      credentials.user,\n      {\n        getSecret: async (acceptedSecrets: AuthSecretType[], previousAttempts: AuthSecretDetails[]) => {\n          expect(acceptedSecrets).to.have.members([AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN])\n          expect(previousAttempts).to.be.empty\n          expect(calls++).to.equal(0)\n          return { value: totp.generate(), secretType: AuthSecretType.TWO_FACTOR_AUTHENTICATION_TOKEN }\n        },\n      },\n      {\n        initialSecret: { password: userPw },\n      }\n    )\n    const userApi = userApiWithProvider(authProvider)\n    expect((await userApi.getCurrentUser()).rev).to.equal(userWithPwAnd2fa.rev)\n    expect(calls).to.equal(1)\n  })\n\n  itNoLite('Switched provider should keep cached secrets and should be able to have elevated security context', async () => {\n    const details = await createUserInMultipleGroups(env)\n    let calls = 0\n    const authProvider = await SmartAuthProvider.initialise(authApi, details.userLogin, {\n      getSecret: async (acceptedSecrets: AuthSecretType[], previousAttempts: AuthSecretDetails[]) => {\n        expect(acceptedSecrets).to.have.include(AuthSecretType.PASSWORD)\n        expect(previousAttempts).to.be.empty\n        expect(calls++).to.equal(0)\n        return { value: details.userPw12, secretType: AuthSecretType.PASSWORD }\n      },\n    })\n    const defaultGroupUserApi = userApiWithProvider(authProvider)\n    const defaultGroupUser = await defaultGroupUserApi.getCurrentUser()\n    const otherGroupId = details.group1.id == defaultGroupUser.groupId ? details.group2.id : details.group1.id\n    const matches = await defaultGroupUserApi.getMatchingUsers()\n    const switchedUserApi = userApiWithProvider(await authProvider.switchGroup(otherGroupId!, matches))\n    const switchedUser = await switchedUserApi.getCurrentUser()\n    expect(switchedUser.id).to.not.equal(defaultGroupUser.id)\n    expect(switchedUser.groupId).to.equal(otherGroupId)\n    const updatedDefault = await switchedUserApi.modifyUser({\n      ...switchedUser,\n      authenticationTokens: {\n        'new-token': {\n          token: randomUUID(),\n          creationTime: Date.now(),\n          validity: 60 * 60 * 24 * 7,\n        },\n      },\n    })\n    expect(updatedDefault.rev).to.not.equal(switchedUser.rev)\n    expect(Object.keys(updatedDefault.authenticationTokens ?? {})).to.not.be.empty\n  })\n})\n"]}

package/test/icc-x-api/autofix-anonymity-test.d.ts

@@ -1 +0,0 @@
-import 'isomorphic-fetch';

package/test/icc-x-api/autofix-anonymity-test.js

@@ -1,122 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const mocha_1 = require("mocha");
-const test_utils_1 = require("../utils/test_utils");
-const types_1 = require("@icure/test-setup/types");
-const DataOwnerTypeEnum_1 = require("../../icc-api/model/DataOwnerTypeEnum");
-const icc_x_api_1 = require("../../icc-x-api");
-const chai_1 = require("chai");
-const TestStorage_1 = require("../utils/TestStorage");
-const crypto_1 = require("crypto");
-require("isomorphic-fetch");
-(0, test_utils_1.setLocalStorage)(fetch);
-let env;
-describe('Autofix anonymity tests', () => {
-    (0, mocha_1.before)(function () {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.timeout(600000);
-            const initializer = yield (0, test_utils_1.getEnvironmentInitializer)();
-            env = yield initializer.execute((0, types_1.getEnvVariables)());
-        });
-    });
-    function initApi(dataOwnerType, isAnonymous) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const cryptoStrats = {
-                dataOwnerRequiresAnonymousDelegation(dataOwner) {
-                    if (isAnonymous)
-                        return dataOwner.type == dataOwnerType;
-                    else
-                        return false;
-                },
-                generateNewKeyForDataOwner(self, cryptoPrimitives) {
-                    throw new Error('This method should not be necessary for this test');
-                },
-                recoverAndVerifySelfHierarchyKeys(keysData, cryptoPrimitives) {
-                    throw new Error('This method should not be necessary for this test');
-                },
-                verifyDelegatePublicKeys(delegate, publicKeys, cryptoPrimitives) {
-                    return Promise.resolve(publicKeys);
-                },
-            };
-            let userDetails;
