@icure/api 8.6.5 → 8.6.6

package/test/support/CSM-729.js

@@ -1,225 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const test_utils_1 = require("../utils/test_utils");
-const icc_x_api_1 = require("../../icc-x-api");
-const chai_1 = require("chai");
-require("isomorphic-fetch");
-const types_1 = require("@icure/test-setup/types");
-const chaiAsPromised = require("chai-as-promised");
-const utils_1 = require("../../icc-x-api/crypto/utils");
-const DataOwnerTypeEnum_1 = require("../../icc-api/model/DataOwnerTypeEnum");
-const crypto_1 = require("crypto");
-const TestStorage_1 = require("../utils/TestStorage");
-const SecureDelegation_1 = require("../../icc-api/model/SecureDelegation");
-var AccessLevelEnum = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
-var initMasterApi = test_utils_1.TestUtils.initMasterApi;
-(0, test_utils_1.setLocalStorage)(fetch);
-(0, chai_1.use)(chaiAsPromised);
-let env;
-const untrustedKeyPropId = 'untrustedKey';
-class TrustedKeysStrategy {
-    constructor(parentKeys, selfKeys, options = {}) {
-        this.parentKeys = parentKeys;
-        this.selfKeys = selfKeys;
-        this.options = options;
-    }
-    dataOwnerRequiresAnonymousDelegation(dataOwner) {
-        return dataOwner.type != DataOwnerTypeEnum_1.DataOwnerTypeEnum.Hcp;
-    }
-    recoverAndVerifySelfHierarchyKeys(keysData, cryptoPrimitives, keyPairRecoverer) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (this.options.failRecoverAndVerifySelfHierarchyKeys) {
-                throw new Error("Shouldn't call this method now");
-            }
-            (0, chai_1.expect)(keysData).to.have.length(2);
-            const parentKeysWithFp = yield Promise.all(this.parentKeys.map((k) => __awaiter(this, void 0, void 0, function* () {
-                return ({
-                    trusted: k.trusted,
-                    fp: (0, utils_1.fingerprintV1)(k.pub),
-                    keypair: yield cryptoPrimitives.RSA.importKeyPair('pkcs8', (0, icc_x_api_1.ua2ab)((0, icc_x_api_1.hex2ua)(k.priv)), 'spki', (0, icc_x_api_1.ua2ab)((0, icc_x_api_1.hex2ua)(k.pub)), k.shaVersion),
-                });
-            })));
-            const selfKeysWithFp = yield Promise.all(this.selfKeys.map((k) => __awaiter(this, void 0, void 0, function* () {
-                return ({
-                    trusted: k.trusted,
-                    fp: (0, utils_1.fingerprintV1)(k.pub),
-                    keypair: yield cryptoPrimitives.RSA.importKeyPair('pkcs8', (0, icc_x_api_1.ua2ab)((0, icc_x_api_1.hex2ua)(k.priv)), 'spki', (0, icc_x_api_1.ua2ab)((0, icc_x_api_1.hex2ua)(k.pub)), k.shaVersion),
-                });
-            })));
-            return {
-                [keysData[0].dataOwner.dataOwner.id]: {
-                    recoveredKeys: Object.fromEntries(parentKeysWithFp.map((k) => [k.fp, k.keypair])),
-                    keyAuthenticity: Object.fromEntries(parentKeysWithFp.map((k) => [k.fp, k.trusted])),
-                },
-                [keysData[1].dataOwner.dataOwner.id]: {
-                    recoveredKeys: Object.fromEntries(selfKeysWithFp.map((k) => [k.fp, k.keypair])),
-                    keyAuthenticity: Object.fromEntries(selfKeysWithFp.map((k) => [k.fp, k.trusted])),
-                },
-            };
-        });
-    }
-    verifyDelegatePublicKeys(delegate, publicKeys, cryptoPrimitives) {
-        var _a;
-        const untrusted = new Set((_a = delegate.stub.cryptoActorProperties) === null || _a === void 0 ? void 0 : _a.flatMap((p) => {
-            var _a;
-            if (p.id == untrustedKeyPropId && ((_a = p.typedValue) === null || _a === void 0 ? void 0 : _a.stringValue) != undefined) {
-                return [p.typedValue.stringValue];
-            }
-            else {
-                return [];
-            }
-        }));
-        return Promise.resolve(publicKeys.filter((k) => !untrusted.has((0, utils_1.fingerprintV2)(k))));
-    }
-    generateNewKeyForDataOwner(self, cryptoPrimitives) {
-        if (this.options.overrideGenerateNewKeyForDataOwner) {
-            return this.options.overrideGenerateNewKeyForDataOwner();
-        }
-        return Promise.reject(new Error('Should not be called now'));
-    }
-}
-describe('CSM-729', function () {
-    return __awaiter(this, void 0, void 0, function* () {
-        before(function () {
-            return __awaiter(this, void 0, void 0, function* () {
-                this.timeout(600000);
-                const initializer = yield (0, test_utils_1.getEnvironmentInitializer)();
-                env = yield initializer.execute((0, types_1.getEnvVariables)());
-            });
-        });
-        it('User with untrusted key', function () {
-            return __awaiter(this, void 0, void 0, function* () {
-                const { grandCredentials: parent, parentCredentials: hcp } = yield (0, test_utils_1.createHcpHierarchyApis)(env);
-                // Create some data to use the original keys
