import { IccAccesslogApi, IccAgendaApi, IccAnonymousAccessApi, IccAuthApi, IccBeefactApi, IccBeresultexportApi, IccBeresultimportApi, IccBesamv2Api, IccCalendarItemTypeApi, IccClassificationTemplateApi, IccEntityrefApi, IccEntitytemplateApi, IccFormApi, IccFrontendmigrationApi, IccGroupApi, IccIcureApi, IccInsuranceApi, IccKeywordApi, IccMedexApi, IccMedicallocationApi, IccPatientApi, IccPermissionApi, IccPlaceApi, IccPubsubApi, IccReplicationApi, IccTarificationApi, IccTimeTableApi, IccTmpApi } from '../icc-api'; import { IccUserXApi } from './icc-user-x-api'; import { IccCryptoXApi } from './icc-crypto-x-api'; import { IccContactXApi } from './icc-contact-x-api'; import { IccInvoiceXApi } from './icc-invoice-x-api'; import { IccDocumentXApi } from './icc-document-x-api'; import { IccHcpartyXApi } from './icc-hcparty-x-api'; import { IccFormXApi } from './icc-form-x-api'; import { IccHelementXApi } from './icc-helement-x-api'; import { IccClassificationXApi } from './icc-classification-x-api'; import { IccCalendarItemXApi } from './icc-calendar-item-x-api'; import { IccPatientXApi } from './icc-patient-x-api'; import { IccMessageXApi } from './icc-message-x-api'; import { IccReceiptXApi } from './icc-receipt-x-api'; import { IccAccesslogXApi } from './icc-accesslog-x-api'; import { IccCodeXApi } from './icc-code-x-api'; import { IccMaintenanceTaskXApi } from './icc-maintenance-task-x-api'; import { IccDataOwnerXApi } from './icc-data-owner-x-api'; import { StorageFacade } from './storage/StorageFacade'; import { KeyStorageFacade } from './storage/KeyStorageFacade'; import { AuthenticationProvider } from './auth/AuthenticationProvider'; import { CryptoPrimitives } from './crypto/CryptoPrimitives'; import { StorageEntryKeysFactory } from './storage/StorageEntryKeysFactory'; import { CryptoStrategies } from './crypto/CryptoStrategies'; import { IccIcureMaintenanceXApi } from './icc-icure-maintenance-x-api'; import { IccDeviceXApi } from './icc-device-x-api'; import { IccBekmehrXApi } from './icc-bekmehr-x-api'; import { IccDoctemplateXApi } from './icc-doctemplate-x-api'; import { UserGroup } from '../icc-api/model/UserGroup'; import { IccTopicXApi } from './icc-topic-x-api'; import { IccRelatedPersonXApi } from './icc-related-person-x-api'; import { IccRoleApi } from '../icc-api/api/IccRoleApi'; import { AuthSecretProvider, SmartAuthProviderInitialSecret } from './auth/SmartAuthProvider'; import { IccRecoveryXApi } from './icc-recovery-x-api'; import { IccApplicationSettingsXApi } from './icc-application-settings-x-api'; export * from './icc-accesslog-x-api'; export * from './icc-application-settings-x-api'; export * from './icc-bekmehr-x-api'; export * from './icc-calendar-item-x-api'; export * from './icc-classification-x-api'; export * from './icc-code-x-api'; export * from './icc-contact-x-api'; export * from './icc-crypto-x-api'; export * from './icc-doctemplate-x-api'; export * from './icc-document-x-api'; export * from './icc-form-x-api'; export * from './icc-hcparty-x-api'; export * from './icc-helement-x-api'; export * from './icc-invoice-x-api'; export * from './icc-message-x-api'; export * from './icc-patient-x-api'; export * from './icc-user-x-api'; export * from './icc-receipt-x-api'; export * from './icc-related-person-x-api'; export * from './icc-data-owner-x-api'; export * from './icc-icure-maintenance-x-api'; export * from './icc-maintenance-task-x-api'; export * from './icc-recovery-x-api'; export * from './utils'; export * from './crypto/RSA'; export * from './crypto/CryptoPrimitives'; export * from './crypto/ShareMetadataBehaviour'; export * from './auth/AuthenticationProvider'; export { AuthSecretDetails, AuthSecretType, AuthSecretProvider, SmartAuthProviderInitialSecret } from './auth/SmartAuthProvider'; export { KeyStorageFacade } from './storage/KeyStorageFacade'; export { LocalStorageImpl } from './storage/LocalStorageImpl'; export { StorageFacade } from './storage/StorageFacade'; export { KeyStorageImpl } from './storage/KeyStorageImpl'; export { CryptoStrategies } from './crypto/CryptoStrategies'; export { NativeCryptoPrimitivesBridge } from './crypto/NativeCryptoPrimitivesBridge'; export { hexPublicKeysWithSha1Of, hexPublicKeysWithSha256Of, getShaVersionForKey } from './crypto/utils'; export { SecretIdUseOption } from './crypto/SecretIdUseOption'; export interface BasicApis { readonly accessLogApi: IccAccesslogApi; readonly agendaApi: IccAgendaApi; readonly authApi: IccAuthApi; readonly codeApi: IccCodeXApi; readonly deviceApi: IccDeviceXApi; readonly entityReferenceApi: IccEntityrefApi; readonly formApi: IccFormApi; readonly groupApi: IccGroupApi; readonly healthcarePartyApi: IccHcpartyXApi; readonly icureApi: IccIcureApi; readonly insuranceApi: IccInsuranceApi; readonly patientApi: IccPatientApi; readonly permissionApi: IccPermissionApi; readonly pricingApi: IccTarificationApi; readonly roleApi: IccRoleApi; readonly userApi: IccUserXApi; } export interface Apis extends BasicApis { readonly calendarItemTypeApi: IccCalendarItemTypeApi; readonly medicalLocationApi: IccMedicallocationApi; readonly cryptoApi: IccCryptoXApi; readonly accessLogApi: IccAccesslogXApi; readonly contactApi: IccContactXApi; readonly formApi: IccFormXApi; readonly invoiceApi: IccInvoiceXApi; readonly documentApi: IccDocumentXApi; readonly healthcareElementApi: IccHelementXApi; readonly classificationApi: IccClassificationXApi; readonly calendarItemApi: IccCalendarItemXApi; readonly receiptApi: IccReceiptXApi; readonly timetableApi: IccTimeTableApi; readonly patientApi: IccPatientXApi; readonly messageApi: IccMessageXApi; readonly maintenanceTaskApi: IccMaintenanceTaskXApi; readonly dataOwnerApi: IccDataOwnerXApi; readonly icureMaintenanceTaskApi: IccIcureMaintenanceXApi; readonly anonymousAccessApi: IccAnonymousAccessApi; readonly applicationSettingsApi: IccApplicationSettingsXApi; readonly bekmehrApi: IccBekmehrXApi; readonly beefactApi: IccBeefactApi; readonly beresultexportApi: IccBeresultexportApi; readonly beresultimportApi: IccBeresultimportApi; readonly besamv2Api: IccBesamv2Api; readonly classificationTemplateApi: IccClassificationTemplateApi; readonly doctemplateApi: IccDoctemplateXApi; readonly entitytemplateApi: IccEntitytemplateApi; readonly frontendmigrationApi: IccFrontendmigrationApi; readonly icureApi: IccIcureApi; readonly keywordApi: IccKeywordApi; readonly medexApi: IccMedexApi; readonly placeApi: IccPlaceApi; readonly pubsubApi: IccPubsubApi; readonly replicationApi: IccReplicationApi; readonly tarificationApi: IccTarificationApi; readonly tmpApi: IccTmpApi; readonly topicApi: IccTopicXApi; readonly relatedPersonApi: IccRelatedPersonXApi; readonly recoveryApi: IccRecoveryXApi; } /** * Allows to customise the behaviour of the iCure API by providing various optional parameters. */ export interface IcureApiOptions { /** * Specifies how iCure can store string values (e.g. json). In production this should be persistent storage. * @default the browser's localStorage. */ readonly storage?: StorageFacade; /** * Specifies how iCure can store cryptographic keys. Preferably this should be some ad-hoc storage key storage. * @default stores the json of the jwk representation of the key in {@link storage}. */ readonly keyStorage?: KeyStorageFacade; /** * Specifies where iCure should store his data within the {@link storage} and {@link keyStorage}. * @default {@link DefaultStorageEntryKeysFactory} */ readonly entryKeysFactory?: StorageEntryKeysFactory; /** * Specifies if iCure should automatically create maintenance tasks for requesting access back when a new key is generated at initialisation time. * Note that the maintenance task will be created only towards HCP data owners: if you want to create a maintenance task also to other types of data * owners you should disable this and call {@link IccIcureMaintenanceXApi.createMaintenanceTasksForNewKeypair} yourself. * @default true */ readonly createMaintenanceTasksOnNewKey?: boolean; /** * Additional headers to use on each request made by the iCure api. * @default no additional headers */ readonly headers?: { [headerName: string]: string; }; /** * Specifies which fields should be encrypted for each kind of encryptable entity. You should make sure that every application in your environment * specifies the same values for this configuration. * @default see documentation for {@link EncryptedFieldsConfig} */ readonly encryptedFieldsConfig?: EncryptedFieldsConfig; /** * Each user may exist in multiple groups, but an instance of {@link IcureApi} is specialised for a single group. This function allows you to decide * the group to use for a given user. * This functions will be called only if a user exists in at least 2 groups, and takes in input: * - the information on the groups the user can access (in no specific order) * - if the authentication method uses JWT also the current group id (undefined otherwise) * The function must return the id of one of the available groups. * @default takes the first group provided. The group chosen by this method may vary between different instantiations of the {@link IcureApi} even * if for the same user and if the groups available for the user do not change. */ readonly groupSelector?: (availableGroupsInfo: UserGroup[], currentGroupId?: string) => Promise; /** * Temporary value to support EHR Lite and MedTech api