-            if (dataOwnerType == DataOwnerTypeEnum_1.DataOwnerTypeEnum.Patient) {
-                userDetails = (yield (0, test_utils_1.createNewPatientApi)(env)).credentials;
-            }
-            else if (dataOwnerType == DataOwnerTypeEnum_1.DataOwnerTypeEnum.Hcp) {
-                userDetails = (yield (0, test_utils_1.createNewHcpApi)(env)).credentials;
-            }
-            else
-                throw new Error('Unsupported data owner type');
-            const storage = yield (0, TestStorage_1.testStorageWithKeys)([
-                {
-                    dataOwnerId: userDetails.dataOwnerId,
-                    pairs: [{ keyPair: { publicKey: userDetails.publicKey, privateKey: userDetails.privateKey }, shaVersion: icc_x_api_1.ShaVersion.Sha1 }],
-                },
-            ]);
-            const api = yield icc_x_api_1.IcureApi.initialise(env.iCureUrl, { username: userDetails.user, password: userDetails.password }, cryptoStrats, crypto_1.webcrypto, fetch, {
-                keyStorage: storage.keyStorage,
-                entryKeysFactory: storage.keyFactory,
-                storage: storage.storage,
-            });
-            (0, chai_1.expect)((yield api.dataOwnerApi.getCurrentDataOwnerStub()).type).to.eq(dataOwnerType);
-            return api;
-        });
-    }
-    function doTest(dataOwnerType, isAnonymous) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const api = yield initApi(dataOwnerType, isAnonymous);
-            const user = yield api.userApi.getCurrentUser();
-            const createdWithNewInstance = yield api.patientApi.createPatientWithUser(user, yield api.patientApi.newInstance(user, { firstName: 'q', lastName: 'q' }));
-            const createdByBackend = yield api.agendaApi.createAgenda({ id: api.cryptoApi.primitives.randomUuid(), name: 'whatever' });
-            if (isAnonymous) {
-                (0, chai_1.expect)(createdWithNewInstance.author).to.eq(undefined);
-                (0, chai_1.expect)(createdWithNewInstance.responsible).to.eq(undefined);
-                (0, chai_1.expect)(createdByBackend.author).to.eq(undefined);
-                (0, chai_1.expect)(createdByBackend.responsible).to.eq(undefined);
-            }
-            else {
-                const doId = api.dataOwnerApi.getDataOwnerIdOf(user);
-                (0, chai_1.expect)(createdWithNewInstance.author).to.eq(user.id);
-                (0, chai_1.expect)(createdWithNewInstance.responsible).to.eq(doId);
-                (0, chai_1.expect)(createdByBackend.author).to.eq(user.id);
-                (0, chai_1.expect)(createdByBackend.responsible).to.eq(doId);
-            }
-            const modified = yield api.agendaApi.modifyAgenda(Object.assign(Object.assign({}, createdByBackend), { name: 'whatever 2' }));
-            if (isAnonymous) {
-                (0, chai_1.expect)(createdWithNewInstance.author).to.eq(undefined);
-                (0, chai_1.expect)(createdWithNewInstance.responsible).to.eq(undefined);
-                (0, chai_1.expect)(createdByBackend.author).to.eq(undefined);
-                (0, chai_1.expect)(createdByBackend.responsible).to.eq(undefined);
-            }
-            else {
-                const doId = api.dataOwnerApi.getDataOwnerIdOf(user);
-                (0, chai_1.expect)(createdWithNewInstance.author).to.eq(user.id);
-                (0, chai_1.expect)(createdWithNewInstance.responsible).to.eq(doId);
-                (0, chai_1.expect)(createdByBackend.author).to.eq(user.id);
-                (0, chai_1.expect)(createdByBackend.responsible).to.eq(doId);
-            }
-        });
-    }
-    it('Entity created by a patient should omit author and responsible if crypto strategies require anonymous delegations for the user', () => __awaiter(void 0, void 0, void 0, function* () {
-        yield doTest(DataOwnerTypeEnum_1.DataOwnerTypeEnum.Patient, true);
-    }));
-    it('Entity created by a patient should autofix author and responsible if crypto strategies does not require anonymous delegations for the user', () => __awaiter(void 0, void 0, void 0, function* () {
-        yield doTest(DataOwnerTypeEnum_1.DataOwnerTypeEnum.Patient, false);
-    }));
-    it('Entity created by a HCP should omit author and responsible if crypto strategies require anonymous delegations for the user', () => __awaiter(void 0, void 0, void 0, function* () {
