@icure/api 4.2.31 → 5.0.3

package/icc-x-api/icc-crypto-x-api.js

@@ -12,10 +12,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.IccCryptoXApi = void 0;
 const AES_1 = require("./crypto/AES");
 const RSA_1 = require("./crypto/RSA");
-const utils_1 = require("./crypto/utils");
 const shamir_1 = require("./crypto/shamir");
 const _ = require("lodash");
+const models_1 = require("../icc-api/model/models");
 const binary_utils_1 = require("./utils/binary-utils");
+const utils_1 = require("./utils");
 class IccCryptoXApi {
     constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
     patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}) {
@@ -29,6 +30,8 @@ class IccCryptoXApi {
         this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
         this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
         this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
+        this.rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.';
+        this.rsaKeyPairs = {};
         this.hcpartyBaseApi = hcpartyBaseApi;
         this.patientBaseApi = patientBaseApi;
         this.deviceBaseApi = deviceBaseApi;
@@ -36,7 +39,6 @@ class IccCryptoXApi {
         this.generateKeyConcurrencyMap = {};
         this._AES = new AES_1.AESUtils(crypto);
         this._RSA = new RSA_1.RSAUtils(crypto);
-        this._utils = new utils_1.UtilsClass();
         this._shamir = new shamir_1.ShamirClass(crypto);
     }
     get crypto() {
@@ -45,9 +47,6 @@ class IccCryptoXApi {
     get shamir() {
         return this._shamir;
     }
-    get utils() {
-        return this._utils;
-    }
     get RSA() {
         return this._RSA;
     }
@@ -66,17 +65,16 @@ class IccCryptoXApi {
      * @param delegateHcPartyId The Health Care Party id
      * @returns  \{delegatorId: delegateEncryptedHcPartyKey\}
      */
-    getHcPartyKeysForDelegate(
-    //TODO: suggested name: getAllEncryptedHcPKeysOfDelegate
-    delegateHcPartyId) {
+    getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId) {
         return (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
-            (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.forceGetHcPartyKeysForDelegate(delegateHcPartyId)));
+            (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.forceGetEncryptedAesExchangeKeysForDelegate(delegateHcPartyId)));
     }
-    forceGetHcPartyKeysForDelegate(delegateHcPartyId) {
+    forceGetEncryptedAesExchangeKeysForDelegate(delegateHcPartyId) {
         return Promise.all([
-            this.patientBaseApi.getPatientHcPartyKeysForDelegate(delegateHcPartyId).catch(() => { }),
-            this.hcpartyBaseApi.getHcPartyKeysForDelegate(delegateHcPartyId).catch(() => { }),
-        ]).then(([a, b]) => Object.assign({}, a, b));
+            this.patientBaseApi.getPatientAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
+            this.hcpartyBaseApi.getAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
+            this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
+        ]).then(([a, b, c]) => (Object.assign(Object.assign(Object.assign({}, a), b), c)));
     }
     randomUuid() {
         return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(/[018]/g, (c) => (Number(c) ^ (this._crypto.getRandomValues(new Uint8Array(1))[0] & (15 >> (Number(c) / 4)))).toString(16) //Keep that inlined or you will loose the random
@@ -85,19 +83,28 @@ class IccCryptoXApi {
     sha256(data) {
         return this._crypto.subtle.digest('SHA-256', data);
     }
-    encryptedShamirRSAKey(hcp, notaries, threshold) {
-        return this._RSA.loadKeyPairImported(hcp.id).then((keyPair) => this._RSA.exportKey(keyPair.privateKey, 'pkcs8').then((exportedKey) => {
+    getPublicKeys() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield Object.values(this.rsaKeyPairs).reduce((p, rsa) => __awaiter(this, void 0, void 0, function* () {
+                return (yield p).concat([(0, utils_1.jwk2spki)(yield this.RSA.exportKey(rsa.publicKey, 'jwk'))]);
+            }), Promise.resolve([]));
+        });
+    }
+    encryptShamirRSAKey(hcp, notaries, threshold) {
+        return this.loadKeyPairImported(hcp.id).then((keyPair) => this._RSA.exportKey(keyPair.privateKey, 'pkcs8').then((exportedKey) => __awaiter(this, void 0, void 0, function* () {
             const privateKey = exportedKey;
             const nLen = notaries.length;
-            const shares = nLen == 1 ? [privateKey] : this._shamir.share(binary_utils_1.ua2hex(privateKey), nLen, threshold || nLen).map((share) => binary_utils_1.hex2ua(share));
+            const shares = nLen == 1 ? [privateKey] : this._shamir.share((0, binary_utils_1.ua2hex)(privateKey), nLen, threshold || nLen).map((share) => (0, binary_utils_1.hex2ua)(share));
+            const publicKeys = yield this.getPublicKeys();
             return _.reduce(notaries, (queue, notary, idx) => {
                 return queue.then((hcp) => __awaiter(this, void 0, void 0, function* () {
-                    const hcParty = hcp.hcPartyKeys[notary.id] ? hcp : (yield this.generateKeyForDelegate(hcp.id, notary.id));
+                    const { owner: hcParty, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(hcp, notary.id);
+                    const [publicKeyIdentifier, hcPartyKeys] = Object.entries(aesExchangeKeys)[0];
                     try {
-                        const importedAESHcPartyKey = yield this.decryptHcPartyKey(hcParty.id, notary.id, hcParty.hcPartyKeys[notary.id][1], false);
+                        const importedAESHcPartyKey = yield this.decryptHcPartyKey(notary.id, hcParty.id, notary.id, publicKeyIdentifier, hcPartyKeys, publicKeys);
                         const encryptedShamirPartition = yield this.AES.encrypt(importedAESHcPartyKey.key, shares[idx]);
                         hcParty.privateKeyShamirPartitions = hcParty.privateKeyShamirPartitions || {};
-                        hcParty.privateKeyShamirPartitions[notary.id] = binary_utils_1.ua2hex(encryptedShamirPartition);
+                        hcParty.privateKeyShamirPartitions[notary.id] = (0, binary_utils_1.ua2hex)(encryptedShamirPartition);
                     }
                     catch (e) {
                         console.log('Error during encryptedShamirRSAKey', notary.id, e);
@@ -105,7 +112,7 @@ class IccCryptoXApi {
                     return hcParty;
                 }));
             }, Promise.resolve(hcp));
-        }));
+        })));
     }
     /* Reconstructs the hcp's private key from the notaries' shamir shares and stores it in localstorage.
     The retrieval procedure of the shares is not designed or implemented yet.  Therefore, it currently only
@@ -113,15 +120,18 @@ class IccCryptoXApi {
      * @param hcp : the hcp whose key we want to reconstruct
      * @param notaries : holders of the shamir shares
     **/
-    decryptedShamirRSAKey(hcp, notaries) {
+    decryptShamirRSAKey(hcp, notaries) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
+                const publicKeys = yield this.getPublicKeys();
                 const nLen = notaries.length;
                 let decryptedPrivatedKey;
                 if (nLen == 1) {
-                    const importedAESHcPartyKey = yield this.decryptHcPartyKey(hcp.id, notaries[0].id, hcp.hcPartyKeys[notaries[0].id][1], false);
-                    const cryptedPrivatedKey = hcp.privateKeyShamirPartitions[notaries[0].id];
-                    decryptedPrivatedKey = binary_utils_1.ua2hex(yield this.AES.decrypt(importedAESHcPartyKey.key, binary_utils_1.hex2ua(cryptedPrivatedKey)));
+                    const notaryHcPartyId = notaries[0].id;
+                    const encryptedAesKeyMap = yield this.getEncryptedAesExchangeKeys(hcp, notaryHcPartyId);
+                    const importedAESHcPartyKey = yield Promise.all(Object.entries(encryptedAesKeyMap).map(([idPubKey, keysMap]) => __awaiter(this, void 0, void 0, function* () { return yield this.decryptHcPartyKey(notaryHcPartyId, hcp.id, notaryHcPartyId, idPubKey, keysMap, publicKeys); })));
+                    const cryptedPrivatedKey = hcp.privateKeyShamirPartitions[notaryHcPartyId];
+                    decryptedPrivatedKey = (0, binary_utils_1.ua2hex)(yield this.AES.decryptSome(importedAESHcPartyKey.map((k) => k.key), (0, binary_utils_1.hex2ua)(cryptedPrivatedKey)));
                 }
                 else {
                     const decryptedShares = yield _.reduce(notaries, (queue, notary) => {
@@ -130,9 +140,10 @@ class IccCryptoXApi {
                                 // TODO: now, we get the encrypted shares in db and decrypt them. This assumes that the
                                 // the notaries' private keys are in localstorage. We should implement a way for the notaries to
                                 // give hcp the decrypted shares without having to also share their private keys.
-                                const importedAESHcPartyKey = yield this.decryptHcPartyKey(hcp.id, notary.id, hcp.hcPartyKeys[notary.id][1], false);
+                                const encryptedAesKeyMap = yield this.getEncryptedAesExchangeKeys(hcp, notary.id);
+                                const importedAESHcPartyKey = yield Promise.all(Object.entries(encryptedAesKeyMap).map(([idPubKey, keysMap]) => __awaiter(this, void 0, void 0, function* () { return yield this.decryptHcPartyKey(notary.id, hcp.id, notary.id, idPubKey, keysMap, publicKeys); })));
                                 const encryptedShare = hcp.privateKeyShamirPartitions[notary.id];
-                                const decryptedShamirPartition = binary_utils_1.ua2hex(yield this.AES.decrypt(importedAESHcPartyKey.key, binary_utils_1.hex2ua(encryptedShare)));
+                                const decryptedShamirPartition = (0, binary_utils_1.ua2hex)(yield this.AES.decryptSome(importedAESHcPartyKey.map((k) => k.key), (0, binary_utils_1.hex2ua)(encryptedShare)));
                                 shares.push(decryptedShamirPartition);
                             }
                             catch (e) {
@@ -143,10 +154,10 @@ class IccCryptoXApi {
                     }, Promise.resolve([]));
                     decryptedPrivatedKey = this._shamir.combine(decryptedShares);
                 }
-                const importedPrivateKey = yield this.RSA.importKey('pkcs8', binary_utils_1.hex2ua(decryptedPrivatedKey), ['decrypt']);
-                const importedPublicKey = yield this.RSA.importKey('spki', binary_utils_1.hex2ua(hcp.publicKey), ['encrypt']);
-                const exportedKeyPair = yield this.RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk');
-                this.RSA.storeKeyPair(hcp.id, exportedKeyPair);
+                const importedPrivateKey = yield this._RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(decryptedPrivatedKey), ['decrypt']);
+                const importedPublicKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(hcp.publicKey), ['encrypt']);
+                const exportedKeyPair = yield this._RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk');
+                this.storeKeyPair(hcp.id, exportedKeyPair);
             }
             catch (e) {
                 console.log('Cannot decrypt shamir RSA key');
@@ -158,63 +169,123 @@ class IccCryptoXApi {
      *
      * If the decrypted key exists in the cache, retrieves it from there.