implementations. * * Currently, all hcps are able to access encrypted data shared with any of their parents, and on initialisation the api will verify that there is a * key pair available for the current user and for every parent of the user. If this option is set to true, the api will not load keys for the * parent users. * * This "implicit data-sharing scheme" (each parent HCP is essentially sharing data with all its children HCPs), however, may not be ideal for all * use cases, and it will be changed in future to be configurable in order to make it more general. * @default false, equivalent to previous behaviour. */ readonly disableParentKeysInitialisation?: boolean; /** * If true the Api will not use some endpoints that are available only in the latest versions of kraken lite. * Set it to true only for connecting to kraken-lite versions < 0.1.187 */ readonly useLiteCompatibilityMode?: boolean; /** * Allows injecting exchange data similarly to {@link IccCryptoXApi.injectExchangeData} but directly on * initialization. * When possible, this solution should be preferred as it allows minimizing proliferation of exchange data under * certain circumstances. */ readonly injectExchangeData?: { details: { exchangeDataId: string; accessControlSecret: ArrayBuffer; exchangeKey: ArrayBuffer; sharedSignatureKey: ArrayBuffer; verified: boolean; }[]; reEncryptWithOwnKeys: boolean; }; } /** * Specifies which fields should be encrypted for each kind of encryptable entity. * * Note that any value you specify here overrides the default values. For example if you specify `['medicalLocationId']` for `healthElement` the * fields `['descr', 'note']` which are usually encrypted by default will no longer be encrypted. If you want to add fields to the default values * you can use {@link EncryptedFieldsConfig.Defaults}, for example `[...EncryptedFieldsConfig.Defaults.healthElement, 'medicalLocationId']. * * # Encrypted fields syntax * * ## Grammar * * The grammar for each encrypted field is the following: * ``` * fieldName := * regex([a-zA-Z_][a-zA-Z0-9_]+) * encryptedField := * fieldName * | fieldName + ("." | ".*." | "[].") + encryptedField * ``` * * This grammar allows you to specify the fields to encrypt for the object and recursively for nested objects. * - A string containing only a single `fieldName` will encrypt the field with the given name. * - A string starting with `fieldName.` allows to specify the encrypted fields of a nested object. The encrypted values of the * fields in the nested object will be saved in the nested object. * - A string starting with `fieldName.*.` treats `fieldName` as a map/dictionary data structure and allows to specify the encrypted fields of the * values of the map. Note that the values of the map must be objects as well. The encrypted content of each map value is stored in that value. * - A string starting with `fieldName[].` treats `fieldName` as an array and allows to specify the encrypted fields of the values of the array. * Note that the values of the array must be objects as well. The encrypted content of each array element is stored in that element. * * ## Example * * Consider the following object and encryption keys: * ```javascript * const obj = { * a: { x: 0, y: 1 }, * b: "hello", * c: [ { public: "a", secret: "b" }, { public: "c", secret: "d" } ], * d: "ok", * e: { * info: "something", * private: "secret", * dataMap: { * "en": { * a: 1, * b: 2 * }, * "fr": { * a: 3, * b: 4 * } * } * } * } * const encryptedFields = [ * "a", * "c[].secret", * "d", * "e.private", * "e.datamap.*.a" * ] * ``` * If you use them with the crypt method you will get the following result: * ```json * { * b: "hello", * c: [ * { public: "a", encryptedSelf: 'encrypted+encoded { secret: "b" }' }, * { public: "c", encryptedSelf: 'encrypted+encoded { secret: "d" }' } * ], * e: { * info: "something", * dataMap: { * "en": { b: 2, encryptedSelf: 'encrypted+encoded { a: 1 }' }, * "fr": { b: 4, encryptedSelf: 'encrypted+encoded { a: 3 }' } * }, * encryptedSelf: 'encrypted+encoded { private: "secret" }' * }, * encryptedSelf: 'encrypted+encoded { a: { x: 0, y: 1 }, d: "ok" }' * } * ``` * * ## Shortened representation * * You can also group encrypted fields having the same prefix by concatenating to the prefix the JSON representation of an array of all the postfixes. * For example the following encrypted fields: * ```javascript * const encryptedFields = ["a.b.c.d.e.f1", "a.b.c.d.e.f2", "a.b.c.d.e.f3", "a.b.c.d.e.f4"] * ``` * can be shortened to * ```javascript * const encryptedFields = ['a.b.c.d.e.