-        yield doTest(DataOwnerTypeEnum_1.DataOwnerTypeEnum.Hcp, true);
-    }));
-    it('Entity created by a HCP should autofix author and responsible if crypto strategies does not require anonymous delegations for the user', () => __awaiter(void 0, void 0, void 0, function* () {
-        yield doTest(DataOwnerTypeEnum_1.DataOwnerTypeEnum.Hcp, false);
-    }));
-});
-//# sourceMappingURL=autofix-anonymity-test.js.map

package/test/icc-x-api/autofix-anonymity-test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"autofix-anonymity-test.js","sourceRoot":"","sources":["../../../test/icc-x-api/autofix-anonymity-test.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,iCAA8B;AAC9B,oDAAsH;AACtH,mDAAgF;AAChF,6EAAyE;AACzE,+CAAmG;AACnG,+BAA6B;AAG7B,sDAA0D;AAC1D,mCAAkC;AAElC,4BAAyB;AAEzB,IAAA,4BAAe,EAAC,KAAK,CAAC,CAAA;AAEtB,IAAI,GAAa,CAAA;AAEjB,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,IAAA,cAAM,EAAC;;YACL,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACpB,MAAM,WAAW,GAAG,MAAM,IAAA,sCAAyB,GAAE,CAAA;YACrD,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAA,uBAAe,GAAE,CAAC,CAAA;QACpD,CAAC;KAAA,CAAC,CAAA;IAEF,SAAe,OAAO,CAAC,aAAgC,EAAE,WAAoB;;YAC3E,MAAM,YAAY,GAAqB;gBACrC,oCAAoC,CAAC,SAAkC;oBACrE,IAAI,WAAW;wBAAE,OAAO,SAAS,CAAC,IAAI,IAAI,aAAa,CAAA;;wBAClD,OAAO,KAAK,CAAA;gBACnB,CAAC;gBACD,0BAA0B,CAAC,IAAuB,EAAE,gBAAkC;oBACpF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;gBACtE,CAAC;gBACD,iCAAiC,CAC/B,QAIG,EACH,gBAAkC;oBAIlC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;gBACtE,CAAC;gBACD,wBAAwB,CAAC,QAAiC,EAAE,UAAoB,EAAE,gBAAkC;oBAClH,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;gBACpC,CAAC;aACF,CAAA;YACD,IAAI,WAAwB,CAAA;YAC5B,IAAI,aAAa,IAAI,qCAAiB,CAAC,OAAO,EAAE,CAAC;gBAC/C,WAAW,GAAG,CAAC,MAAM,IAAA,gCAAmB,EAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAA;YAC5D,CAAC;iBAAM,IAAI,aAAa,IAAI,qCAAiB,CAAC,GAAG,EAAE,CAAC;gBAClD,WAAW,GAAG,CAAC,MAAM,IAAA,4BAAe,EAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAA;YACxD,CAAC;;gBAAM,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;YACrD,MAAM,OAAO,GAAG,MAAM,IAAA,iCAAmB,EAAC;gBACxC;oBACE,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,EAAE,UAAU,EAAE,sBAAU,CAAC,IAAI,EAAE,CAAC;iBAC5H;aACF,CAAC,CAAA;YACF,MAAM,GAAG,GAAG,MAAM,oBAAQ,CAAC,UAAU,CACnC,GAAG,CAAC,QAAQ,EACZ,EAAE,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,EAC9D,YAAY,EACZ,kBAAgB,EAChB,KAAK,EACL;gBACE,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,gBAAgB,EAAE,OAAO,CAAC,UAAU;gBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CACF,CAAA;YACD,IAAA,aAAM,EAAC,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,uBAAuB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAA;YACpF,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAED,SAAe,MAAM,CAAC,aAAgC,EAAE,WAAoB;;YAC1E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;YACrD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;YAC/C,MAAM,sBAAsB,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,qBAAqB,CACvE,IAAI,EACJ,MAAM,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAC1E,CAAA;YACD,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;YAC1H,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAA,aAAM,EAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;gBACtD,IAAA,aAAM,EAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;gBAC3D,IAAA,aAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;gBAChD,IAAA,aAAM,EAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;YACvD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAA;gBACpD,IAAA,aAAM,EAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACpD,IAAA,aAAM,EAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBACtD,IAAA,aAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAC9C,IAAA,aAAM,EAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;YAClD,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,YAAY,iCAAM,gBAAgB,KAAE,IAAI,EAAE,YAAY,IAAG,CAAA;YAC9F,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAA,aAAM,EAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;gBACtD,IAAA,aAAM,EAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;gBAC3D,IAAA,aAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;gBAChD,IAAA,aAAM,EAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,CAAA;YACvD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAA;gBACpD,IAAA,aAAM,EAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBACpD,IAAA,aAAM,EAAC,sBAAsB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBACtD,IAAA,aAAM,EAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAC9C,IAAA,aAAM,EAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;YAClD,CAAC;QACH,CAAC;KAAA;IAED,EAAE,CAAC,gIAAgI,EAAE,GAAS,EAAE;QAC9I,MAAM,MAAM,CAAC,qCAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAC/C,CAAC,CAAA,CAAC,CAAA;IAEF,EAAE,CAAC,4IAA4I,EAAE,GAAS,EAAE;QAC1J,MAAM,MAAM,CAAC,qCAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAChD,CAAC,CAAA,CAAC,CAAA;IAEF,EAAE,CAAC,4HAA4H,EAAE,GAAS,EAAE;QAC1I,MAAM,MAAM,CAAC,qCAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC3C,CAAC,CAAA,CAAC,CAAA;IAEF,EAAE,CAAC,wIAAwI,EAAE,GAAS,EAAE;QACtJ,MAAM,MAAM,CAAC,qCAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5C,CAAC,CAAA,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { before } from 'mocha'\nimport { createNewHcpApi, createNewPatientApi, getEnvironmentInitializer, setLocalStorage } from '../utils/test_utils'\nimport { getEnvVariables, TestVars, UserDetails } from '@icure/test-setup/types'\nimport { DataOwnerTypeEnum } from '../../icc-api/model/DataOwnerTypeEnum'\nimport { CryptoPrimitives, CryptoStrategies, IcureApi, KeyPair, ShaVersion } from '../../icc-x-api'\nimport { expect } from 'chai'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { DataOwnerWithType } from '../../icc-api/model/DataOwnerWithType'\nimport { testStorageWithKeys } from '../utils/TestStorage'\nimport { webcrypto } from 'crypto'\n\nimport 'isomorphic-fetch'\n\nsetLocalStorage(fetch)\n\nlet env: TestVars\n\ndescribe('Autofix anonymity tests', () => {\n  before(async function () {\n    this.timeout(600000)\n    const initializer = await getEnvironmentInitializer()\n    env = await initializer.execute(getEnvVariables())\n  })\n\n  async function initApi(dataOwnerType: DataOwnerTypeEnum, isAnonymous: boolean): Promise<IcureApi> {\n    const cryptoStrats: CryptoStrategies = {\n      dataOwnerRequiresAnonymousDelegation(dataOwner: CryptoActorStubWithType): boolean {\n        if (isAnonymous) return dataOwner.type == dataOwnerType\n        else return false\n      },\n      generateNewKeyForDataOwner(self: DataOwnerWithType, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean> {\n        throw new Error('This method should not be necessary for this test')\n      },\n      recoverAndVerifySelfHierarchyKeys(\n        keysData: {\n          dataOwner: DataOwnerWithType\n          unknownKeys: string[]\n          unavailableKeys: string[]\n        }[],\n        cryptoPrimitives: CryptoPrimitives\n      ): Promise<{\n        [p: string]: { recoveredKeys: { [p: string]: KeyPair<CryptoKey> }; keyAuthenticity: { [p: string]: boolean } }\n      }> {\n        throw new Error('This method should not be necessary for this test')\n      },\n      verifyDelegatePublicKeys(delegate: CryptoActorStubWithType, publicKeys: string[], cryptoPrimitives: CryptoPrimitives): Promise<string[]> {\n        return Promise.resolve(publicKeys)\n      },\n    }\n    let userDetails: UserDetails\n    if (dataOwnerType == DataOwnerTypeEnum.Patient) {\n      userDetails = (await createNewPatientApi(env)).credentials\n    } else if (dataOwnerType == DataOwnerTypeEnum.Hcp) {\n      userDetails = (await createNewHcpApi(env)).credentials\n    } else throw new Error('Unsupported data owner type')\n    const storage = await testStorageWithKeys([\n      {\n        dataOwnerId: userDetails.dataOwnerId,\n        pairs: [{ keyPair: { publicKey: userDetails.publicKey, privateKey: userDetails.privateKey }, shaVersion: ShaVersion.Sha1 }],\n      },\n    ])\n    const api = await IcureApi.initialise(\n      env.iCureUrl,\n      { username: userDetails.user, password: userDetails.password },\n      cryptoStrats,\n      webcrypto as any,\n      fetch,\n      {\n        keyStorage: storage.keyStorage,\n        entryKeysFactory: storage.keyFactory,\n        storage: storage.storage,\n      }\n    )\n    expect((await api.dataOwnerApi.getCurrentDataOwnerStub()).type).to.eq(dataOwnerType)\n    return api\n  }\n\n  async function doTest(dataOwnerType: DataOwnerTypeEnum, isAnonymous: boolean) {\n    const api = await initApi(dataOwnerType, isAnonymous)\n    const user = await api.userApi.getCurrentUser()\n    const createdWithNewInstance = await api.patientApi.createPatientWithUser(\n      user,\n      await api.patientApi.newInstance(user, { firstName: 