      * Otherwise, decrypts it using the RSA key of the delegator or delegate (depending on the value of `encryptedForDelegator`)
-     * @param delegatorId : the id of the delegator HcP
-     * @param delegateHcPartyId : the id of the delegate HcP
-     * @param encryptedHcPartyKey : can be delegatorEncryptedHcPartyKey or delegateEncryptedHcPartyKey (depending on the value of `encryptedForDelegator`)
-     * @param encryptedForDelegator : default false - for the `encryptedHcPartyKey` RSA encrypted for delegate; true for the `encryptedHcPartyKey` RSA encrypted for delegator;
+     *
+     * @param loggedHcPartyId The logged DataOwner id or the id of his parent
+     * @param delegatorId The id of Delegator eg, the DataOwner where this AES exchange key is stored
+     * @param delegateHcPartyId The id of the delegate : the data owner for whom this aes exchange key has been created
+     * @param publicKey The public key of the delegator : A unique aes exchange key is created for each public key of the delegator. This is the public key corresponding to the encryptedHcPartyKeys
+     * @param encryptedHcPartyKeys The encryptedHcPartyKeys to be decrypted
+     * @param publicKeys The public keys for which we might have a private key
+     *
      * @returns - **delegatorId** the input param  `delegatorId`
      * - **key** the decrypted `encryptedHcPartyKey`
      */
-    decryptHcPartyKey(delegatorId, delegateHcPartyId, encryptedHcPartyKey, encryptedForDelegator = false //TODO: suggestion: break this into 2 separate methods: decryptDelegatorEncryptedHcPartyKey() and decryptDelegateEncryptedHcPartyKey()
-    ) {
-        const cacheKey = delegatorId + '|' + delegateHcPartyId + '|' + (encryptedForDelegator ? '->' : '<-');
-        const res = this.hcPartyKeysCache[cacheKey];
-        const hcPartyKeyOwner = encryptedForDelegator ? delegatorId : delegateHcPartyId;
-        if (res) {
-            return Promise.resolve(res);
-        }
-        else {
-            const keyPair = this._RSA.rsaKeyPairs[hcPartyKeyOwner];
-            return (keyPair
-                ? Promise.resolve(keyPair)
-                : Promise.resolve(this._RSA.loadKeyPairNotImported(hcPartyKeyOwner)).then((keyPairInJwk) => this.cacheKeyPair(keyPairInJwk, hcPartyKeyOwner)))
-                .then((keyPair) => this._RSA.decrypt(keyPair.privateKey, binary_utils_1.hex2ua(encryptedHcPartyKey)))
-                .catch((e) => {
-                console.log(`Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId} as ${encryptedForDelegator ? 'delegator' : 'delegate'}`);
-                throw e;
-            })
-                .then((decryptedHcPartyKey) => this._AES.importKey('raw', decryptedHcPartyKey).then((decryptedImportedHcPartyKey) => ({
-                decryptedHcPartyKey,
-                decryptedImportedHcPartyKey,
-            })))
-                .then(({ decryptedHcPartyKey, decryptedImportedHcPartyKey }) => (this.hcPartyKeysCache[cacheKey] = {
-                delegatorId: delegatorId,
-                key: decryptedImportedHcPartyKey,
-                rawKey: binary_utils_1.ua2hex(new Uint8Array(decryptedHcPartyKey)),
-            }));
-        }
+    decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, publicKeys) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!publicKeys.length) {
+                const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: no public key`;
+                console.warn(reason);
+                throw new Error(reason);
+            }
+            const cacheKey = `${delegateHcPartyId}|${publicKey.slice(-32)}|${delegatorId}`;
+            const res = this.hcPartyKeysCache[cacheKey];
+            if (res) {
+                return res;
+            }
+            const result = yield publicKeys.reduce((res, pk) => __awaiter(this, void 0, void 0, function* () {
+                var _b;
+                const delegatorAndKeys = yield res;
+                if (delegatorAndKeys) {
+                    return delegatorAndKeys;
+                }
+                const fingerprint = pk.slice(-32);
+                const keyPair = (_b = this.rsaKeyPairs[fingerprint]) !== null && _b !== void 0 ? _b : (yield this.cacheKeyPair(this.loadKeyPairNotImported(loggedHcPartyId, fingerprint)));
+                if (!keyPair) {
+                    return;
+                }
+                const encryptedHcPartyKey = encryptedHcPartyKeys[fingerprint];
+                if (!encryptedHcPartyKey) {
+                    return;
+                }
+                try {
+                    const decryptedAesExchangeKey = yield this._RSA.decrypt(keyPair.privateKey, (0, binary_utils_1.hex2ua)(encryptedHcPartyKey));
+                    const importedAesExchangeKey = yield this._AES.importKey('raw', decryptedAesExchangeKey);
+                    return (this.hcPartyKeysCache[cacheKey] = {
+                        delegatorId: delegatorId,
+                        key: importedAesExchangeKey,
+                        rawKey: (0, binary_utils_1.ua2hex)(new Uint8Array(decryptedAesExchangeKey)),
+                    });
+                }
+                catch (e) {
+                    const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId} for pubKey ${fingerprint}: impossible to decrypt`;
+                    console.log(reason);
+                }
+            }), Promise.resolve());
+            const availablePublicKeys = publicKeys.filter((pk) => this.rsaKeyPairs[pk.slice(-32)]);
+            if (!result) {
+                //Try to find another key from the transfer keys
+                const hcp = (yield this.getDataOwner(loggedHcPartyId));
+                const candidates = Object.entries((_a = hcp.dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {})
+                    .filter(([fp, _]) => availablePublicKeys.some((pk) => pk.slice(-32) === fp.slice(-32))) // only keep keys that we will be able to decrypt
+                    .flatMap(([pk, keys]) => Object.entries(keys).map(([k, v]) => [pk, k, v]))
+                    .filter(([_, k]) => !publicKeys.some((apk) => apk.slice(-32) === k.slice(-32)));
+                if (candidates.length) {
+                    const newPublicKeys = yield candidates.reduce((p, [decryptionKeyFingerprint, privateKeyFingerprint, encryptedPrivateKey]) => __awaiter(this, void 0, void 0, function* () {
+                        var _c, _d;
+                        const newKeys = yield p;
+                        const aesExchangeKeys = (_c = Object.entries(hcp.dataOwner.aesExchangeKeys).find(([fp, _]) => fp.slice(-32) === privateKeyFingerprint.slice(-32))) === null || _c === void 0 ? void 0 : _c[1][loggedHcPartyId];
+                        if (aesExchangeKeys) {
+                            const encryptedAesExchangeKey = (_d = Object.entries(aesExchangeKeys).find(([fp, _]) => fp.slice(-32) === decryptionKeyFingerprint.slice(-32))) === null || _d === void 0 ? void 0 : _d[1];
+                            if (encryptedAesExchangeKey) {
+                                const keyPair = this.rsaKeyPairs[decryptionKeyFingerprint.slice(-32)];
+                                if (!keyPair) {
+                                    return newKeys;
+                                }
+                                const decryptedAesExchangeKey = yield this._RSA.decrypt(keyPair.privateKey, (0, binary_utils_1.hex2ua)(encryptedAesExchangeKey));
+                                const importedAesExchangeKey = yield this._AES.importKey('raw', decryptedAesExchangeKey);
+                                const decryptedPrivateKey = yield this._AES.decrypt(importedAesExchangeKey, (0, binary_utils_1.hex2ua)(encryptedPrivateKey));
+                                const newPublicKey = Object.keys(hcp.dataOwner.aesExchangeKeys).find((fp) => fp.slice(-32) === privateKeyFingerprint.slice(-32));
+                                yield this.cacheKeyPair({
+                                    publicKey: (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(newPublicKey)),
+                                    privateKey: (0, utils_1.pkcs8ToJwk)(decryptedPrivateKey),
+                                });
+                                return newKeys.concat([newPublicKey]);
+                            }
+                        }
+                        return newKeys;
+                    }), Promise.resolve([]));
+                    if (newPublicKeys.length) {
+                        return yield this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, newPublicKeys);
+                    }
+                }
+                const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: impossible to decrypt. No private key was found or could be used to decrypt the aes exchange keys`;
+                console.log(reason);
+                throw new Error(reason);
+            }
+            return result;
+        });
     }
     /**
      * Cache the RSA private/public key pair for the HcP with the given id `hcPartyKeyOwner`
      */
-    cacheKeyPair(keyPairInJwk, hcPartyKeyOwner) {
-        if (!keyPairInJwk) {
-            throw 'No RSA private key for Healthcare party(' + hcPartyKeyOwner + ').';
-        }
+    cacheKeyPair(keyPairInJwk) {
         return this._RSA.importKeyPair('jwk', keyPairInJwk.privateKey, 'jwk', keyPairInJwk.publicKey).then((importedKeyPair) => {
-            return (this._RSA.rsaKeyPairs[hcPartyKeyOwner] = importedKeyPair);
+            const pk = (0, utils_1.jwk2spki)(keyPairInJwk.publicKey);
+            return (this.rsaKeyPairs[pk.slice(-32)] = importedKeyPair);
         });
     }
     /**
-     * Gets the secret ID (SFKs) that should be used in the prescribed context (condfidential or not) from decrypted SPKs of the given `parent`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param parent : the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId : the id of the delegate HcP
-     * @param confidential : wether the key is going to be used for a confidential piece or data or not
+     * Gets the secret ID (SFKs) that should be used in the prescribed context (confidential or not) from decrypted SPKs of the given `parent`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
+     * @param parent :the object of which delegations (SPKs) to decrypt
+     * @param hcpartyId :the id of the delegate HcP
+     * @param confidential :weather the key is going to be used for a confidential piece or data or not
      * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
      * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
      */
     extractPreferredSfk(parent, hcpartyId, confidential) {
-        return this.extractSFKsHierarchyFromDelegations(parent, hcpartyId).then((secretForeignKeys) => {
+        return __awaiter(this, void 0, void 0, function* () {
+            const secretForeignKeys = yield this.extractSFKsHierarchyFromDelegations(parent, hcpartyId);
             const keys = secretForeignKeys
                 .filter(({ extractedKeys }) => extractedKeys.length > 0)
                 .filter((x, idx) => (confidential ? x.hcpartyId === hcpartyId : idx === 0))[0];
@@ -222,7 +293,7 @@ class IccCryptoXApi {
                 (confidential
                     ? keys.extractedKeys.find((k) => !secretForeignKeys.some(({ extractedKeys, hcpartyId: parentHcpId }) => hcpartyId !== parentHcpId && extractedKeys.includes(k)))
                     : keys.extractedKeys[0])) ||
-                null);
+                undefined);
         });
     }
     /**
@@ -238,34 +309,39 @@ class IccCryptoXApi {
      * @returns - **delegatorId** : the id of the delegator HcP that shares the **key** with the `delegateHcPartyId`
      *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `delegateHcPartyId`
      */
-    decryptAndImportAesHcPartyKeysForDelegators(
-    //TODO:  suggested name: getDecryptedHcPKeysSharedBetweenDelegateAndDelegators
-    delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds = 60) {
-        return (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
-            (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.getHcPartyKeysForDelegate(delegateHcPartyId))).then((delegatorIDsWithDelegateEncryptedHcPartyKey) => {
-            // [key: delegatorId] = delegateEncryptedHcPartyKey