-                const initialApi = yield icc_x_api_1.IcureApi.initialise(env.iCureUrl, { username: hcp.user, password: hcp.password }, new TrustedKeysStrategy([{ priv: parent.privateKey, pub: parent.publicKey, trusted: true, shaVersion: icc_x_api_1.ShaVersion.Sha1 }], [{ priv: hcp.privateKey, pub: hcp.publicKey, trusted: true, shaVersion: icc_x_api_1.ShaVersion.Sha1 }]), crypto_1.webcrypto, fetch, {
-                    storage: new TestStorage_1.TestStorage(),
-                    keyStorage: new TestStorage_1.TestKeyStorage(),
-                });
-                const user = yield initialApi.userApi.getCurrentUser();
-                const pat1 = yield initialApi.patientApi.createPatientWithUser(user, yield initialApi.patientApi.newInstance(user, {
-                    firstName: 'John',
-                    lastName: 'Doe',
-                    note: 'Secret note',
-                }, {
-                    additionalDelegates: { [parent.dataOwnerId]: AccessLevelEnum.WRITE },
-                }));
-                // Check exchange data was created as expected
-                const selfSelfXdata = yield initialApi.cryptoApi.exchangeData.base.getExchangeDataByDelegatorDelegatePair(hcp.dataOwnerId, hcp.dataOwnerId);
-                const selfParentXdata = yield initialApi.cryptoApi.exchangeData.base.getExchangeDataByDelegatorDelegatePair(hcp.dataOwnerId, parent.dataOwnerId);
-                (0, chai_1.expect)(selfSelfXdata).to.not.be.undefined;
-                (0, chai_1.expect)(selfParentXdata).to.not.be.undefined;
-                (0, chai_1.expect)(selfSelfXdata).to.have.length(1);
-                (0, chai_1.expect)(selfParentXdata).to.have.length(1);
-                // Prepare for new api with untrusted key
-                //// Mark self hcp keys as untrusted
-                let selfHcp = yield initialApi.healthcarePartyApi.getCurrentHealthcareParty();
-                selfHcp = yield initialApi.healthcarePartyApi.modifyHealthcareParty(Object.assign(Object.assign({}, selfHcp), { cryptoActorProperties: [
-                        ...(selfHcp.cryptoActorProperties || []),
-                        {
-                            id: untrustedKeyPropId,
-                            typedValue: { stringValue: (0, utils_1.fingerprintV2)(hcp.publicKey) },
-                        },
-                    ] }));
-                //// Mark parent hcp keys as untrusted and add new key (currently can't be done through crypto strategies)
-                const newParentKey = yield initialApi.cryptoApi.primitives.RSA.generateKeyPair(icc_x_api_1.ShaVersion.Sha256);
-                const newParentKeySpki = (0, icc_x_api_1.ua2hex)(yield initialApi.cryptoApi.primitives.RSA.exportKey(newParentKey.publicKey, 'spki'));
-                const newParentKeyPkcs8 = (0, icc_x_api_1.ua2hex)(yield initialApi.cryptoApi.primitives.RSA.exportKey(newParentKey.privateKey, 'pkcs8'));
-                const adminApi = yield initMasterApi(env);
-                let parentHcp = yield adminApi.healthcarePartyApi.getHealthcareParty(parent.dataOwnerId);
-                parentHcp = yield adminApi.healthcarePartyApi.modifyHealthcareParty(Object.assign(Object.assign({}, parentHcp), { cryptoActorProperties: [
-                        ...(parentHcp.cryptoActorProperties || []),
-                        {
-                            id: untrustedKeyPropId,
-                            typedValue: { stringValue: (0, utils_1.fingerprintV2)(parent.publicKey) },
-                        },
-                    ], publicKeysForOaepWithSha256: [...(parentHcp.publicKeysForOaepWithSha256 || []), newParentKeySpki] }));
-                //// No need to invalidate exchange data, as untrusted keys are not used to validate it
-                // Setup new api
-                let didCreateNewKey = false;
-                const newHcpKey = yield initialApi.cryptoApi.primitives.RSA.generateKeyPair(icc_x_api_1.ShaVersion.Sha256);
-                const newHcpKeySpki = (0, icc_x_api_1.ua2hex)(yield initialApi.cryptoApi.primitives.RSA.exportKey(newHcpKey.publicKey, 'spki'));
-                const newHcpKeyPkcs8 = (0, icc_x_api_1.ua2hex)(yield initialApi.cryptoApi.primitives.RSA.exportKey(newHcpKey.privateKey, 'pkcs8'));
-                const apiWithUntrustedKeysStorages = {
-                    // Using a new storage, simulates wiping the local storage
-                    storage: new TestStorage_1.TestStorage(),
-                    keyStorage: new TestStorage_1.TestKeyStorage(),
-                };
-                const apiWithUntrustedKey = yield icc_x_api_1.IcureApi.initialise(env.iCureUrl, { username: hcp.user, password: hcp.password }, new TrustedKeysStrategy([
-                    { priv: parent.privateKey, pub: parent.publicKey, trusted: false, shaVersion: icc_x_api_1.ShaVersion.Sha1 },
-                    { priv: newParentKeyPkcs8, pub: newParentKeySpki, trusted: true, shaVersion: icc_x_api_1.ShaVersion.Sha256 },
-                ], [{ priv: hcp.privateKey, pub: hcp.publicKey, trusted: false, shaVersion: icc_x_api_1.ShaVersion.Sha1 }], {