'q', lastName: 'q' })\n    )\n    const createdByBackend = await api.agendaApi.createAgenda({ id: api.cryptoApi.primitives.randomUuid(), name: 'whatever' })\n    if (isAnonymous) {\n      expect(createdWithNewInstance.author).to.eq(undefined)\n      expect(createdWithNewInstance.responsible).to.eq(undefined)\n      expect(createdByBackend.author).to.eq(undefined)\n      expect(createdByBackend.responsible).to.eq(undefined)\n    } else {\n      const doId = api.dataOwnerApi.getDataOwnerIdOf(user)\n      expect(createdWithNewInstance.author).to.eq(user.id)\n      expect(createdWithNewInstance.responsible).to.eq(doId)\n      expect(createdByBackend.author).to.eq(user.id)\n      expect(createdByBackend.responsible).to.eq(doId)\n    }\n    const modified = await api.agendaApi.modifyAgenda({ ...createdByBackend, name: 'whatever 2' })\n    if (isAnonymous) {\n      expect(createdWithNewInstance.author).to.eq(undefined)\n      expect(createdWithNewInstance.responsible).to.eq(undefined)\n      expect(createdByBackend.author).to.eq(undefined)\n      expect(createdByBackend.responsible).to.eq(undefined)\n    } else {\n      const doId = api.dataOwnerApi.getDataOwnerIdOf(user)\n      expect(createdWithNewInstance.author).to.eq(user.id)\n      expect(createdWithNewInstance.responsible).to.eq(doId)\n      expect(createdByBackend.author).to.eq(user.id)\n      expect(createdByBackend.responsible).to.eq(doId)\n    }\n  }\n\n  it('Entity created by a patient should omit author and responsible if crypto strategies require anonymous delegations for the user', async () => {\n    await doTest(DataOwnerTypeEnum.Patient, true)\n  })\n\n  it('Entity created by a patient should autofix author and responsible if crypto strategies does not require anonymous delegations for the user', async () => {\n    await doTest(DataOwnerTypeEnum.Patient, false)\n  })\n\n  it('Entity created by a HCP should omit author and responsible if crypto strategies require anonymous delegations for the user', async () => {\n    await doTest(DataOwnerTypeEnum.Hcp, true)\n  })\n\n  it('Entity created by a HCP should autofix author and responsible if crypto strategies does not require anonymous delegations for the user', async () => {\n    await doTest(DataOwnerTypeEnum.Hcp, false)\n  })\n})\n"]}

package/test/icc-x-api/confidential-entities-test.d.ts

@@ -1 +0,0 @@
-import 'isomorphic-fetch';

package/test/icc-x-api/confidential-entities-test.js

@@ -1,168 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const test_utils_1 = require("../utils/test_utils");
-const types_1 = require("@icure/test-setup/types");
-const chai_1 = require("chai");
-require("isomorphic-fetch");
-const icc_x_api_1 = require("../../icc-x-api");
-const SecretIdUseOption_1 = require("../../icc-x-api/crypto/SecretIdUseOption");
-var UseAnyConfidential = SecretIdUseOption_1.SecretIdUseOption.UseAnyConfidential;
-var UseAnySharedWithParent = SecretIdUseOption_1.SecretIdUseOption.UseAnySharedWithParent;
-const crypto_1 = require("crypto");
-var UseAllConfidential = SecretIdUseOption_1.SecretIdUseOption.UseAllConfidential;
-var UseAllSharedWithParent = SecretIdUseOption_1.SecretIdUseOption.UseAllSharedWithParent;
-var UseNone = SecretIdUseOption_1.SecretIdUseOption.UseNone;
-(0, test_utils_1.setLocalStorage)(fetch);
-var env;
-describe('test confidential helement', () => {
-    before(function () {
-        return __awaiter(this, void 0, void 0, function* () {
-            this.timeout(600000);
-            const initializer = yield (0, test_utils_1.getEnvironmentInitializer)();
-            env = yield initializer.execute((0, types_1.getEnvVariables)());
-        });
-    });
-    it('confidential entity should be accessible only to user, non confidential should be accessible also to parent', () => __awaiter(void 0, void 0, void 0, function* () {
-        // Use only the top of the hierarchy for simplicity of the test
-        const { parentApi: childApi, parentUser: childUser, grandApi: parentApi, grandUser: parentUser } = yield (0, test_utils_1.createHcpHierarchyApis)(env);
-        const pat = yield childApi.patientApi.newInstance(childUser, { firstName: 'John', lastName: 'Doe' });
-        const modifiedPatient = (yield childApi.patientApi.initConfidentialSecretId(pat, childUser));
-        const patientSecretIdsForParent = yield parentApi.patientApi.decryptSecretIdsOf(modifiedPatient);