-            // For each delegatorId, obtain the AES key (decrypted HcParty Key) shared with the delegate, decrypted by the delegate
-            return Promise.all(delegatorsHcPartyIdsSet.map((delegatorId) => {
-                if (!delegatorIDsWithDelegateEncryptedHcPartyKey[delegatorId]) {
-                    return undefined;
-                }
-                return this.decryptHcPartyKey(delegatorId, delegateHcPartyId, delegatorIDsWithDelegateEncryptedHcPartyKey[delegatorId]).catch(() => {
-                    console.log(`failed to decrypt hcPartyKey from ${delegatorId} to ${delegateHcPartyId}`);
-                    return undefined;
-                });
-            })).then((hcPartyKeys) => {
-                const filteredHcPartyKeys = hcPartyKeys.filter((hcPartyKey) => !!hcPartyKey);
-                if (filteredHcPartyKeys.length > 0) {
-                    return filteredHcPartyKeys;
-                }
-                const nowTimestamp = +new Date();
-                if (!this.cacheLastDeletionTimestamp || (nowTimestamp - this.cacheLastDeletionTimestamp) / 1000 >= minCacheDurationInSeconds) {
-                    delete this.hcPartyKeysRequestsCache[delegateHcPartyId];
-                    this.cacheLastDeletionTimestamp = nowTimestamp;
-                    return this.decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId);
-                }
-                return filteredHcPartyKeys;
-            });
+    decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds = 60) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const aesExchangeKeys = yield (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
+                (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId))).then((delegatorIdsWithDelegateEncryptedHcPartyKeys) => __awaiter(this, void 0, void 0, function* () {
+                // [key: delegatorId] = delegateEncryptedHcPartyKey
+                // For each delegatorId, obtain the AES key (decrypted HcParty Key) shared with the delegate, decrypted by the delegate
+                return (yield Promise.all(delegatorsHcPartyIdsSet.map((delegatorId) => __awaiter(this, void 0, void 0, function* () {
+                    const encryptedHcPartyKeysForPubKeyFingerprint = delegatorIdsWithDelegateEncryptedHcPartyKeys[delegatorId];
+                    if (!encryptedHcPartyKeysForPubKeyFingerprint) {
+                        return [];
+                    }
+                    const decryptedKeys = yield Promise.all(Object.entries(encryptedHcPartyKeysForPubKeyFingerprint).map(([delegatorPubKeyFinerprint, encryptedAesExchangeKeys]) => __awaiter(this, void 0, void 0, function* () {
+                        try {
+                            return yield this.decryptHcPartyKey(delegateHcPartyId, delegatorId, delegateHcPartyId, delegatorPubKeyFinerprint, encryptedAesExchangeKeys, Object.keys(this.rsaKeyPairs));
+                        }
+                        catch (e) {
+                            console.log(`failed to decrypt hcPartyKey from ${delegatorId} to ${delegateHcPartyId}`);
+                            return;
+                        }
+                    })));
+                    return decryptedKeys.filter((x) => !!x);
+                })))).reduce((acc, x) => [...acc, ...x], []);
+            }));
+            if (aesExchangeKeys.length > 0) {
+                return aesExchangeKeys;
+            }
+            const nowTimestamp = +new Date();
+            if (!this.cacheLastDeletionTimestamp || (nowTimestamp - this.cacheLastDeletionTimestamp) / 1000 >= minCacheDurationInSeconds) {
+                delete this.hcPartyKeysRequestsCache[delegateHcPartyId];
+                this.cacheLastDeletionTimestamp = nowTimestamp;
+                return this.decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds);
+            }
+            return [];
         });
     }
     /**
@@ -278,77 +354,99 @@ class IccCryptoXApi {
      * 3. Decrypt's delegators' keys and returns them.
      *
      * @param dataOwnerId : the id of the delegate HCP
-     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates
+     * @param delegations : delegations (can be SPKs, CFKs, EKs) for all delegates
      * @param fallbackOnParent  default true; use parent's healthCarePartyId in case there's no delegation for the `healthcarePartyId`
      * @returns  - **delegatorId** : the id of the delegator HcP that shares the **key** with the `healthcarePartyId`
      *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `healthcarePartyId`
      */
-    decryptAndImportAesHcPartyKeysInDelegations(
-    //TODO: suggested name: getDecryptedHcPKeysOfDelegateAndParentsFromGenericDelegations
-    dataOwnerId, delegations, fallbackOnParent = true) {
-        const delegatorIds = {};
-        const delegationsArray = delegations[dataOwnerId];
-        if (delegationsArray && delegationsArray.length) {
-            delegationsArray.forEach(function (delegationItem) {
-                delegatorIds[delegationItem.owner] = true; //TODO: why is set to true?
-            });
-        }
-        else if (fallbackOnParent) {
-            return this.getDataOwner(dataOwnerId).then(({ dataOwner: hcp }) => hcp.parentId ? this.decryptAndImportAesHcPartyKeysInDelegations(hcp.parentId, delegations) : Promise.resolve([]));
-        }
-        return this.decryptAndImportAesHcPartyKeysForDelegators(Object.keys(delegatorIds), dataOwnerId);
+    getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, fallbackOnParent = true) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const delegationsArray = (_a = delegations[dataOwnerId]) !== null && _a !== void 0 ? _a : [];
+            if (!delegationsArray.length && fallbackOnParent) {
+                const { dataOwner: hcp } = yield this.getDataOwner(dataOwnerId);
+                return hcp.parentId
+                    ? yield this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(hcp.parentId, delegations)
+                    : [];
+            }
+            else {
+                const delegatorIds = new Set();
+                delegationsArray.forEach((del) => delegatorIds.add(del.owner));
+                return this.decryptAndImportAesHcPartyKeysForDelegators(Array.from(delegatorIds), dataOwnerId);
+            }
+        });
     }
     /**
-     * Retreive the owner HealthCareParty key and use it to encrypt
+     * Retrieve the owner HealthCareParty key and use it to encrypt
      * both the delegations (createdObject.id) and the cryptedForeignKeys
      * (parentObject.id), and returns them in an object.
      */
     initObjectDelegations(createdObject, parentObject, ownerId, secretForeignKeyOfParent) {
-        this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initObjectDelegations', arguments);
-        if (parentObject)
-            this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject.id, 'initObjectDelegations', arguments);
-        const secretId = this.randomUuid();
-        return this.getDataOwner(ownerId)
-            .then(({ dataOwner: owner }) => {
-            return this.getOrCreateHcPartyKey(owner, ownerId);
-        })
-            .then((encryptedHcPartyKey) => this.decryptHcPartyKey(ownerId, ownerId, encryptedHcPartyKey, true))
-            .then((importedAESHcPartyKey) => Promise.all([
-            this._AES.encrypt(importedAESHcPartyKey.key, binary_utils_1.string2ua(createdObject.id + ':' + secretId).buffer, importedAESHcPartyKey.rawKey),
-            parentObject
-                ? this._AES.encrypt(importedAESHcPartyKey.key, binary_utils_1.string2ua(createdObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
-                : Promise.resolve(null),
-        ]))
-            .then((encryptedDelegationAndSecretForeignKey) => ({
-            delegations: _.fromPairs([
-                [
-                    ownerId,
-                    [
-                        {
-                            owner: ownerId,
-                            delegatedTo: ownerId,
-                            key: binary_utils_1.ua2hex(encryptedDelegationAndSecretForeignKey[0]),
-                        },
-                    ],
-                ],
-            ]),
-            cryptedForeignKeys: (encryptedDelegationAndSecretForeignKey[1] &&
-                _.fromPairs([
-                    [
-                        ownerId,
+        return __awaiter(this, arguments, void 0, function* () {
+            const publicKeys = yield this.getPublicKeys();
+            this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initObjectDelegations', arguments);
+            if (parentObject)
+                this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject.id, 'initObjectDelegations', arguments);
+            const secretId = this.randomUuid();
+            return this.getDataOwner(ownerId).then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
+                const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, ownerId);
+                const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys);
+                const encryptedDelegation = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId).buffer, importedAESHcPartyKey.rawKey);
+                const encryptedSecretForeignKey = parentObject &&
+                    this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey);
+                return {
+                    owner: modifiedOwner,
+                    delegations: _.fromPairs([
                         [
-                            {
-                                owner: ownerId,
-                                delegatedTo: ownerId,
-                                key: binary_utils_1.ua2hex(encryptedDelegationAndSecretForeignKey[1]),
-                            },
+                            ownerId,
+                            [
+                                {
+                                    owner: ownerId,
+                                    delegatedTo: ownerId,
+                                    key: (0, binary_utils_1.ua2hex)(encryptedDelegation),
+                                },
+                            ],
                         ],
-                    ],
-                ])) ||
-                {},
-            secretForeignKeys: (secretForeignKeyOfParent && [secretForeignKeyOfParent]) || [],
-            secretId: secretId,
-        }));
+                    ]),
+                    cryptedForeignKeys: (encryptedSecretForeignKey &&
+                        _.fromPairs([
+                            [
+                                ownerId,
+                                [
+                                    {
+                                        owner: ownerId,
+                                        delegatedTo: ownerId,
+                                        key: (0, binary_utils_1.ua2hex)(encryptedSecretForeignKey),
+                                    },
+                                ],
+                            ],
+                        ])) ||
+                        {},
+                    secretForeignKeys: (secretForeignKeyOfParent && [secretForeignKeyOfParent]) || [],
+                    secretId: secretId,
+                };
+            }));
+        });
+    }
+    decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, loggedHcPartyId, delegatorId, delegateHcPartyId, publicKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const importedAESHcPartyKey = yield Object.entries(aesExchangeKeys).reduce((acc, [publicKeyIdentifier, hcPartyKeys]) => __awaiter(this, void 0, void 0, function* () {
+                const accValue = yield acc;
+                if (accValue) {
+                    return accValue;
+                }
+                try {
+                    return yield this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKeyIdentifier, hcPartyKeys, publicKeys);
+                }
+                catch (e) {
+                    return undefined;
+                }
+            }), Promise.resolve());
+            if (!importedAESHcPartyKey) {
+                throw new Error(`No hcParty key can be decrypted from ${delegatorId} to ${delegateHcPartyId} using currently available private keys`);
+            }
+            return importedAESHcPartyKey;
+        });
     }
     /**
      * Gets updated instances of SPKs and CKFs for the child object `modifiedObject`.