-                    overrideGenerateNewKeyForDataOwner: () => {
-                        didCreateNewKey = true;
-                        return Promise.resolve(newHcpKey);
-                    },
-                }), crypto_1.webcrypto, fetch, apiWithUntrustedKeysStorages);
-                (0, chai_1.expect)(didCreateNewKey).to.eq(true);
-                // Check all keys are available but only new keys are trusted
-                (0, chai_1.expect)(yield apiWithUntrustedKey.cryptoApi.userKeysManager.getVerifiedPublicKeysFor(yield apiWithUntrustedKey.healthcarePartyApi.getHealthcareParty(hcp.dataOwnerId))).to.have.members([newHcpKeySpki]);
-                (0, chai_1.expect)(yield apiWithUntrustedKey.cryptoApi.userKeysManager.getVerifiedPublicKeysFor(yield apiWithUntrustedKey.healthcarePartyApi.getHealthcareParty(parent.dataOwnerId))).to.have.members([newParentKeySpki]);
-                (0, chai_1.expect)(yield apiWithUntrustedKey.cryptoApi.userKeysManager.getCurrentUserHierarchyAvailablePublicKeysHex()).to.have.members([
-                    newHcpKeySpki,
-                    hcp.publicKey,
-                    parent.publicKey,
-                    newParentKeySpki,
-                ]);
-                (0, chai_1.expect)(yield apiWithUntrustedKey.cryptoApi.userKeysManager.getCurrentUserAvailablePublicKeysHex(false)).to.have.members([
-                    newHcpKeySpki,
-                    hcp.publicKey,
-                ]);
-                // Check can still read old data
-                const pat1Recovered = yield apiWithUntrustedKey.patientApi.getPatientWithUser(user, pat1.id);
-                (0, chai_1.expect)(pat1Recovered.note).to.eq('Secret note');
-                // Check can create new data
-                const pat2 = yield initialApi.patientApi.createPatientWithUser(user, yield initialApi.patientApi.newInstance(user, {
-                    firstName: 'Joe',
-                    lastName: 'Doe',
-                    note: 'Secret note',
-                }, {
-                    additionalDelegates: { [parent.dataOwnerId]: AccessLevelEnum.WRITE },
-                }));
-                // Check created new exchange data and only used the new trusted keys for it
-                const selfSelfXdata2 = yield initialApi.cryptoApi.exchangeData.base.getExchangeDataByDelegatorDelegatePair(hcp.dataOwnerId, hcp.dataOwnerId);
-                const selfParentXdata2 = yield initialApi.cryptoApi.exchangeData.base.getExchangeDataByDelegatorDelegatePair(hcp.dataOwnerId, parent.dataOwnerId);
-                (0, chai_1.expect)(selfSelfXdata2).to.not.be.undefined;
-                (0, chai_1.expect)(selfParentXdata2).to.not.be.undefined;
-                (0, chai_1.expect)(selfSelfXdata2).to.have.length(2);
-                (0, chai_1.expect)(selfParentXdata2).to.have.length(2);
-                const newSelfSelfXdata = selfSelfXdata2.filter((xd) => xd.id !== selfSelfXdata[0].id);
-                (0, chai_1.expect)(newSelfSelfXdata).to.have.length(1);
-                const newSelfSelfXDataUsedFps = Object.keys(newSelfSelfXdata[0].exchangeKey);
-                (0, chai_1.expect)(newSelfSelfXDataUsedFps).to.have.length(1);
-                (0, chai_1.expect)(newSelfSelfXDataUsedFps[0]).to.eq((0, utils_1.fingerprintV2)(newHcpKeySpki));
-                const newSelfParentXdata = selfParentXdata2.filter((xd) => xd.id !== selfParentXdata[0].id);
-                (0, chai_1.expect)(newSelfParentXdata).to.have.length(1);
-                const newSelfParentXDataUsedFps = Object.keys(newSelfParentXdata[0].exchangeKey);
-                (0, chai_1.expect)(newSelfParentXDataUsedFps).to.have.length(2);
-                (0, chai_1.expect)(newSelfParentXDataUsedFps).to.have.members([(0, utils_1.fingerprintV2)(newHcpKeySpki), (0, utils_1.fingerprintV2)(newParentKeySpki)]);
-                // Check after reinitialization with keys already in storage the "verified" situation is unchanged.
-                const apiWithUntrustedKey2 = yield icc_x_api_1.IcureApi.initialise(env.iCureUrl, { username: hcp.user, password: hcp.password }, new TrustedKeysStrategy([], [], { failRecoverAndVerifySelfHierarchyKeys: true }), crypto_1.webcrypto, fetch, apiWithUntrustedKeysStorages);
-                (0, chai_1.expect)(yield apiWithUntrustedKey2.cryptoApi.userKeysManager.getVerifiedPublicKeysFor(yield apiWithUntrustedKey2.healthcarePartyApi.getHealthcareParty(hcp.dataOwnerId))).to.have.members([newHcpKeySpki]);
-                (0, chai_1.expect)(yield apiWithUntrustedKey2.cryptoApi.userKeysManager.getVerifiedPublicKeysFor(yield apiWithUntrustedKey2.healthcarePartyApi.getHealthcareParty(parent.dataOwnerId))).to.have.members([newParentKeySpki]);
-                (0, chai_1.expect)(yield apiWithUntrustedKey2.cryptoApi.userKeysManager.getCurrentUserHierarchyAvailablePublicKeysHex()).to.have.members([
-                    newHcpKeySpki,
-                    hcp.publicKey,
-                    parent.publicKey,