-        const patientSecretIdsForChild = yield childApi.patientApi.decryptSecretIdsOf(modifiedPatient);
-        (0, chai_1.expect)(patientSecretIdsForParent).to.have.length(1);
-        (0, chai_1.expect)(patientSecretIdsForChild).to.have.length(2);
-        (0, chai_1.expect)(patientSecretIdsForChild).to.contain(patientSecretIdsForParent[0]);
-        (0, chai_1.expect)(patientSecretIdsForChild[0]).to.not.eq(patientSecretIdsForChild[1]);
-        const confidentialHe = yield childApi.healthcareElementApi.createHealthElementWithUser(childUser, yield childApi.healthcareElementApi.newInstance(childUser, modifiedPatient, { descr: 'Confidential info' }, { sfkOption: UseAnyConfidential, ignoreAutoDelegations: true }));
-        (0, chai_1.expect)(confidentialHe.descr).to.eq('Confidential info');
-        const nonConfidentialHe = yield childApi.healthcareElementApi.createHealthElementWithUser(childUser, yield childApi.healthcareElementApi.newInstance(childUser, modifiedPatient, { descr: 'Non confidential info' }, { sfkOption: UseAnySharedWithParent }));
-        (0, chai_1.expect)(nonConfidentialHe.descr).to.eq('Non confidential info');
-        const retrievedHesAsUser = yield childApi.healthcareElementApi.findBy(childUser.healthcarePartyId, modifiedPatient);
-        (0, chai_1.expect)(retrievedHesAsUser.length).to.equal(2, 'Child should see confidential and non-confidential data created by him');
-        (0, chai_1.expect)(retrievedHesAsUser.map((he) => he.id)).to.have.members([confidentialHe.id, nonConfidentialHe.id]);
-        const retrievedConfidential = retrievedHesAsUser.find((he) => he.id === confidentialHe.id);
-        const retrievedNonConfidential = retrievedHesAsUser.find((he) => he.id === nonConfidentialHe.id);
-        (0, chai_1.expect)(retrievedConfidential).to.deep.eq(confidentialHe);
-        (0, chai_1.expect)(retrievedNonConfidential).to.deep.eq(nonConfidentialHe);
-        const retrievedHesAsParent = yield parentApi.healthcareElementApi.findBy(parentUser.healthcarePartyId, modifiedPatient);
-        (0, chai_1.expect)(retrievedHesAsParent.length).to.equal(1, 'Parent should not see confidential data, but only non-confidential data created by child');
-        (0, chai_1.expect)(retrievedHesAsParent[0]).to.deep.eq(nonConfidentialHe);
-        let failedToRetrieve = false;
-        try {
-            yield parentApi.healthcareElementApi.getHealthElementWithUser(parentUser, confidentialHe.id);
-        }
-        catch (e) {
-            console.log(e);
-            failedToRetrieve = true;
-        }
-        if (!(0, test_utils_1.isLiteTest)()) {
-            (0, chai_1.expect)(failedToRetrieve).to.equal(true, 'Parent should fail to retrieve confidential data');
-        }
-        // Even if in some way I could get the contact I should not be able to decrypt it
-        (0, chai_1.expect)(yield parentApi.cryptoApi.xapi.encryptionKeysOf({ entity: confidentialHe, type: icc_x_api_1.EntityWithDelegationTypeName.HealthElement }, undefined)).to.have.length(0);
-    }));
-    it('creation of confidential data should fail if no confidential secret id is available for patient', () => __awaiter(void 0, void 0, void 0, function* () {
-        // Use only the top of the hierarchy for simplicity of the test
-        const { parentApi: childApi, parentUser: childUser, grandApi: parentApi, grandUser: parentUser } = yield (0, test_utils_1.createHcpHierarchyApis)(env);
-        const pat = yield childApi.patientApi.createPatientWithUser(childUser, yield childApi.patientApi.newInstance(childUser, { firstName: 'John', lastName: 'Doe' }));
-        let failed = false;
-        try {
-            yield childApi.healthcareElementApi.newInstance(childUser, pat, { descr: 'Confidential info' }, { sfkOption: UseAnyConfidential, ignoreAutoDelegations: true });
-        }
-        catch (_a) {
-            failed = true;
-        }
-        (0, chai_1.expect)(failed).to.equal(true, 'Creation of confidential data should fail if no confidential secret id is available for patient');
-    }));
-    it('creation of non-confidential data should fail if no secret id is available for parent', () => __awaiter(void 0, void 0, void 0, function* () {
-        // Use only the top of the hierarchy for simplicity of the test
-        const { parentApi: childApi, parentUser: childUser, grandApi: parentApi, grandUser: parentUser } = yield (0, test_utils_1.createHcpHierarchyApis)(env, false);