@@ -377,32 +475,36 @@ class IccCryptoXApi {
     modifiedObject, parentObject, ownerId, delegateId, secretIdOfModifiedObject) {
         this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments); //modifiedObject should never be null
         if (parentObject)
-            this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments);
+            this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject === null || parentObject === void 0 ? void 0 : parentObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments);
         this.throwDetailedExceptionForInvalidParameter('secretIdOfModifiedObject', secretIdOfModifiedObject, 'extendedDelegationsAndCryptedForeignKeys', arguments);
         return this.getDataOwner(ownerId)
-            .then(({ dataOwner: owner }) => this.getOrCreateHcPartyKey(owner, delegateId))
-            .then((encryptedHcPartyKey) => this.decryptHcPartyKey(ownerId, delegateId, encryptedHcPartyKey, true))
-            .then((importedAESHcPartyKey) => Promise.all([
-            Promise.all(((modifiedObject.delegations || {})[delegateId] || []).map((d) => (d.key &&
-                d.owner === ownerId &&
-                this._AES.decrypt(importedAESHcPartyKey.key, binary_utils_1.hex2ua(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                    console.log(`Cannot decrypt delegation from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                    return null;
-                })) ||
-                Promise.resolve(null))),
-            Promise.all(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => (d.key &&
-                d.owner === ownerId &&
-                this._AES.decrypt(importedAESHcPartyKey.key, binary_utils_1.hex2ua(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                    console.log(`Cannot decrypt cryptedForeignKeys from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                    return null;
-                })) ||
-                Promise.resolve(null))),
-            this._AES.encrypt(importedAESHcPartyKey.key, binary_utils_1.string2ua(modifiedObject.id + ':' + secretIdOfModifiedObject).buffer, importedAESHcPartyKey.rawKey),
-            parentObject
-                ? this._AES.encrypt(importedAESHcPartyKey.key, binary_utils_1.string2ua(modifiedObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
-                : Promise.resolve(null),
-        ]))
-            .then(([previousDecryptedDelegations, previousDecryptedCryptedForeignKeys, cryptedDelegation, cryptedForeignKey]) => {
+            .then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
+            const publicKeys = yield this.getPublicKeys();
+            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
+            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, delegateId, ownerId, publicKeys);
+            modifiedObject = (modifiedObject === null || modifiedObject === void 0 ? void 0 : modifiedObject.id) === owner.id ? modifiedOwner : modifiedObject;
+            return {
+                previousDecryptedDelegations: yield Promise.all(((modifiedObject.delegations || {})[delegateId] || []).map((d) => (d.key &&
+                    d.owner === ownerId &&
+                    this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                        console.log(`Cannot decrypt delegation from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                        return Promise.resolve();
+                    })) ||
+                    Promise.resolve())),
+                previousDecryptedCryptedForeignKeys: yield Promise.all(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => (d.key &&
+                    d.owner === ownerId &&
+                    this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                        console.log(`Cannot decrypt cryptedForeignKeys from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                        return Promise.resolve();
+                    })) ||
+                    Promise.resolve())),
+                cryptedDelegation: yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretIdOfModifiedObject).buffer, importedAESHcPartyKey.rawKey),
+                cryptedForeignKey: parentObject
+                    ? yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
+                    : undefined,
+            };
+        }))
+            .then(({ previousDecryptedDelegations, previousDecryptedCryptedForeignKeys, cryptedDelegation, cryptedForeignKey }) => {
             //try to limit the extent of the modifications to the delegations by preserving the redundant delegation already present and removing duplicates
             //For delegate delegateId, we create:
             // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for each existing delegation and the new key concatenated
@@ -410,36 +512,42 @@ class IccCryptoXApi {
             // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
             const delegationCryptedDecrypted = _.merge(((modifiedObject.delegations || {})[delegateId] || []).map((d) => ({
                 d,
-            })), (previousDecryptedDelegations || []).map((dd) => (dd ? binary_utils_1.ua2string(dd) : null)).map((k) => ({ k })))
+            })), (previousDecryptedDelegations || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
                 .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                .map(({ d, k }) => ({ d, k: k || this.randomUuid() })) // Use some unique id that ensures the delegation not created by us are going to be held
+                .map(({ d, k }) => ({
+                d,
+                k: k || this.randomUuid(),
+            })) // Use some unique id that ensures the delegation not created by us are going to be held
                 .concat([
                 {
                     d: {
                         owner: ownerId,
                         delegatedTo: delegateId,
-                        key: binary_utils_1.ua2hex(cryptedDelegation),
+                        key: (0, binary_utils_1.ua2hex)(cryptedDelegation),
                     },
                     k: modifiedObject.id + ':' + secretIdOfModifiedObject,
                 },
             ]);
-            const allDelegations = _.cloneDeep(modifiedObject.delegations);
+            const allDelegations = _.cloneDeep(modifiedObject.delegations || {});
             //Only keep one version of the decrypted key
             allDelegations[delegateId] = _.uniqBy(delegationCryptedDecrypted, (x) => x.k).map((x) => x.d);
             const cryptedForeignKeysCryptedDecrypted = _.merge(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => ({
                 d,
-            })), (previousDecryptedCryptedForeignKeys || []).map((dd) => (dd ? binary_utils_1.ua2string(dd) : null)).map((k) => ({ k })))
+            })), (previousDecryptedCryptedForeignKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
                 .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                .map(({ d, k }) => ({ d, k: k || this.randomUuid() })) // Use some unique id that ensures the delegation not created by us are going to be held
+                .map(({ d, k }) => ({
+                d,
+                k: k || this.randomUuid(),
+            })) // Use some unique id that ensures the delegation not created by us are going to be held
                 .concat(cryptedForeignKey
                 ? [
                     {
                         d: {
                             owner: ownerId,
                             delegatedTo: delegateId,
-                            key: binary_utils_1.ua2hex(cryptedForeignKey),
+                            key: (0, binary_utils_1.ua2hex)(cryptedForeignKey),
                         },
-                        k: modifiedObject.id + ':' + parentObject.id,
+                        k: modifiedObject.id + ':' + (parentObject === null || parentObject === void 0 ? void 0 : parentObject.id),
                     },
                 ]
                 : []);
@@ -448,16 +556,38 @@ class IccCryptoXApi {
                 allCryptedForeignKeys[delegateId] = _.uniqBy(cryptedForeignKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
             }
             return {
+                modifiedObject,
                 delegations: allDelegations,
                 cryptedForeignKeys: allCryptedForeignKeys,
                 secretId: secretIdOfModifiedObject,
             };
         });
     }
-    getOrCreateHcPartyKey(owner, delegateId) {
-        return !owner.hcPartyKeys[delegateId]
-            ? this.generateKeyForDelegate(owner.id, delegateId).then((owner) => owner.hcPartyKeys[delegateId][0])
-            : Promise.resolve(owner.hcPartyKeys[delegateId][0]);
+    getEncryptedAesExchangeKeys(owner, delegateId) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            const publicKeys = yield this.getPublicKeys();
+            const mapOfAesExchangeKeys = Object.entries((_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})
+                .filter((e) => e[1][delegateId] && Object.keys(e[1][delegateId]).some((k1) => publicKeys.some((pk) => pk.endsWith(k1))))
+                .reduce((map, e) => {
+                const candidates = Object.entries(e[1][delegateId]);
+                const [publicKeyFingerprint, encryptedAesExchangeKey] = candidates[candidates.findIndex(([k, v]) => publicKeys.some((pk) => pk.endsWith(k)))];
+                return Object.assign(Object.assign({}, map), { [e[0]]: { [publicKeyFingerprint]: encryptedAesExchangeKey } });
+            }, {});
+            return !owner.publicKey || mapOfAesExchangeKeys[owner.publicKey] || !((_b = owner.hcPartyKeys) === null || _b === void 0 ? void 0 : _b[delegateId])
+                ? mapOfAesExchangeKeys
+                : Object.assign(Object.assign({}, mapOfAesExchangeKeys), { [owner.publicKey]: { [owner.publicKey.slice(-32)]: owner.hcPartyKeys[delegateId][0] } });
+        });
+    }
+    getOrCreateHcPartyKeys(owner, delegateId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const aesExchangeKeys = yield this.getEncryptedAesExchangeKeys(owner, delegateId);
+            if (Object.keys(aesExchangeKeys).length) {
+                return { owner, aesExchangeKeys };
+            }
+            const modifiedOwner = yield this.generateKeyForDelegate(owner.id, delegateId);
+            return { owner: modifiedOwner, aesExchangeKeys: yield this.getEncryptedAesExchangeKeys(modifiedOwner, delegateId) };
+        });
     }
     /**
      * Retrieve the owners HealthCareParty key, decrypt it, and
@@ -469,24 +599,26 @@ class IccCryptoXApi {
     initEncryptionKeys(createdObject, ownerId) {
         this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initEncryptionKeys', arguments);
         const secretId = this.randomUuid();
-        return this.getDataOwner(ownerId)
-            .then(({ dataOwner: owner }) => this.getOrCreateHcPartyKey(owner, ownerId))
-            .then((encryptedHcPartyKey) => this.decryptHcPartyKey(ownerId, ownerId, encryptedHcPartyKey, true))
-            .then((importedAESHcPartyKey) => this._AES.encrypt(importedAESHcPartyKey.key, binary_utils_1.string2ua(createdObject.id + ':' + secretId)))
-            .then((encryptedEncryptionKeys) => ({
-            encryptionKeys: _.fromPairs([
-                [
-                    ownerId,
+        return this.getDataOwner(ownerId).then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
+            const publicKeys = yield this.getPublicKeys();
+            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, ownerId);
+            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys);