["f1","f2","f3","f4"]'] // Note the use of single quotes to avoid escaping the double quotes * ``` * If you use the shortened representation you may need to escape nested json representations. In that case the use of `JSON.stringify` is * recommended. */ export interface EncryptedFieldsConfig { /** * Fields to encrypt for entities of type {@link AccessLog} * @default ['detail', 'objectId'] */ readonly accessLog?: string[]; /** * Fields to encrypt for entities of type {@link CalendarItem} * @default ['details', 'title', 'patientId'] */ readonly calendarItem?: string[]; /** * Fields to encrypt for entities of type {@link Contact}, excluding `services`. You can specify which fields of `services` should be encrypted * using {@link service}. * @default ['descr'] // encryption of `services` is managed through {@link service} */ readonly contact?: string[]; /** * Fields to encrypt for entities of type {@link Service}. Note that encryption of the `content` field and recursively contained `Services` through * `content.compoundValue` is automatically managed by the sdk, and you are not allowed to modify it. * * Note: any non-empty values for this field will break bi-directional data compatibility between v7 and previous: Contacts created with * v7 will not be read properly by previous versions. If you want * @default ['notes[].markdown'] // encryption of `content` is managed in a special way */ readonly service?: string[]; /** * Fields to encrypt for entities of type {@link HealthElement} * @default ['descr', 'note', 'notes[].markdown'] */ readonly healthElement?: string[]; /** * Fields to encrypt for entities of type {@link MaintenanceTask} * @default ['properties'] */ readonly maintenanceTask?: string[]; /** * Fields to encrypt for entities of type {@link Patient} * @default ['note', 'notes[].markdown'] */ readonly patient?: string[]; /** * Fields to encrypt for entities of type {@link Message} * @default [] */ readonly message?: string[]; /** * Fields to encrypt for entities of type {@link Topic} * @default ['description'] */ readonly topic?: string[]; /** * Fields to encrypt for entities of type {@link RelatedPerson} * @default ['created', 'modified', 'companyName', 'languages', 'civility'] */ readonly relatedPerson?: string[]; /** * Fields to encrypt for entities of type {@link Document} * @default [] */ readonly document?: string[]; } export declare namespace EncryptedFieldsConfig { const Defaults: { accessLog: string[]; calendarItem: string[]; contact: string[]; service: string[]; healthElement: string[]; maintenanceTask: string[]; patient: string[]; message: never[]; document: never[]; topic: string[]; relatedPerson: string[]; }; } /** * Details for the authentication of a user */ export type AuthenticationDetails = { username: string; password: string; thirdPartyTokens?: { [thirdParty: string]: string; }; } | { icureTokens: { token: string; refreshToken: string; }; credentials?: { username: string; password: string; }; } | { thirdPartyTokens: { [thirdParty: string]: string; }; } | SmartAuthenticationDetails; /** * Allows to perform authentication through an {@link AuthSecretProvider}. * * The iCure SDK can authenticate to the backend using different kinds of secrets, such as passwords, long-lived authentication tokens, and * short-lived authentication tokens generated through the message gateway. iCure associates to each kind of secret a certain security level, and for * some sensitive operations, depending on the configurations of the user and his group, some operations may require a secret of a certain security * level. For example, with the default configurations, in order to change his own email the user can't have logged in with a long-lived token, but he * needs to provide his current password or a short-lived token. * * By using this authentication option, the iCure SDK will automatically request and cache the secret from the {@link AuthSecretProvider} only when * needed, which should help to minimise the interaction with the user. * * Another advantage of using this authentication option over others is that in case all the cached tokens and secrets were to expire while performing * a request, instead of having the request fail the SDK will ask for a new secret from the {@link SmartAuthProvider} and the request will * automatically be retried with the new secret. * * You must provide the following information: * - secretProvider: the secret provider to use for authentication. Will handle interaction with the gui. * * You can also provide the following optional information, which may allow to reduce the requests for secrets initially: * - username: any kind of value that can identify the user (userId, groupId/userId, username, email, ...). More generic identifiers, valid * on multiple groups, allow for simpler group