-        const pat = yield childApi.patientApi.createPatientWithUser(childUser, yield childApi.patientApi.newInstance(childUser, { firstName: 'John', lastName: 'Doe' }));
-        let failed = false;
-        try {
-            yield childApi.healthcareElementApi.newInstance(childUser, pat, { descr: 'Confidential info' }, { sfkOption: UseAnySharedWithParent });
-        }
-        catch (_a) {
-            failed = true;
-        }
-        (0, chai_1.expect)(failed).to.equal(true, 'Creation of confidential data should fail if no non-confidential secret id is available for patient');
-    }));
-    it('confidential or non-confidential is irrelevant if api is initialised without parent key initialisation: data created by user is only accessible to him', () => __awaiter(void 0, void 0, void 0, function* () {
-        // Use only the top of the hierarchy for simplicity of the test
-        const { parentApi: childApi, parentUser: childUser, grandApi: parentApi, grandUser: parentUser } = yield (0, test_utils_1.createHcpHierarchyApis)(env, false, true);
-        const pat = yield childApi.patientApi.newInstance(childUser, { firstName: 'John', lastName: 'Doe' });
-        const confidentialHe = yield childApi.healthcareElementApi.createHealthElementWithUser(childUser, yield childApi.healthcareElementApi.newInstance(childUser, pat, { descr: 'Confidential info' }, { sfkOption: UseAnyConfidential, ignoreAutoDelegations: true }));
-        (0, chai_1.expect)(confidentialHe.descr).to.eq('Confidential info');
-        const nonConfidentialHe = yield childApi.healthcareElementApi.createHealthElementWithUser(childUser, yield childApi.healthcareElementApi.newInstance(childUser, pat, { descr: 'Non confidential info' }, { sfkOption: UseAnySharedWithParent }));
-        (0, chai_1.expect)(nonConfidentialHe.descr).to.eq('Non confidential info');
-        const retrievedHesAsUser = yield childApi.healthcareElementApi.findBy(childUser.healthcarePartyId, pat);
-        (0, chai_1.expect)(retrievedHesAsUser.length).to.equal(2, 'Child should see confidential and non-confidential data created by him');
-        (0, chai_1.expect)(retrievedHesAsUser.map((he) => he.id)).to.have.members([confidentialHe.id, nonConfidentialHe.id]);
-        const retrievedConfidential = retrievedHesAsUser.find((he) => he.id === confidentialHe.id);
-        const retrievedNonConfidential = retrievedHesAsUser.find((he) => he.id === nonConfidentialHe.id);
-        (0, chai_1.expect)(retrievedConfidential).to.deep.eq(confidentialHe);
-        (0, chai_1.expect)(retrievedNonConfidential).to.deep.eq(nonConfidentialHe);
-        yield parentApi.patientApi.decryptSecretIdsOf(pat);
-    }));
-    it('sfk confidential option should use one or all secret ids as requested', () => __awaiter(void 0, void 0, void 0, function* () {
-        // Use only the top of the hierarchy for simplicity of the test
-        const { parentApi: childApi, parentUser: childUser, grandApi: parentApi, grandUser: parentUser } = yield (0, test_utils_1.createHcpHierarchyApis)(env);
-        const pat = yield childApi.patientApi.newInstance(childUser, { firstName: 'John', lastName: 'Doe' });
-        let modifiedPatient = (yield childApi.patientApi.initConfidentialSecretId(pat, childUser));
-        modifiedPatient = yield childApi.patientApi.shareWith(childUser.healthcarePartyId, modifiedPatient, [(0, crypto_1.randomUUID)()]);
-        modifiedPatient = yield childApi.patientApi.shareWith(parentUser.healthcarePartyId, modifiedPatient, [(0, crypto_1.randomUUID)()]);
-        const patientSecretIdsForParent = yield parentApi.patientApi.decryptSecretIdsOf(modifiedPatient);
-        const patientSecretIdsForChild = yield childApi.patientApi.decryptSecretIdsOf(modifiedPatient);
-        (0, chai_1.expect)(patientSecretIdsForParent).to.have.length(2);
-        (0, chai_1.expect)(patientSecretIdsForChild).to.have.length(4);
-        const confidentialSecretIds = patientSecretIdsForChild.filter((x) => !patientSecretIdsForParent.includes(x));
-        const nonConfidentialSecretIds = patientSecretIdsForParent;
-        (0, chai_1.expect)(confidentialSecretIds).to.have.length(2);
-        (0, chai_1.expect)(yield childApi.patientApi.decryptConfidentialSecretIdsOf(modifiedPatient)).to.have.members(confidentialSecretIds);