+            const encryptedEncryptionKeys = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId), importedAESHcPartyKey.rawKey);
+            return {
+                encryptionKeys: _.fromPairs([
                     [
-                        {
-                            owner: ownerId,
-                            delegatedTo: ownerId,
-                            key: binary_utils_1.ua2hex(encryptedEncryptionKeys),
-                        },
+                        ownerId,
+                        [
+                            {
+                                owner: ownerId,
+                                delegatedTo: ownerId,
+                                key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKeys),
+                            },
+                        ],
                     ],
-                ],
-            ]),
-            secretId: secretId,
+                ]),
+                secretId: secretId,
+            };
         }));
     }
     /**
@@ -502,48 +634,53 @@ class IccCryptoXApi {
     appendEncryptionKeys(
     //TODO: suggested name: getExtendedEKwithDelegationFromDelegatorToDelegate
     modifiedObject, ownerId, delegateId, secretEncryptionKeyOfObject) {
-        this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'appendEncryptionKeys', arguments); //modifiedObject should never be null
-        this.throwDetailedExceptionForInvalidParameter('secretEncryptionKeyOfObject', secretEncryptionKeyOfObject, 'appendEncryptionKeys', arguments);
-        return this.getDataOwner(ownerId)
-            .then(({ dataOwner: owner }) => this.getOrCreateHcPartyKey(owner, delegateId))
-            .then((encryptedHcPartyKey) => this.decryptHcPartyKey(ownerId, delegateId, encryptedHcPartyKey, true))
-            .then((importedAESHcPartyKey) => Promise.all([
-            Promise.all(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => (d.key &&
-                d.owner === ownerId &&
-                this._AES.decrypt(importedAESHcPartyKey.key, binary_utils_1.hex2ua(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                    console.log(`Cannot decrypt encryption key from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                    return null;
-                })) ||
-                Promise.resolve(null))),
-            this._AES.encrypt(importedAESHcPartyKey.key, binary_utils_1.string2ua(modifiedObject.id + ':' + secretEncryptionKeyOfObject)),
-        ]))
-            .then(([previousDecryptedEncryptionKeys, encryptedEncryptionKey]) => {
-            //try to limit the extent of the modifications to the delegations by preserving the redundant encryption keys already present and removing duplicates
-            //For delegate delegateId, we create:
-            // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for the existing encryption keys and the new key concatenated
-            // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
-            // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
-            const encryptionKeysCryptedDecrypted = _.merge(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => ({
-                d,
-            })), (previousDecryptedEncryptionKeys || []).map((dd) => (dd ? binary_utils_1.ua2string(dd) : null)).map((k) => ({ k })))
-                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                .map(({ d, k }) => ({ d, k: k || this.randomUuid() }))
-                .concat([
-                {
-                    d: {
-                        owner: ownerId,
-                        delegatedTo: delegateId,
-                        key: binary_utils_1.ua2hex(encryptedEncryptionKey),
+        return __awaiter(this, arguments, void 0, function* () {
+            this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'appendEncryptionKeys', arguments); //modifiedObject should never be null
+            this.throwDetailedExceptionForInvalidParameter('secretEncryptionKeyOfObject', secretEncryptionKeyOfObject, 'appendEncryptionKeys', arguments);
+            return this.getDataOwner(ownerId)
+                .then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
+                const publicKeys = yield this.getPublicKeys();
+                const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
+                const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, delegateId, publicKeys);
+                return {
+                    previousDecryptedEncryptionKeys: yield Promise.all(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => (d.key &&
+                        d.owner === ownerId &&
+                        this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                            console.log(`Cannot decrypt encryption key from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                            return Promise.resolve();
+                        })) ||
+                        Promise.resolve())),
+                    encryptedEncryptionKey: yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretEncryptionKeyOfObject)),
+                };
+            }))
+                .then(({ previousDecryptedEncryptionKeys, encryptedEncryptionKey }) => {
+                //try to limit the extent of the modifications to the delegations by preserving the redundant encryption keys already present and removing duplicates
+                //For delegate delegateId, we create:
+                // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for the existing encryption keys and the new key concatenated
+                // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
+                // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
+                const encryptionKeysCryptedDecrypted = _.merge(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => ({
+                    d,
+                })), (previousDecryptedEncryptionKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
+                    .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
+                    .map(({ d, k }) => ({ d, k: k || this.randomUuid() }))
+                    .concat([
+                    {
+                        d: {
+                            owner: ownerId,
+                            delegatedTo: delegateId,
+                            key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKey),
+                        },
+                        k: modifiedObject.id + ':' + secretEncryptionKeyOfObject,
                     },
-                    k: modifiedObject.id + ':' + secretEncryptionKeyOfObject,
-                },
-            ]);
-            const allEncryptionKeys = _.cloneDeep(modifiedObject.encryptionKeys);
-            allEncryptionKeys[delegateId] = _.uniqBy(encryptionKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
-            return {
-                encryptionKeys: allEncryptionKeys,
-                secretId: secretEncryptionKeyOfObject,
-            };
+                ]);
+                const allEncryptionKeys = _.cloneDeep(modifiedObject.encryptionKeys);
+                allEncryptionKeys[delegateId] = _.uniqBy(encryptionKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
+                return {
+                    encryptionKeys: allEncryptionKeys,
+                    secretId: secretEncryptionKeyOfObject,
+                };
+            });
         });
     }
     /**
@@ -676,15 +813,22 @@ class IccCryptoXApi {
     extractKeysHierarchyFromDelegationLikes(
     //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
     hcpartyId, objectId, delegations) {
-        return this.getDataOwner(hcpartyId).then(({ dataOwner: hcp }) => (delegations[hcpartyId] && delegations[hcpartyId].length
-            ? this.decryptAndImportAesHcPartyKeysInDelegations(hcpartyId, delegations, false).then((decryptedAndImportedAesHcPartyKeys) => {
-                const collatedAesKeysFromDelegatorToHcpartyId = {};
-                decryptedAndImportedAesHcPartyKeys.forEach((k) => (collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] = k));
-                return this.decryptKeyInDelegationLikes(delegations[hcpartyId], collatedAesKeysFromDelegatorToHcpartyId, objectId);
-            })
-            : Promise.resolve([])).then((extractedKeys) => hcp.parentId
-            ? this.extractKeysHierarchyFromDelegationLikes(hcp.parentId, objectId, delegations).then((parentResponse) => parentResponse.concat({ extractedKeys: extractedKeys, hcpartyId: hcpartyId }))
-            : [{ extractedKeys: extractedKeys, hcpartyId: hcpartyId }]));
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const { dataOwner: hcp } = yield this.getDataOwner(hcpartyId);
+            const extractedKeys = [];
+            if ((_a = delegations[hcpartyId]) === null || _a === void 0 ? void 0 : _a.length) {
+                const decryptedAndImportedAesHcPartyKeys = yield this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(hcpartyId, delegations, false);
+                const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce((map, k) => (Object.assign(Object.assign({}, map), { [k.delegatorId]: k })), {});
+                extractedKeys.push(...(yield this.decryptKeyInDelegationLikes(delegations[hcpartyId], collatedAesKeysFromDelegatorToHcpartyId, objectId)));
+            }
+            return hcp.parentId
+                ? [
+                    ...(yield this.extractKeysHierarchyFromDelegationLikes(hcp.parentId, objectId, delegations)),
+                    { extractedKeys: extractedKeys, hcpartyId: hcpartyId },
+                ]
+                : [{ extractedKeys: extractedKeys, hcpartyId: hcpartyId }];
+        });
     }
     /**
      * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
@@ -703,9 +847,13 @@ class IccCryptoXApi {
     //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
     dataOwnerId, objectId, delegations) {
         return this.getDataOwner(dataOwnerId).then(({ dataOwner: hcp }) => (delegations[dataOwnerId] && delegations[dataOwnerId].length
-            ? this.decryptAndImportAesHcPartyKeysInDelegations(dataOwnerId, delegations, false).then((decryptedAndImportedAesHcPartyKeys) => {
+            ? this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, false).then((decryptedAndImportedAesHcPartyKeys) => {
                 const collatedAesKeysFromDelegatorToHcpartyId = {};
-                decryptedAndImportedAesHcPartyKeys.forEach((k) => (collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] = k));
+                decryptedAndImportedAesHcPartyKeys.forEach((k) => {
+                    var _a;
+                    ;
+                    ((_a = collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId]) !== null && _a !== void 0 ? _a : (collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] = [])).push(k);
+                });
                 return this.decryptKeyInDelegationLikes(delegations[dataOwnerId], collatedAesKeysFromDelegatorToHcpartyId, objectId);
             })
             : Promise.resolve([])).then((extractedKeys) => hcp.parentId
@@ -728,74 +876,90 @@ class IccCryptoXApi {
      */
     decryptKeyInDelegationLikes(
     //TODO: suggested name: getSecretIdsFromGenericDelegations
-    delegationsArray, aesKeys, masterId) {
-        const decryptPromises = [];
-        for (let i = 0; i < (delegationsArray || []).length; i++) {
-            var genericDelegationItem = delegationsArray[i];
-            const aesKey = aesKeys[genericDelegationItem.owner];
-            if (aesKey) {
-                decryptPromises.push(this._AES
-                    .decrypt(aesKey.key, binary_utils_1.hex2ua(genericDelegationItem.key), aesKey.rawKey)