-                    newParentKeySpki,
-                ]);
-                (0, chai_1.expect)(yield apiWithUntrustedKey2.cryptoApi.userKeysManager.getCurrentUserAvailablePublicKeysHex(false)).to.have.members([
-                    newHcpKeySpki,
-                    hcp.publicKey,
-                ]);
-            });
-        });
-    });
-});
-//# sourceMappingURL=CSM-729.js.map

package/test/support/CSM-729.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"CSM-729.js","sourceRoot":"","sources":["../../../test/support/CSM-729.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,oDAAmH;AACnH,+CAA0H;AAC1H,+BAA6C;AAC7C,4BAAyB;AACzB,mDAAmE;AACnE,mDAAkD;AAClD,wDAA2E;AAI3E,6EAAyE;AACzE,mCAAkC;AAClC,sDAAkE;AAClE,2EAAuE;AACvE,IAAO,eAAe,GAAG,mCAAgB,CAAC,eAAe,CAAA;AACzD,IAAO,aAAa,GAAG,sBAAS,CAAC,aAAa,CAAA;AAE9C,IAAA,4BAAe,EAAC,KAAK,CAAC,CAAA;AAEtB,IAAA,UAAO,EAAC,cAAc,CAAC,CAAA;AAEvB,IAAI,GAAa,CAAA;AAEjB,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEzC,MAAM,mBAAmB;IACvB,YACmB,UAAqF,EACrF,QAAmF,EACnF,UAGb,EAAE;QALW,eAAU,GAAV,UAAU,CAA2E;QACrF,aAAQ,GAAR,QAAQ,CAA2E;QACnF,YAAO,GAAP,OAAO,CAGlB;IACL,CAAC;IAEJ,oCAAoC,CAAC,SAAkC;QACrE,OAAO,SAAS,CAAC,IAAI,IAAI,qCAAiB,CAAC,GAAG,CAAA;IAChD,CAAC;IAEK,iCAAiC,CACrC,QAIG,EACH,gBAAkC,EAClC,gBAAkC;;YAIlC,IAAI,IAAI,CAAC,OAAO,CAAC,qCAAqC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YACnD,CAAC;YACD,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAClC,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,GAAG,CACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAO,CAAC,EAAE,EAAE;gBAAC,OAAA,CAAC;oBAChC,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,EAAE,EAAE,IAAA,qBAAa,EAAC,CAAC,CAAC,GAAG,CAAC;oBACxB,OAAO,EAAE,MAAM,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,IAAA,iBAAK,EAAC,IAAA,kBAAM,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAK,EAAC,IAAA,kBAAM,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC;iBAC9H,CAAC,CAAA;cAAA,CAAC,CACJ,CAAA;YACD,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAO,CAAC,EAAE,EAAE;gBAAC,OAAA,CAAC;oBAC9B,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,EAAE,EAAE,IAAA,qBAAa,EAAC,CAAC,CAAC,GAAG,CAAC;oBACxB,OAAO,EAAE,MAAM,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,OAAO,EAAE,IAAA,iBAAK,EAAC,IAAA,kBAAM,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,IAAA,iBAAK,EAAC,IAAA,kBAAM,EAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC;iBAC9H,CAAC,CAAA;cAAA,CAAC,CACJ,CAAA;YACD,OAAO;gBACL,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,CAAC,EAAE;oBACrC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBACjF,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;iBACpF;gBACD,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAG,CAAC,EAAE;oBACrC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;oBAC/E,eAAe,EAAE,MAAM,CAAC,WAAW,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;iBAClF;aACF,CAAA;QACH,CAAC;KAAA;IAED,wBAAwB,CAAC,QAAiC,EAAE,UAAoB,EAAE,gBAAkC;;QAClH,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,MAAA,QAAQ,CAAC,IAAI,CAAC,qBAAqB,0CAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;;YACjD,IAAI,CAAC,CAAC,EAAE,IAAI,kBAAkB,IAAI,CAAA,MAAA,CAAC,CAAC,UAAU,0CAAE,WAAW,KAAI,SAAS,EAAE,CAAC;gBACzE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAA;YACnC,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAA;YACX,CAAC;QACH,CAAC,CAAC,CACH,CAAA;QACD,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAA,qBAAa,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpF,CAAC;IAED,0BAA0B,CAAC,IAAuB,EAAE,gBAAkC;QACpF,IAAI,IAAI,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC,OAAO,CAAC,kCAAkC,EAAE,CAAA;QAC1D,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAA;IAC9D,CAAC;CACF;AAED,QAAQ,CAAC,SAAS,EAAE;;QAClB,MAAM,CAAC;;gBACL,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACpB,MAAM,WAAW,GAAG,MAAM,IAAA,sCAAyB,GAAE,CAAA;gBACrD,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAA,uBAAe,GAAE,CAAC,CAAA;YACpD,CAAC;SAAA,CAAC,CAAA;QAEF,EAAE,CAAC,yBAAyB,EAAE;;gBAC5B,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,EAAE,GAAG,MAAM,IAAA,mCAAsB,EAAC,GAAG,CAAC,CAAA;gBAC9F,4CAA4C;gBAC5C,MAAM,UAAU,GAAG,MAAM,oBAAQ,CAAC,UAAU,CAC1C,GAAG,CAAC,QAAQ,EACZ,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAC9C,IAAI,mBAAmB,CACrB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAU,CAAC,IAAI,EAAE,CAAC,EAChG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAU,CAAC,IAAI,EAAE,CAAC,CAC3F,EACD,kBAAgB,EAChB,KAAK,EACL;oBACE,OAAO,EAAE,IAAI,yBAAW,EAAE;oBAC1B,UAAU,EAAE,IAAI,4BAAc,EAAE;iBACjC,CACF,CAAA;gBACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,CAAA;gBACtD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAC5D,IAAI,EACJ,MAAM,UAAU,CAAC,UAAU,CAAC,WAAW,CACrC,IAAI,EACJ;oBACE,SAAS,EAAE,MAAM;oBACjB,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,aAAa;iBACpB,EACD;oBACE,mBAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE;iBACrE,CACF,CACF,CAAA;gBACD,8CAA8C;gBAC9C,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,sCAAsC,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;gBAC3I,