switching by using {@link IcureApi.switchGroup}. * This value, however, is mandatory if you want to use password or icure tokens. * - initialSecret: an initial secret (password, token, ...) that will be used to get new authentication tokens as needed. If it is expired it will be ignored. * - initialAuthToken: an initial authentication token used on each request. If it is expired it will be ignored. * - initialRefreshToken: an initial refresh token used to get new authentication tokens as needed. If it is expired it will be ignored. */ export type SmartAuthenticationDetails = { username?: string; secretProvider: AuthSecretProvider; initialSecret?: SmartAuthProviderInitialSecret; initialAuthToken?: string; initialRefreshToken?: string; }; /** * Main entry point for the iCure API. Provides entity-specific sub-apis and some general methods which are not related to a specific entity. */ export interface IcureApi extends Apis { /** * Get the information on groups that the current user can access and the current group that this api instance is working on. * Note that the values you will get for `availableGroups` may differ from the values you would get if you call {@link IccUserApi.getMatchingUsers} * on {@link Apis.userApi}, since the latter is specialised on the specific instance of the user in `currentGroup`. * - `currentGroup`: the group that this api instance is working on, or undefined if the backend environment is not multi-group. * - `availableGroups`: the list of groups that the current user can access with the provided secret. Empty if the backend environment is not * multi-group. */ getGroupsInfo(): Promise<{ currentGroup: UserGroup | undefined; availableGroups: UserGroup[]; }>; /** * Switches the api to allow the user to work on a different group. * @param newGroupId the id of the group to switch to. * @return a new api for the specified group. */ switchGroup(newGroupId: string): Promise; } export declare namespace IcureApi { /** * Initialises a new instance of the iCure API. */ function initialise(host: string, authenticationOptions: AuthenticationDetails | AuthenticationProvider, cryptoStrategies: CryptoStrategies, crypto?: Crypto | CryptoPrimitives, fetchImpl?: (input: RequestInfo, init?: RequestInit) => Promise, options?: IcureApiOptions): Promise; } export interface IcureBasicApi extends BasicApis { /** * Get the information on groups that the current user can access and the current group that this api instance is working on. * Note that the values you will get for `availableGroups` may differ from the values you would get if you call {@link IccUserApi.getMatchingUsers} * on {@link userApi}, since the latter is specialised on the specific instance of the user in `currentGroup`. * - `currentGroup`: the group that this api instance is working on, or undefined if the backend environment is not multi-group. * - `availableGroups`: the list of groups that the current user can access with the provided secret. Empty if the backend environment is not * multi-group. */ getGroupsInfo(): Promise<{ currentGroup: UserGroup | undefined; availableGroups: UserGroup[]; }>; /** * Switches the api to allow the user to work on a different group. * @param newGroupId the id of the group to switch to. * @return a new api for the specified group. */ switchGroup(newGroupId: string): Promise; } export interface IcureBasicApiOptions { /** * Additional headers to use on each request made by the iCure api. * @default no additional headers */ readonly headers?: { [headerName: string]: string; }; /** * Each user may exist in multiple groups, but an instance of {@link IcureApi} is specialised for a single group. This function allows you to decide * the group to use for a given user. * This functions will be called only if a user exists in at least 2 groups, and takes in input: * - the information on the groups the user can access (in no specific order) * - if the authentication method uses JWT also the current group id (undefined otherwise) * The function must return the id of one of the available groups. * @default takes the first group provided. The group chosen by this method may vary between different instantiations of the {@link IcureApi} even * if for the same user and if the groups available for the user do not change. */ readonly groupSelector?: (availableGroupsInfo: UserGroup[], currentGroupId?: string) => Promise; } export declare namespace IcureBasicApi { /** * Initialises a new instance of the iCure API. */ function initialise(host: string, authenticationOptions: AuthenticationDetails | AuthenticationProvider, fetchImpl?: (input: RequestInfo, init?: RequestInit) => Promise, options?: IcureBasicApiOptions): Promise; }