-                    .then((decryptedGenericDelegationKey) => {
-                    const results = binary_utils_1.ua2string(decryptedGenericDelegationKey).split(':');
-                    const objectId = results[0]; //must be the ID of the object, for checksum
-                    const genericSecretId = results[1];
-                    const details = 'object ID: ' + masterId + '; generic delegation from ' + genericDelegationItem.owner + ' to ' + genericDelegationItem.delegatedTo;
-                    if (!objectId)
-                        console.warn('Object id is empty; ' + details);
-                    if (!genericSecretId)
-                        console.warn('Secret id is empty; ' + details);
-                    if (objectId !== masterId) {
-                        /*console.log(
-                          "Cryptographic mistake: object ID is not equal to the expected concatenated id within decrypted generic delegation. This may happen when patients have been merged; " +
-                            details
-                        )*/
-                    }
-                    return genericSecretId;
-                })
-                    .catch((err) => {
-                    console.log(`Could not decrypt generic delegation in object with ID: ${masterId} from ${genericDelegationItem.owner} to ${genericDelegationItem.delegatedTo}: ${err}`);
-                    return undefined;
-                }));
-            }
-            else {
-                console.log(`Could not find aes key for object with ID: ${masterId}`);
-            }
+    delegationsArray, aesKeysForDataOwnerId, masterId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const decryptPromises = delegationsArray.map((genericDelegationItem) => __awaiter(this, void 0, void 0, function* () {
+                const aesKeys = aesKeysForDataOwnerId[genericDelegationItem.owner];
+                if (aesKeys === null || aesKeys === void 0 ? void 0 : aesKeys.length) {
+                    return aesKeys.reduce((acc, aesKey) => __awaiter(this, void 0, void 0, function* () {
+                        const accValue = yield acc;
+                        if (accValue) {
+                            return accValue;
+                        }
+                        try {
+                            const decryptedGenericDelegationKey = yield this._AES.decrypt(aesKey.key, (0, binary_utils_1.hex2ua)(genericDelegationItem.key), aesKey.rawKey);
+                            const results = (0, binary_utils_1.ua2string)(decryptedGenericDelegationKey).split(':');
+                            const objectId = results[0]; //must be the ID of the object, for checksum
+                            const genericSecretId = results[1];
+                            const details = 'object ID: ' + masterId + '; generic delegation from ' + genericDelegationItem.owner + ' to ' + genericDelegationItem.delegatedTo;
+                            if (!objectId)
+                                console.warn('Object id is empty; ' + details);
+                            if (!genericSecretId)
+                                console.warn('Secret id is empty; ' + details);
+                            if (objectId !== masterId) {
+                                /*console.log(
+                                  "Cryptographic mistake: object ID is not equal to the expected concatenated id within decrypted generic delegation. This may happen when patients have been merged; " +
+                                    details
+                                )*/
+                            }
+                            return genericSecretId;
+                        }
+                        catch (err) {
+                            console.log(`Could not decrypt generic delegation in object with ID: ${masterId} from ${genericDelegationItem.owner} to ${genericDelegationItem.delegatedTo}: ${err}`);
+                            console.log(`AES key is: ${aesKey.rawKey}. Encrypted data is ${genericDelegationItem.key}.`);
+                            return undefined;
+                        }
+                    }), Promise.resolve());
+                }
+                else {
+                    console.log(`Could not find aes key for object with ID: ${masterId}`);
+                }
+            }));
+            return Promise.all(decryptPromises).then((genericSecretId) => genericSecretId.filter((id) => !!id));
+        });
+    }
+    getPublicKeyFromPrivateKey(privateKey, dataOwner) {
+        var _a;
+        if (!privateKey.n || !privateKey.e) {
+            throw new Error('No public key can be deduced from incomplete private key');
+        }
+        const publicKeyFromPrivateKey = (0, utils_1.jwk2spki)(privateKey);
+        const publicKeys = [dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x);
+        if (!publicKeys.length) {
+            throw new Error('No public key has been defined for hcp');
         }
-        return Promise.all(decryptPromises).then((genericSecretId) => genericSecretId.filter((id) => !!id));
+        const publicKey = publicKeys.find((it) => it === publicKeyFromPrivateKey);
+        if (!publicKey) {
+            throw new Error('No public key can be found for this private key');
+        }
+        return publicKey;
     }
     loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, privateKey) {
-        return this.getDataOwner(healthcarePartyId)
-            .then(({ dataOwner }) => dataOwner.publicKey)
-            .then((publicKey) => {
-            if (!publicKey) {
-                throw new Error('No public key has been defined for hcp');
-            }
-            return this._RSA.importKeyPair('jwk', this._utils.pkcs8ToJwk(privateKey), 'jwk', this._utils.spkiToJwk(binary_utils_1.hex2ua(publicKey)));
-        })
-            .then((keyPair) => {
-            this._RSA.rsaKeyPairs[healthcarePartyId] = keyPair;
-            return this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-        })
-            .then((exportedKeyPair) => {
-            return this._RSA.storeKeyPair(healthcarePartyId, exportedKeyPair);
+        return __awaiter(this, void 0, void 0, function* () {
+            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
+            const privateKeyInJwk = (0, utils_1.pkcs8ToJwk)(privateKey);
+            const publicKey = this.getPublicKeyFromPrivateKey(privateKeyInJwk, dataOwner);
+            const keyPair = yield this._RSA.importKeyPair('jwk', privateKeyInJwk, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
+            this.rsaKeyPairs[healthcarePartyId] = keyPair;
+            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
+            return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
         });
     }
-    // noinspection JSUnusedGlobalSymbols
-    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privKey) {
-        return this.getDataOwner(healthcarePartyId)
-            .then(({ dataOwner }) => {
-            const pubKey = this._utils.spkiToJwk(binary_utils_1.hex2ua(dataOwner.publicKey));
-            privKey.n = pubKey.n;
-            privKey.e = pubKey.e;
-            return this._RSA.importKeyPair('jwk', privKey, 'jwk', pubKey);
-        })
-            .then((keyPair) => {
-            this._RSA.rsaKeyPairs[healthcarePartyId] = keyPair;
-            return this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-        })
-            .then((exportedKeyPair) => {
-            return this._RSA.storeKeyPair(healthcarePartyId, exportedKeyPair);
+    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privateKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
+            if ((!privateKey.n || !privateKey.e) && dataOwner.publicKey) {
+                //Fallback on default publicKey
+                console.warn('An incomplete key has been completed using the default public key of the data owner');
+                const publicKeyInJwk = (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(dataOwner.publicKey));
+                privateKey.n = publicKeyInJwk.n;
+                privateKey.e = publicKeyInJwk.e;
+            }
+            const publicKey = this.getPublicKeyFromPrivateKey(privateKey, dataOwner);
+            const keyPair = yield this._RSA.importKeyPair('jwk', privateKey, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
+            this.rsaKeyPairs[healthcarePartyId] = keyPair;
+            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
+            return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
         });
     }
     // noinspection JSUnusedGlobalSymbols
@@ -807,14 +971,16 @@ class IccCryptoXApi {
             fr.onload = (e) => {
                 //TODO remove any
                 const privateKey = e.target.result;
-                this.loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, binary_utils_1.hex2ua(privateKey)).then(resolve).catch(reject);
+                this.loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, (0, binary_utils_1.hex2ua)(privateKey))
+                    .then(() => resolve())
+                    .catch(reject);
             };
             fr.readAsText(file);
         });
     }
     // noinspection JSUnusedGlobalSymbols
     saveKeychainInBrowserLocalStorage(id, keychain) {
-        localStorage.setItem(this.keychainLocalStoreIdPrefix + id, binary_utils_1.b2a(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), '')));
+        localStorage.setItem(this.keychainLocalStoreIdPrefix + id, (0, binary_utils_1.b2a)(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), '')));
     }
     saveKeychainInBrowserLocalStorageAsBase64(id, keyChainB64) {
         localStorage.setItem(this.keychainLocalStoreIdPrefix + id, keyChainB64);
@@ -854,13 +1020,13 @@ class IccCryptoXApi {
                 if (!!aesKey && !!crt) {
                     let crtEncrypted = null;
                     try {
-                        crtEncrypted = yield this.AES.encrypt(aesKey, new Uint8Array(binary_utils_1.string2ua(atob(crt))));
+                        crtEncrypted = yield this.AES.encrypt(aesKey, new Uint8Array((0, binary_utils_1.string2ua)(atob(crt))));
                     }
                     catch (e) {
                         console.error('Error while encrypting the certificate', e);
                     }
                     // add the encrypted certificate to the options
-                    _.set(opts, this.hcpPreferenceKeyEhealthCert, binary_utils_1.ua2string(new Uint8Array(crtEncrypted)));
+                    _.set(opts, this.hcpPreferenceKeyEhealthCert, (0, binary_utils_1.ua2string)(new Uint8Array(crtEncrypted)));
                 }
                 const crtValidityDate = this.getKeychainValidityDateInBrowserLocalStorage(hcp.id);
                 if (!!crtValidityDate) {
@@ -875,7 +1041,7 @@ class IccCryptoXApi {
         return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
             let crtCryp = null;
             if (!!hcp.options && !!hcp.options[this.hcpPreferenceKeyEhealthCert]) {
-                crtCryp = binary_utils_1.string2ua(hcp.options[this.hcpPreferenceKeyEhealthCert]);
+                crtCryp = (0, binary_utils_1.string2ua)(hcp.options[this.hcpPreferenceKeyEhealthCert]);
             }
             const crtValidityDate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCertDate);
             // store the validity date
@@ -941,50 +1107,310 @@ class IccCryptoXApi {
     // noinspection JSUnusedGlobalSymbols
     loadKeychainFromBrowserLocalStorage(id) {
         const lsItem = localStorage.getItem('org.taktik.icure.ehealth.keychain.' + id);
-        return lsItem !== null ? binary_utils_1.b64_2uas(lsItem) : null;