-        (0, chai_1.expect)(yield childApi.patientApi.decryptNonConfidentialSecretIdsOf(modifiedPatient)).to.have.members(nonConfidentialSecretIds);
-        const anyConfidentialHe = yield childApi.healthcareElementApi.newInstance(childUser, modifiedPatient, { descr: 'Confidential info' }, { sfkOption: UseAnyConfidential, ignoreAutoDelegations: true });
-        (0, chai_1.expect)(anyConfidentialHe.secretForeignKeys).to.have.length(1);
-        (0, chai_1.expect)(confidentialSecretIds).to.include(anyConfidentialHe.secretForeignKeys[0]);
-        const allConfidentialHe = yield childApi.healthcareElementApi.newInstance(childUser, modifiedPatient, { descr: 'Confidential info' }, { sfkOption: UseAllConfidential, ignoreAutoDelegations: true });
-        (0, chai_1.expect)(allConfidentialHe.secretForeignKeys).to.have.members(confidentialSecretIds);
-        const anyNonConfidentialHe = yield childApi.healthcareElementApi.newInstance(childUser, modifiedPatient, { descr: 'Confidential info' }, { sfkOption: UseAnySharedWithParent });
-        (0, chai_1.expect)(anyNonConfidentialHe.secretForeignKeys).to.have.length(1);
-        (0, chai_1.expect)(nonConfidentialSecretIds).to.include(anyNonConfidentialHe.secretForeignKeys[0]);
-        const allNonConfidentialHe = yield childApi.healthcareElementApi.newInstance(childUser, modifiedPatient, { descr: 'Confidential info' }, { sfkOption: UseAllSharedWithParent });
-        (0, chai_1.expect)(allNonConfidentialHe.secretForeignKeys).to.have.members(nonConfidentialSecretIds);
-    }));
-    it('Should allow creation of half-links by using no sfk', () => __awaiter(void 0, void 0, void 0, function* () {
-        const { parentApi: childApi, parentUser: childUser, grandApi: parentApi, grandUser: parentUser } = yield (0, test_utils_1.createHcpHierarchyApis)(env);
-        const pat = yield childApi.patientApi.newInstance(childUser, { firstName: 'John', lastName: 'Doe' });
-        const halfLinkedHe = yield childApi.healthcareElementApi.newInstance(childUser, pat, { descr: 'Confidential info' }, { sfkOption: UseNone, ignoreAutoDelegations: true });
-        (0, chai_1.expect)(halfLinkedHe.secretForeignKeys).to.have.length(0);
-        const decryptedPatientId = yield childApi.healthcareElementApi.decryptPatientIdOf(halfLinkedHe);
-        (0, chai_1.expect)(decryptedPatientId).to.have.length(1);
-        (0, chai_1.expect)(decryptedPatientId[0]).to.equal(pat.id);
-    }));
-    it('Should allow creation of links using the provided sfks', () => __awaiter(void 0, void 0, void 0, function* () {
-        const { parentApi: childApi, parentUser: childUser, grandApi: parentApi, grandUser: parentUser } = yield (0, test_utils_1.createHcpHierarchyApis)(env);
-        const pat = yield childApi.patientApi.newInstance(childUser, { firstName: 'John', lastName: 'Doe' });
-        const modifiedPatient = (yield childApi.patientApi.initConfidentialSecretId(pat, childUser));
-        const secretIds = yield childApi.patientApi.decryptSecretIdsOf(modifiedPatient);
-        (0, chai_1.expect)(secretIds).to.have.length(2);
-        const halfLinkedHe = yield childApi.healthcareElementApi.newInstance(childUser, pat, { descr: 'Confidential info' }, { sfkOption: new SecretIdUseOption_1.SecretIdUseOption.Use([]), ignoreAutoDelegations: true });
-        (0, chai_1.expect)(halfLinkedHe.secretForeignKeys).to.have.length(0);
-        const linkedHeSfk0 = yield childApi.healthcareElementApi.newInstance(childUser, pat, { descr: 'Confidential info' }, { sfkOption: new SecretIdUseOption_1.SecretIdUseOption.Use([secretIds[0]]), ignoreAutoDelegations: true });
-        (0, chai_1.expect)(linkedHeSfk0.secretForeignKeys).to.have.members([secretIds[0]]);
-        const linkedHeSfk1 = yield childApi.healthcareElementApi.newInstance(childUser, pat, { descr: 'Confidential info' }, { sfkOption: new SecretIdUseOption_1.SecretIdUseOption.Use([secretIds[1]]), ignoreAutoDelegations: true });
-        (0, chai_1.expect)(linkedHeSfk1.secretForeignKeys).to.have.members([secretIds[1]]);
-        const linkedHeSfkBoth = yield childApi.healthcareElementApi.newInstance(childUser, pat, { descr: 'Confidential info' }, { sfkOption: new SecretIdUseOption_1.SecretIdUseOption.Use(secretIds), ignoreAutoDelegations: true });
-        (0, chai_1.expect)(linkedHeSfkBoth.secretForeignKeys).to.have.members(secretIds);
-    }));
-});
-//# sourceMappingURL=confidential-entities-test.js.map