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,sCAAsC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;gBAChJ,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;gBACzC,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;gBAC3C,IAAA,aAAM,EAAC,aAAa,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACvC,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACzC,yCAAyC;gBACzC,oCAAoC;gBACpC,IAAI,OAAO,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC,yBAAyB,EAAE,CAAA;gBAC7E,OAAO,GAAG,MAAM,UAAU,CAAC,kBAAkB,CAAC,qBAAqB,iCAC9D,OAAO,KACV,qBAAqB,EAAE;wBACrB,GAAG,CAAC,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;wBACxC;4BACE,EAAE,EAAE,kBAAkB;4BACtB,UAAU,EAAE,EAAE,WAAW,EAAE,IAAA,qBAAa,EAAC,GAAG,CAAC,SAAS,CAAC,EAAE;yBAC1D;qBACF,IACD,CAAA;gBACF,0GAA0G;gBAC1G,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAU,CAAC,MAAM,CAAC,CAAA;gBACjG,MAAM,gBAAgB,GAAG,IAAA,kBAAM,EAAC,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;gBACpH,MAAM,iBAAiB,GAAG,IAAA,kBAAM,EAAC,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;gBACvH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;gBACzC,IAAI,SAAS,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;gBACxF,SAAS,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,qBAAqB,iCAE9D,SAAS,KACZ,qBAAqB,EAAE;wBACrB,GAAG,CAAC,SAAS,CAAC,qBAAqB,IAAI,EAAE,CAAC;wBAC1C;4BACE,EAAE,EAAE,kBAAkB;4BACtB,UAAU,EAAE,EAAE,WAAW,EAAE,IAAA,qBAAa,EAAC,MAAM,CAAC,SAAS,CAAC,EAAE;yBAC7D;qBACF,EACD,2BAA2B,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,2BAA2B,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC,IACjG,CAAA;gBACF,uFAAuF;gBACvF,gBAAgB;gBAChB,IAAI,eAAe,GAAG,KAAK,CAAA;gBAC3B,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,sBAAU,CAAC,MAAM,CAAC,CAAA;gBAC9F,MAAM,aAAa,GAAG,IAAA,kBAAM,EAAC,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;gBAC9G,MAAM,cAAc,GAAG,IAAA,kBAAM,EAAC,MAAM,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;gBACjH,MAAM,4BAA4B,GAAG;oBACnC,0DAA0D;oBAC1D,OAAO,EAAE,IAAI,yBAAW,EAAE;oBAC1B,UAAU,EAAE,IAAI,4BAAc,EAAE;iBACjC,CAAA;gBACD,MAAM,mBAAmB,GAAG,MAAM,oBAAQ,CAAC,UAAU,CACnD,GAAG,CAAC,QAAQ,EACZ,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAC9C,IAAI,mBAAmB,CACrB;oBACE,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,sBAAU,CAAC,IAAI,EAAE;oBAC/F,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,sBAAU,CAAC,MAAM,EAAE;iBACjG,EACD,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,sBAAU,CAAC,IAAI,EAAE,CAAC,EAC3F;oBACE,kCAAkC,EAAE,GAAG,EAAE;wBACvC,eAAe,GAAG,IAAI,CAAA;wBACtB,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;oBACnC,CAAC;iBACF,CACF,EACD,kBAAgB,EAChB,KAAK,EACL,4BAA4B,CAC7B,CAAA;gBACD,IAAA,aAAM,EAAC,eAAe,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAA;gBACnC,6DAA6D;gBAC7D,IAAA,aAAM,EACJ,MAAM,mBAAmB,CAAC,SAAS,CAAC,eAAe,CAAC,wBAAwB,CAC1E,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CACjF,CACF,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;gBAClC,IAAA,aAAM,EACJ,MAAM,mBAAmB,CAAC,SAAS,CAAC,eAAe,CAAC,wBAAwB,CAC1E,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CACpF,CACF,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBACrC,IAAA,aAAM,EAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,eAAe,CAAC,6CAA6C,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC1H,aAAa;oBACb,GAAG,CAAC,SAAS;oBACb,MAAM,CAAC,SAAS;oBAChB,gBAAgB;iBACjB,CAAC,CAAA;gBACF,IAAA,aAAM,EAAC,MAAM,mBAAmB,CAAC,SAAS,CAAC,eAAe,CAAC,oCAAoC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;oBACtH,aAAa;oBACb,GAAG,CAAC,SAAS;iBACd,CAAC,CAAA;gBACF,gCAAgC;gBAChC,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,EAAG,CAAC,CAAA;gBAC7F,IAAA,aAAM,EAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAA;gBAC/C,4BAA4B;gBAC5B,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,qBAAqB,CAC5D,IAAI,EACJ,MAAM,UAAU,CAAC,UAAU,CAAC,WAAW,CACrC,IAAI,EACJ;oBACE,SAAS,EAAE,KAAK;oBAChB,QAAQ,EAAE,KAAK;oBACf,IAAI,EAAE,aAAa;iBACpB,EACD;oBACE,mBAAmB,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,KAAK,EAAE;iBACrE,CACF,CACF,CAAA;gBACD,4EAA4E;gBAC5E,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,sCAAsC,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC,CAAA;gBAC5I,MAAM,gBAAgB,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,sCAAsC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;gBACjJ,IAAA,aAAM,EAAC,cAAc,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;gBAC1C,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAA;gBAC5C,IAAA,aAAM,EAAC,cAAc,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACxC,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBAC1C,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAE,CAAA;gBACtF,IAAA,aAAM,EAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBAC1C,MAAM,uBAAuB,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBAC5E,IAAA,aAAM,EAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACjD,IAAA,aAAM,EAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,IAAA,qBAAa,EAAC,aAAa,CAAC,CAAC,CAAA;gBACtE,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAE,CAAA;gBAC5F,IAAA,aAAM,EAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBAC5C,MAAM,yBAAyB,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;gBAChF,IAAA,aAAM,EAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACnD,IAAA,aAAM,EAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAA,qBAAa,EAAC,aAAa,CAAC,EAAE,IAAA,qBAAa,EAAC,gBAAgB,CAAC,CAAC,CAAC,CAAA;gBAClH,mGAAmG;gBACnG,MAAM,oBAAoB,GAAG,MAAM,oBAAQ,CAAC,UAAU,CACpD,GAAG,CAAC,QAAQ,EACZ,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAC9C,IAAI,mBAAmB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,EAChF,kBAAgB,EAChB,KAAK,EACL,4BAA4B,CAC7B,CAAA;gBACD,IAAA,aAAM,EACJ,MAAM,oBAAoB,CAAC,SAAS,CAAC,eAAe,CAAC,wBAAwB,CAC3E,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAClF,CACF,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAA;gBAClC,IAAA,aAAM,EACJ,MAAM,oBAAoB,CAAC,SAAS,CAAC,eAAe,CAAC,wBAAwB,CAC3E,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CACrF,CACF,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBACrC,IAAA,aAAM,EAAC,MAAM,oBAAoB,CAAC,SAAS,CAAC,eAAe,CAAC,6CAA6C,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC3H,aAAa;oBACb,GAAG,CAAC,SAAS;oBACb,MAAM,CAAC,SAAS;oBAChB,gBAAgB;iBACjB,CAAC,CAAA;gBACF,IAAA,aAAM,EAAC,MAAM,oBAAoB,CAAC,SAAS,CAAC,eAAe,CAAC,oCAAoC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;oBACvH,aAAa;oBACb,GAAG,CAAC,SAAS;iBACd,CAAC,CAAA;YACJ,CAAC;SAAA,CAAC,CAAA;IACJ,CAAC;CAAA,CAAC,CAAA","sourcesContent":["import { createHcpHierarchyApis, getEnvironmentInitializer, setLocalStorage, TestUtils } from '../utils/test_utils'\nimport { CryptoPrimitives, CryptoStrategies, hex2ua, IcureApi, KeyPair, ShaVersion, ua2ab, ua2hex } from '../../icc-x-api'\nimport { expect, use as chaiUse } from 'chai'\nimport 'isomorphic-fetch'\nimport { getEnvVariables, TestVars } from '@icure/test-setup/types'\nimport * as chaiAsPromised from 'chai-as-promised'\nimport { fingerprintV1, fingerprintV2 } from '../../icc-x-api/crypto/utils'\nimport { KeyPairRecoverer } from '../../icc-x-api/crypto/KeyPairRecoverer'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\nimport { DataOwnerWithType } from '../../icc-api/model/DataOwnerWithType'\nimport { DataOwnerTypeEnum } from '../../icc-api/model/DataOwnerTypeEnum'\nimport { webcrypto } from 'crypto'\nimport { TestKeyStorage, TestStorage } from '../utils/TestStorage'\nimport { SecureDelegation } from '../../icc-api/model/SecureDelegation'\nimport AccessLevelEnum = SecureDelegation.AccessLevelEnum\nimport initMasterApi = TestUtils.initMasterApi\n\nsetLocalStorage(fetch)\n\nchaiUse(chaiAsPromised)\n\nlet env: TestVars\n\nconst untrustedKeyPropId = 'untrustedKey'\n\nclass TrustedKeysStrategy implements CryptoStrategies {\n  constructor(\n    private readonly parentKeys: { pub: string; priv: string; trusted: boolean; shaVersion: ShaVersion }[],\n    private readonly selfKeys: { pub: string; priv: string; trusted: boolean; shaVersion: ShaVersion }[],\n    private readonly options: {\n      failRecoverAndVerifySelfHierarchyKeys?: boolean\n      overrideGenerateNewKeyForDataOwner?: () => Promise<KeyPair<CryptoKey> | boolean | 'keyless'>\n    } = {}\n  ) {}\n\n  dataOwnerRequiresAnonymousDelegation(dataOwner: CryptoActorStubWithType): boolean {\n    return dataOwner.type != DataOwnerTypeEnum.Hcp\n  }\n\n  async recoverAndVerifySelfHierarchyKeys(\n    keysData: {\n      dataOwner: DataOwnerWithType\n      unknownKeys: string[]\n      unavailableKeys: string[]\n    }[],\n    cryptoPrimitives: CryptoPrimitives,\n    keyPairRecoverer: KeyPairRecoverer\n  ): Promise<{\n    [p: string]: { recoveredKeys: { [p: string]: KeyPair<CryptoKey> }; keyAuthenticity: { [p: string]: boolean } }\n  }> {\n    if (this.options.failRecoverAndVerifySelfHierarchyKeys) {\n      throw new Error(\"Shouldn't call this method now\")\n    }\n    expect(keysData).to.have.length(2)\n    const parentKeysWithFp = await Promise.all(\n      this.parentKeys.map(async (k) => ({\n        trusted: k.trusted,\n        fp: fingerprintV1(k.pub),\n        keypair: await cryptoPrimitives.RSA.importKeyPair('pkcs8', ua2ab(hex2ua(k.priv)), 'spki', ua2ab(hex2ua(k.pub)), k.shaVersion),\n      }))\n    )\n    const selfKeysWithFp = await Promise.all(\n      this.selfKeys.map(async (k) => ({\n        trusted: k.trusted,\n        fp: fingerprintV1(k.pub),\n        keypair: await cryptoPrimitives.RSA.importKeyPair('pkcs8', ua2ab(hex2ua(k.priv)), 'spki', ua2ab(hex2ua(k.pub)), k.shaVersion),\n      }))\n    )\n    return {\n      [keysData[0].dataOwner.dataOwner.id!]: {\n        recoveredKeys: Object.fromEntries(parentKeysWithFp.map((k) => [k.fp, k.keypair])),\n        keyAuthenticity: Object.fromEntries(parentKeysWithFp.map((k) => [k.fp, k.trusted])),\n      },\n      [keysData[1].dataOwner.dataOwner.id!]: {\n        recoveredKeys: Object.fromEntries(selfKeysWithFp.map((k) => [k.fp, k.keypair])),\n        keyAuthenticity: Object.fromEntries(selfKeysWithFp.map((k) => [k.fp, k.trusted])),\n      },\n    }\n  }\n\n  verifyDelegatePublicKeys(delegate: CryptoActorStubWithType, publicKeys: string[], cryptoPrimitives: CryptoPrimitives): Promise<string[]> {\n    const untrusted = new Set(\n      delegate.stub.cryptoActorProperties?.flatMap((p) => {\n        if (p.id == untrustedKeyPropId && p.typedValue?.stringValue != undefined) {\n          return [p.typedValue.stringValue]\n        } else {\n          return []\n        }\n      })\n    )\n    return Promise.resolve(publicKeys.filter((k) => !untrusted.has(fingerprintV2(k))))\n  }\n\n  generateNewKeyForDataOwner(self: DataOwnerWithType, cryptoPrimitives: CryptoPrimitives): Promise<KeyPair<CryptoKey> | boolean | 'keyless'> {\n    if (this.options.overrideGenerateNewKeyForDataOwner) {\n      return this.options.overrideGenerateNewKeyForDataOwner()\n    }\n    return Promise.reject(new Error('Should not be called now'))\n  }\n}\n\ndescribe('CSM-729', async function () {\n  before(async function () {\n    this.timeout(600000)\n    const initializer = await getEnvironmentInitializer()\n    env = await initializer.execute(getEnvVariables())\n  })\n\n  it('User with untrusted key', async function () {\n    const { grandCredentials: parent, parentCredentials: hcp } = await createHcpHierarchyApis(env)\n    // Create some data to use the original keys\n    const initialApi = await IcureApi.initialise(\n      env.iCureUrl,\n      { username: hcp.user, password: hcp.password },\n      new TrustedKeysStrategy(\n        [{ priv: parent.privateKey, pub: parent.publicKey, trusted: true, shaVersion: ShaVersion.Sha1 }],\n        [{ priv: hcp.privateKey, pub: hcp.publicKey, trusted: true, shaVersion: ShaVersion.Sha1 }]\n      ),\n      webcrypto as any,\n      fetch,\n      {\n        storage: new TestStorage(),\n        keyStorage: new TestKeyStorage(),\n      }\n    )\n    const user = await initialApi.userApi.getCurrentUser()\n    const pat1 = await initialApi.patientApi.createPatientWithUser(\n      user,\n      await initialApi.patientApi.newInstance(\n        user,\n        {\n          firstName: 'John',\n          lastName: 'Doe',\n          note: 'Secret note',\n        },\n        {\n          additionalDelegates: { [parent.dataOwnerId]: AccessLevelEnum.WRITE },\n        }\n      )\n    )\n    // Check exchange data was created as expected\n    const selfSelfXdata = await initialApi.cryptoApi.exchangeData.base.getExchangeDataByDelegatorDelegatePair(hcp.dataOwnerId, hcp.dataOwnerId)\n    const selfParentXdata = await initialApi.cryptoApi.exchangeData.base.getExchangeDataByDelegatorDelegatePair(hcp.dataOwnerId, parent.dataOwnerId)\n    expect(selfSelfXdata).to.not.be.undefined\n    expect(selfParentXdata).to.not.be.undefined\n    expect(selfSelfXdata).to.have.length(1)\n    expect(selfParentXdata).to.have.length(1)\n    // Prepare for new api with untrusted key\n    //// Mark self hcp keys as untrusted\n    let selfHcp = await initialApi.healthcarePartyApi.getCurrentHealthcareParty()\n    selfHcp = await initialApi.healthcarePartyApi.modifyHealthcareParty({\n      ...selfHcp,\n      cryptoActorProperties: [\n        ...(selfHcp.cryptoActorProperties || []),\n        {\n          id: untrustedKeyPropId,\n          typedValue: { stringValue: fingerprintV2(hcp.publicKey) },\n        },\n      ],\n    })\n    //// Mark parent hcp keys as untrusted and add new key (currently can't be done through crypto strategies)\n    const newParentKey = await initialApi.cryptoApi.primitives.RSA.generateKeyPair(ShaVersion.Sha256)\n    const newParentKeySpki = ua2hex(await initialApi.cryptoApi.primitives.RSA.exportKey(newParentKey.publicKey, 'spki'))\n    const newParentKeyPkcs8 = ua2hex(await initialApi.cryptoApi.primitives.RSA.exportKey(newParentKey.privateKey, 'pkcs8'))\n    const adminApi = await initMasterApi(env)\n    let parentHcp = await adminApi.healthcarePartyApi.getHealthcareParty(parent.dataOwnerId)\n    parentHcp = await adminApi.healthcarePartyApi.modifyHealthcareParty({\n      // Hcp normally doesn't have right to modify parent, depends on permissions\n      ...parentHcp,\n      cryptoActorProperties: [\n        ...(parentHcp.cryptoActorProperties || []),\n        {\n          id: untrustedKeyPropId,\n          typedValue: { stringValue: fingerprintV2(parent.publicKey) },\n        },\n      ],\n      publicKeysForOaepWithSha256: [...(parentHcp.publicKeysForOaepWithSha256 || []), newParentKeySpki],\n    })\n    //// No need to invalidate exchange data, as untrusted keys are not used to validate it\n    // Setup new api\n    let didCreateNewKey = false\n    const newHcpKey = await initialApi.cryptoApi.primitives.RSA.generateKeyPair(ShaVersion.Sha256)\n    const newHcpKeySpki = ua2hex(await initialApi.cryptoApi.primitives.RSA.exportKey(newHcpKey.publicKey, 'spki'))\n    const newHcpKeyPkcs8 = ua2hex(await initialApi.cryptoApi.primitives.RSA.exportKey(newHcpKey.privateKey, 'pkcs8'))\n    const apiWithUntrustedKeysStorages = {\n      // Using a new storage, simulates wiping the local storage\n      storage: new TestStorage(),\n      keyStorage: new TestKeyStorage(),\n    }\n    const apiWithUntrustedKey = await IcureApi.initialise(\n      env.iCureUrl,\n      { username: hcp.user, password: hcp.password },\n      new TrustedKeysStrategy(\n        [\n          { priv: parent.privateKey, pub: parent.publicKey, trusted: false, shaVersion: ShaVersion.Sha1 },\n          { priv: newParentKeyPkcs8, pub: newParentKeySpki, trusted: true, shaVersion: ShaVersion.Sha256 },\n        ],\n        [{ priv: hcp.privateKey, pub: hcp.publicKey, trusted: false, shaVersion: ShaVersion.Sha1 }],\n        {\n          overrideGenerateNewKeyForDataOwner: () => {\n            didCreateNewKey = true\n            return Promise.resolve(newHcpKey)\n          },\n        }\n      ),\n      webcrypto as any,\n      fetch,\n      apiWithUntrustedKeysStorages\n    )\n    expect(didCreateNewKey).to.eq(true)\n    // Check all keys are available but only new keys are trusted\n    expect(\n      await apiWithUntrustedKey.cryptoApi.userKeysManager.getVerifiedPublicKeysFor(\n        await apiWithUntrustedKey.healthcarePartyApi.getHealthcareParty(hcp.dataOwnerId)\n      )\n    ).to.have.members([newHcpKeySpki])\n    expect(\n      await apiWithUntrustedKey.cryptoApi.userKeysManager.getVerifiedPublicKeysFor(\n        await apiWithUntrustedKey.healthcarePartyApi.getHealthcareParty(parent.dataOwnerId)\n      )\n    ).to.have.members([newParentKeySpki])\n    expect(await apiWithUntrustedKey.cryptoApi.userKeysManager.getCurrentUserHierarchyAvailablePublicKeysHex()).to.have.members([\n      newHcpKeySpki,\n      hcp.publicKey,\n      parent.publicKey,\n      newParentKeySpki,\n    ])\n    expect(await apiWithUntrustedKey.cryptoApi.userKeysManager.getCurrentUserAvailablePublicKeysHex(false)).to.have.members([\n      newHcpKeySpki,\n      hcp.publicKey,\n    ])\n    // Check can still read old data\n    const pat1Recovered = await apiWithUntrustedKey.patientApi.getPatientWithUser(user, pat1.id!)\n    expect(pat1Recovered.note).to.eq('Secret note')\n    // Check can create new data\n    const pat2 = await initialApi.patientApi.createPatientWithUser(\n      user,\n      await initialApi.patientApi.newInstance(\n        user,\n        {\n          firstName: 'Joe',\n          lastName: 'Doe',\n          note: 'Secret note',\n        },\n        {\n          additionalDelegates: { [parent.dataOwnerId]: AccessLevelEnum.WRITE },\n        }\n      )\n    )\n    // Check created new exchange data and only used the new trusted keys for it\n    const selfSelfXdata2 = await initialApi.cryptoApi.exchangeData.base.getExchangeDataByDelegatorDelegatePair(hcp.dataOwnerId, hcp.dataOwnerId)\n    const selfParentXdata2 = await initialApi.cryptoApi.exchangeData.base.getExchangeDataByDelegatorDelegatePair(hcp.dataOwnerId, parent.dataOwnerId)\n    expect(selfSelfXdata2).to.not.be.undefined\n    expect(selfParentXdata2).to.not.be.undefined\n    expect(selfSelfXdata2).to.have.length(2)\n    expect(selfParentXdata2).to.have.length(2)\n    const newSelfSelfXdata = selfSelfXdata2.filter((xd) => xd.id !== selfSelfXdata[0].id)!\n    expect(newSelfSelfXdata).to.have.length(1)\n    const newSelfSelfXDataUsedFps = Object.keys(newSelfSelfXdata[0].exchangeKey)\n    expect(newSelfSelfXDataUsedFps).to.have.length(1)\n    expect(newSelfSelfXDataUsedFps[0]).to.eq(fingerprintV2(newHcpKeySpki))\n    const newSelfParentXdata = selfParentXdata2.filter((xd) => xd.id !== selfParentXdata[0].id)!\n    expect(newSelfParentXdata).to.have.length(1)\n    const newSelfParentXDataUsedFps = Object.keys(newSelfParentXdata[0].exchangeKey)\n    expect(newSelfParentXDataUsedFps).to.have.length(2)\n    expect(newSelfParentXDataUsedFps).to.have.members([fingerprintV2(newHcpKeySpki), fingerprintV2(newParentKeySpki)])\n    // Check after reinitialization with keys already in storage the \"verified\" situation is unchanged.\n    const apiWithUntrustedKey2 = await IcureApi.initialise(\n      env.iCureUrl,\n      { username: hcp.user, password: hcp.password },\n      new TrustedKeysStrategy([], [], { failRecoverAndVerifySelfHierarchyKeys: true }),\n      webcrypto as any,\n      fetch,\n      apiWithUntrustedKeysStorages\n    )\n    expect(\n      await apiWithUntrustedKey2.cryptoApi.userKeysManager.getVerifiedPublicKeysFor(\n        await apiWithUntrustedKey2.healthcarePartyApi.getHealthcareParty(hcp.dataOwnerId)\n      )\n    ).to.have.members([newHcpKeySpki])\n    expect(\n      await apiWithUntrustedKey2.cryptoApi.userKeysManager.getVerifiedPublicKeysFor(\n        await apiWithUntrustedKey2.healthcarePartyApi.getHealthcareParty(parent.dataOwnerId)\n      )\n    ).to.have.members([newParentKeySpki])\n    expect(await apiWithUntrustedKey2.cryptoApi.userKeysManager.getCurrentUserHierarchyAvailablePublicKeysHex()).to.have.members([\n      newHcpKeySpki,\n      hcp.publicKey,\n      parent.publicKey,\n      newParentKeySpki,\n    ])\n    expect(await apiWithUntrustedKey2.cryptoApi.userKeysManager.getCurrentUserAvailablePublicKeysHex(false)).to.have.members([\n      newHcpKeySpki,\n      hcp.publicKey,\n    ])\n  })\n})\n"]}