+        return lsItem !== null ? (0, binary_utils_1.b64_2uas)(lsItem) : null;
+    }
+    /**
+     *
+     * @param id
+     * @param keyPair should be JWK
+     */
+    storeKeyPair(id, keyPair) {
+        if (typeof Storage === 'undefined') {
+            console.log('Your browser does not support HTML5 Browser Local Storage !');
+            throw 'Your browser does not support HTML5 Browser Local Storage !';
+        }
+        //TODO encryption
+        localStorage.setItem(this.rsaLocalStoreIdPrefix + id, JSON.stringify(keyPair));
+    }
+    /**
+     * loads the RSA key pair (hcparty) in JWK from local storage, not imported
+     *
+     * @param id  doc id - hcpartyId
+     * @param publicKeyFingerPrint the 32 last characters of public key this private key is associated with
+     * @returns {Object} it is in JWK - not imported
+     */
+    loadKeyPairNotImported(id, publicKeyFingerPrint) {
+        var _a;
+        if (typeof Storage === 'undefined') {
+            console.log('Your browser does not support HTML5 Browser Local Storage !');
+            throw 'Your browser does not support HTML5 Browser Local Storage !';
+        }
+        //TODO decryption
+        const item = (_a = (publicKeyFingerPrint && localStorage.getItem(this.rsaLocalStoreIdPrefix + id + '.' + publicKeyFingerPrint))) !== null && _a !== void 0 ? _a : localStorage.getItem(this.rsaLocalStoreIdPrefix + id);
+        if (!item) {
+            console.warn(`No key can be found in local storage for id ${id} and publicKeyFingerPrint ${publicKeyFingerPrint}`);
+        }
+        return JSON.parse(item);
+    }
+    /**
+     * Loads and imports the RSA key pair (hcparty) from local storage
+     *
+     * @param id  doc id - hcPartyId
+     * @returns {Promise} -> {CryptoKey} - imported RSA
+     */
+    loadKeyPairImported(id) {
+        return new Promise((resolve, reject) => {
+            try {
+                const jwkKey = localStorage.getItem(this.rsaLocalStoreIdPrefix + id);
+                if (jwkKey) {
+                    const jwkKeyPair = JSON.parse(jwkKey);
+                    if (jwkKeyPair.publicKey && jwkKeyPair.privateKey) {
+                        this._RSA.importKeyPair('jwk', jwkKeyPair.privateKey, 'jwk', jwkKeyPair.publicKey).then(resolve, (err) => {
+                            console.log('Error in RSA.importKeyPair: ' + err);
+                            reject(err);
+                        });
+                    }
+                    else {
+                        const message = 'Error in RSA.importKeyPair: Invalid key';
+                        console.log(message);
+                        reject(Error(message));
+                    }
+                }
+                else {
+                    const message = 'Error in RSA.importKeyPair: Missing key';
+                    console.log(message);
+                    reject(Error(message));
+                }
+            }
+            catch (err) {
+                reject(err);
+            }
+        });
+    }
+    addNewKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, generateTransferKey = true) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.addNewKeyPairForOwner(maintenanceTasksApi, user, yield this.getDataOwner(ownerId), generateTransferKey);
+        });
+    }
+    addNewKeyPairForOwner(maintenanceTasksApi, user, cdo, generateTransferKey = true) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { publicKey, privateKey } = yield this.RSA.generateKeyPair();
+            const publicKeyHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(publicKey, 'spki'));
+            const gen = (yield this._AES.generateCryptoKey(true));
+            yield this.cacheKeyPair({ publicKey: yield this.RSA.exportKey(publicKey, 'jwk'), privateKey: yield this.RSA.exportKey(privateKey, 'jwk') });
+            const { type: ownerType, dataOwner: ownerToUpdate } = yield this.createOrUpdateAesExchangeKeysFor(cdo, gen, {
+                pubKey: publicKey,
+                privKey: privateKey,
+            }).then((dataOwnerWithUpdatedAesKeys) => generateTransferKey
+                ? this.createOrUpdateTransferKeysFor(dataOwnerWithUpdatedAesKeys, gen, { pubKey: publicKey, privKey: privateKey })
+                : dataOwnerWithUpdatedAesKeys);
+            const modifiedDataOwnerAndType = ownerType === 'hcp'
+                ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.hcpartyBaseApi
+                    .modifyHealthcareParty(ownerToUpdate)
+                    .then((x) => ({ type: 'hcp', dataOwner: x })))
+                : ownerType === 'patient'
+                    ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.patientBaseApi
+                        .modifyPatient(ownerToUpdate)
+                        .then((x) => ({ type: 'patient', dataOwner: x })))
+                    : yield (this.dataOwnerCache[ownerToUpdate.id] = this.deviceBaseApi
+                        .updateDevice(ownerToUpdate)
+                        .then((x) => ({ type: 'device', dataOwner: x })));
+            const sentMaintenanceTasks = yield this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, publicKey);
+            return {
+                dataOwner: sentMaintenanceTasks.length
+                    ? yield this.retrieveDataOwnerInfoAfterPotentialUpdate(modifiedDataOwnerAndType.dataOwner)
+                    : modifiedDataOwnerAndType.dataOwner,
+                publicKey: publicKeyHex,
+                privateKey: (0, binary_utils_1.ua2hex)((yield this.RSA.exportKey(privateKey, 'pkcs8'))),
+            };
+        });
+    }
+    createOrUpdateAesExchangeKeysFor(cdo, decryptedAesExchangeKey, keyToEncrypt) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const publicKeyHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keyToEncrypt.pubKey, 'spki'));
+            const existingAesExchangeKeys = (_a = cdo.dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {};
+            existingAesExchangeKeys[publicKeyHex] = yield this.encryptAesKeyFor(decryptedAesExchangeKey, cdo.dataOwner, keyToEncrypt.pubKey);
+            return { type: cdo.type, dataOwner: Object.assign(Object.assign({}, cdo.dataOwner), { aesExchangeKeys: existingAesExchangeKeys }) };
+        });
+    }
+    createOrUpdateTransferKeysFor(dataOwner, decryptedAesExchangeKey, keyToEncrypt) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const pubKeyToEncryptHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keyToEncrypt.pubKey, 'spki'));
+            const encryptedKey = (0, binary_utils_1.ua2hex)(yield this._AES.encrypt(yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(decryptedAesExchangeKey)), (yield this.RSA.exportKey(keyToEncrypt.privKey, 'pkcs8')), decryptedAesExchangeKey));
+            const dataOwnerExistingPubKeys = Array.from(yield this.getDataOwnerHexPublicKeys(dataOwner.dataOwner));
+            const transferKeys = (0, utils_1.fold)(dataOwnerExistingPubKeys, (_a = dataOwner.dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {}, (pubAcc, pubKeyHex) => {
+                var _a;
+                if (pubKeyHex !== pubKeyToEncryptHex) {
+                    const existingKeys = (_a = pubAcc[pubKeyHex]) !== null && _a !== void 0 ? _a : {};
+                    existingKeys[pubKeyToEncryptHex] = encryptedKey;
+                    pubAcc[pubKeyHex] = existingKeys;
+                }
+                return pubAcc;
+            });
+            return { type: dataOwner.type, dataOwner: Object.assign(Object.assign({}, dataOwner.dataOwner), { transferKeys: transferKeys }) };
+        });
+    }
+    encryptAesKeyFor(aesKey, dataOwner, doNewPublicKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dataOwnerAllPubKeys = [doNewPublicKey].concat(yield this.getDataOwnerPublicKeys(dataOwner));
+            const encrAes = {};
+            for (const pubKey of dataOwnerAllPubKeys) {
+                encrAes[(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(pubKey, (0, binary_utils_1.hex2ua)(aesKey)));
+            }
+            return { [dataOwner.id]: encrAes };
+        });
+    }
+    retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {
+        return this.getDataOwner(dataOwnerToUpdate.id).then(({ type, dataOwner }) => {
+            var _a, _b, _c, _d;
+            return {
+                type: type,
+                dataOwner: Object.assign(Object.assign({}, dataOwner), { transferKeys: dataOwnerToUpdate.transferKeys, hcPartyKeys: (0, utils_1.fold)(Object.entries((_a = dataOwnerToUpdate.hcPartyKeys) !== null && _a !== void 0 ? _a : {}), (_b = dataOwner.hcPartyKeys) !== null && _b !== void 0 ? _b : {}, (acc, [delegateId, hcKeys]) => {
+                        acc[delegateId] = hcKeys;
+                        return acc;
+                    }), aesExchangeKeys: (0, utils_1.fold)(Object.entries((_c = dataOwnerToUpdate.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => {
+                        var _a;
+                        const existingKeys = (_a = pubAcc[pubKey]) !== null && _a !== void 0 ? _a : {};
+                        pubAcc[pubKey] = (0, utils_1.fold)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => {
+                            delAcc[delId] = delKeys;
+                            return delAcc;
+                        });
+                        return pubAcc;
+                    }) }),
+            };
+        });
+    }
+    sendMaintenanceTasks(maintenanceTaskApi, user, dataOwner, newPublicKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const hexNewPubKey = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(newPublicKey, 'spki'));
+            const nonAccessiblePubKeys = Array.from(this.getDataOwnerHexPublicKeys(dataOwner).values())
+                .filter((existingPubKey) => existingPubKey != hexNewPubKey)
+                .filter((existingPubKey) => !Object.values(this.rsaKeyPairs).find(({ publicKey, privateKey }) => __awaiter(this, void 0, void 0, function* () { return (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(publicKey, 'spki')) == existingPubKey; })));
+            if (nonAccessiblePubKeys.length) {
+                const tasksForDelegates = Object.entries(yield this.getEncryptedAesExchangeKeysForDelegate(dataOwner.id))
+                    .filter(([delegatorId]) => delegatorId != dataOwner.id)
+                    .flatMap(([delegatorId, delegatorKeys]) => {
+                    return Object.entries(delegatorKeys).flatMap(([, aesExchangeKeys]) => {
+                        return Object.keys(aesExchangeKeys).map((delegatePubKey) => {
+                            return { delegateId: delegatorId, maintenanceTask: this.createMaintenanceTask(dataOwner, delegatePubKey) };
+                        });
+                    });
+                });
+                const tasksForDelegator = Object.entries(yield this.getEncryptedAesExchangeKeys(dataOwner, dataOwner.id)).flatMap(([doPubKey, delegateKeys]) => {
+                    return Object.keys(delegateKeys)
+                        .filter((delegateId) => delegateId != dataOwner.id)
+                        .map((delegateId) => {
+                        return { delegateId: delegateId, maintenanceTask: this.createMaintenanceTask(dataOwner, doPubKey) };
+                    });
+                });
+                return Promise.all(tasksForDelegates
+                    .concat(tasksForDelegator)
+                    .map(({ delegateId, maintenanceTask }) => __awaiter(this, void 0, void 0, function* () {
+                    const taskToCreate = yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.newInstance(user, maintenanceTask, delegateId));
+                    return taskToCreate ? maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.createMaintenanceTaskWithUser(user, taskToCreate) : undefined;
+                }))
+                    .filter((createdTask) => createdTask != undefined));
+            }
+            else {
+                return [];
+            }
+        });
+    }
+    createMaintenanceTask(concernedDataOwner, concernedPubKey) {
+        return new models_1.MaintenanceTask({
+            id: this.randomUuid(),
+            taskType: 'updateAesExchangeKey',
+            status: models_1.MaintenanceTask.StatusEnum.Pending,
+            properties: [
+                new models_1.PropertyStub({
+                    id: 'dataOwnerConcernedId',
+                    type: new models_1.PropertyTypeStub({ type: models_1.PropertyTypeStub.TypeEnum.STRING }),
+                    typedValue: new models_1.TypedValueObject({
+                        type: models_1.TypedValueObject.TypeEnum.STRING,
+                        stringValue: concernedDataOwner.id,
+                    }),
+                }),
+                new models_1.PropertyStub({
+                    id: 'dataOwnerConcernedPubKey',
+                    type: new models_1.PropertyTypeStub({ type: models_1.PropertyTypeStub.TypeEnum.STRING }),
+                    typedValue: new models_1.TypedValueObject({
+                        type: models_1.TypedValueObject.TypeEnum.STRING,
+                        stringValue: concernedPubKey,
+                    }),
+                }),
+            ],
+        });
+    }
+    getDataOwnerHexPublicKeys(dataOwner) {
+        return new Set((dataOwner.publicKey ? [dataOwner.publicKey] : [])
+            .concat(dataOwner.aesExchangeKeys ? Object.keys(dataOwner.aesExchangeKeys) : [])
+            .filter((pubKey) => !!pubKey));
+    }
+    getDataOwnerPublicKeys(dataOwner) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield Promise.all(Array.from(this.getDataOwnerHexPublicKeys(dataOwner)).map((pubKey) => __awaiter(this, void 0, void 0, function* () { return yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(pubKey)), ['encrypt']); })));
+        });
     }
     generateKeyForDelegate(ownerId, delegateId) {
         //Preload hcp and patient because we need them and they are going to be invalidated from the caches
-        return this._utils.notConcurrent(this.generateKeyConcurrencyMap, ownerId, () => Promise.all([this.getDataOwner(ownerId), this.getDataOwner(delegateId)]).then(([{ type: ownerType, dataOwner: owner }, { dataOwner: delegate }]) => {
-            if ((owner.hcPartyKeys || {})[delegateId]) {
+        return (0, utils_1.notConcurrent)(this.generateKeyConcurrencyMap, ownerId, () => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e;
+            const [{ type: ownerType, dataOwner: owner }, { dataOwner: delegate }] = yield Promise.all([
+                this.getDataOwner(ownerId),
+                this.getDataOwner(delegateId),
+            ]);
+            const ownerLegacyPublicKey = owner.publicKey;
+            const availablePublicKeysFingerprints = Object.keys(this.rsaKeyPairs);
+            const availableOwnerPublicKeys = [
+                ownerLegacyPublicKey,
+                ...Object.keys(owner.aesExchangeKeys || {}).filter((x) => x !== ownerLegacyPublicKey),
+            ].filter((k) => !!k && availablePublicKeysFingerprints.some((fp) => k.endsWith(fp)));
+            const selectedPublicKey = availableOwnerPublicKeys[0];
+            if (!selectedPublicKey) {
+                throw new Error(`Invalid owner, no public key, keypairs have not be set for ${ownerId}`);
+            }
+            if ((owner.hcPartyKeys || {})[delegateId] ||
+                Object.values(owner.aesExchangeKeys || {}).some((x) => x[delegateId] && Object.keys(x[delegateId]).some((k) => availablePublicKeysFingerprints.includes(k)))) {
                 return owner;
             }
-            const genProm = new Promise((resolve, reject) => {
-                delegate.publicKey
-                    ? this._AES
-                        .generateCryptoKey(true)
-                        .then((AESKey) => {
-                        const ownerPubKey = this._utils.spkiToJwk(binary_utils_1.hex2ua(owner.publicKey));
-                        const delegatePubKey = this._utils.spkiToJwk(binary_utils_1.hex2ua(delegate.publicKey));
-                        return Promise.all([
-                            this._RSA.importKey('jwk', ownerPubKey, ['encrypt']),
-                            this._RSA.importKey('jwk', delegatePubKey, ['encrypt']),
-                        ]).then(([ownerImportedKey, delegateImportedKey]) => Promise.all([
-                            this._RSA.encrypt(ownerImportedKey, binary_utils_1.hex2ua(AESKey)),
-                            this._RSA.encrypt(delegateImportedKey, binary_utils_1.hex2ua(AESKey)),
-                        ]));
-                    })
-                        .then(([ownerKey, delegateKey]) => (owner.hcPartyKeys[delegateId] = [binary_utils_1.ua2hex(ownerKey), binary_utils_1.ua2hex(delegateKey)]))
-                        .then(() => {
-                        return ownerType === 'hcp'
-                            ? (this.dataOwnerCache[owner.id] = this.hcpartyBaseApi
-                                .modifyHealthcareParty(owner)
-                                .then((x) => ({ type: 'hcp', dataOwner: x }))).then((x) => resolve(['hcp', x.dataOwner]))
-                            : ownerType === 'patient'
-                                ? (this.dataOwnerCache[owner.id] = this.patientBaseApi
-                                    .modifyPatient(owner)
-                                    .then((x) => ({ type: 'patient', dataOwner: x }))).then((x) => resolve(['patient', x.dataOwner]))
-                                : (this.dataOwnerCache[owner.id] = this.deviceBaseApi
-                                    .updateDevice(owner)
-                                    .then((x) => ({ type: 'device', dataOwner: x }))).then((x) => resolve(['device', x.dataOwner]));
-                    })
-                        .catch((e) => reject(e))
-                    : reject(new Error(`Missing public key for delegate ${delegateId}`));
-            });
-            // invalidate the hcPartyKeys cache for the delegate hcp (who was not modified, but the view for its
-            // id was updated)
+            let ownerCombinedAesExchangeKeys = (_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {};
+            if (ownerLegacyPublicKey && !((_b = owner.aesExchangeKeys) !== null && _b !== void 0 ? _b : {})[ownerLegacyPublicKey]) {
+                //Transfer keys from old structure (hcparty keys) to new one (aesExchangeKeys)
+                const unknownDataOwnerCounterPartIds = Object.keys((_c = owner.hcPartyKeys) !== null && _c !== void 0 ? _c : {}).filter((x) => x !== ownerId && x !== delegateId);
+                const counterParts = [
+                    owner,
+                    delegate,
+                    ...(yield Promise.all(unknownDataOwnerCounterPartIds.map((cpid) => this.getDataOwner(cpid).then((dot) => dot.dataOwner)))),
+                ];
+                ownerCombinedAesExchangeKeys = Object.assign({ [ownerLegacyPublicKey]: Object.entries((_d = owner.hcPartyKeys) !== null && _d !== void 0 ? _d : {}).reduce((map, [hcpId, keys]) => {
+                        var _a, _b;
+                        return (Object.assign(Object.assign(Object.assign({}, map), { [hcpId]: { [ownerLegacyPublicKey]: keys[0], [(_b = (_a = counterParts.find((x) => x.id === hcpId)) === null || _a === void 0 ? void 0 : _a.publicKey) !== null && _b !== void 0 ? _b : '']: keys[1] } }), {}));
+                    }, {}) }, ownerCombinedAesExchangeKeys);
+            }
+            const delegatePublicKeys = [delegate.publicKey, ...Object.keys((_e = delegate.aesExchangeKeys) !== null && _e !== void 0 ? _e : {}).filter((x) => x !== delegate.publicKey)].filter((x) => !!x);
+            if (!delegatePublicKeys.length) {
+                throw new Error(`Invalid delegate, no public key, keypairs have not be set for ${delegateId}`);
+            }
+            const genProm = this._AES.generateCryptoKey(true).then((AESKey) => __awaiter(this, void 0, void 0, function* () {
+                var _f, _g;
+                const allPubKeys = [...availableOwnerPublicKeys, ...delegatePublicKeys];
+                const encryptedAesKeys = yield allPubKeys.reduce((map, pubK) => __awaiter(this, void 0, void 0, function* () {
+                    return (Object.assign(Object.assign({}, (yield map)), { [pubK.slice(-32)]: (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(pubK)), ['encrypt']), (0, binary_utils_1.hex2ua)(AESKey))) }));
+                }), Promise.resolve({}));
+                if (delegate.publicKey && ownerLegacyPublicKey) {
+                    owner.hcPartyKeys[delegateId] = [encryptedAesKeys[ownerLegacyPublicKey.slice(-32)], encryptedAesKeys[delegate.publicKey.slice(-32)]];
+                }
+                owner.aesExchangeKeys = Object.assign(Object.assign({}, (ownerCombinedAesExchangeKeys !== null && ownerCombinedAesExchangeKeys !== void 0 ? ownerCombinedAesExchangeKeys : {})), { [selectedPublicKey]: Object.assign(Object.assign({}, ((_g = (_f = owner.aesExchangeKeys) === null || _f === void 0 ? void 0 : _f[selectedPublicKey]) !== null && _g !== void 0 ? _g : {})), { [delegateId]: encryptedAesKeys }) });
+                return new Promise((resolve, reject) => {
+                    ownerType === 'hcp'
+                        ? (this.dataOwnerCache[owner.id] = this.hcpartyBaseApi
+                            .modifyHealthcareParty(owner)
+                            .then((x) => ({ type: 'hcp', dataOwner: x })))
+                            .then((x) => resolve(['hcp', x.dataOwner]))
+                            .catch((e) => reject(e))
+                        : ownerType === 'patient'
+                            ? (this.dataOwnerCache[owner.id] = this.patientBaseApi.modifyPatient(owner).then((x) => ({ type: 'patient', dataOwner: x })))
+                                .then((x) => resolve(['patient', x.dataOwner]))
+                                .catch((e) => reject(e))
+                            : (this.dataOwnerCache[owner.id] = this.deviceBaseApi.updateDevice(owner).then((x) => ({ type: 'device', dataOwner: x })))
+                                .then((x) => resolve(['device', x.dataOwner]))
+                                .catch((e) => reject(e));
+                });
+            }));
             this.hcPartyKeysRequestsCache[delegateId] = genProm.then(() => {
-                return this.forceGetHcPartyKeysForDelegate(delegateId);
+                return this.forceGetEncryptedAesExchangeKeysForDelegate(delegateId);
             });
             return genProm.then((res) => {
                 return res[1];
@@ -1005,22 +1431,28 @@ class IccCryptoXApi {
     }
     // noinspection JSUnusedGlobalSymbols
     checkPrivateKeyValidity(dataOwner) {
-        return new Promise((resolve) => {
-            this._RSA
-                .importKey('jwk', this._utils.spkiToJwk(binary_utils_1.hex2ua(dataOwner.publicKey)), ['encrypt'])
-                .then((k) => this._RSA.encrypt(k, binary_utils_1.utf8_2ua('shibboleth')))
-                .then((cipher) => {
-                const kp = this._RSA.loadKeyPairNotImported(dataOwner.id);
-                return this._RSA
-                    .importKeyPair('jwk', kp.privateKey, 'jwk', kp.publicKey)
-                    .then((ikp) => this._RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)));
-            })
-                .then((plainText) => {
-                const pt = binary_utils_1.ua2utf8(plainText);
-                console.log(pt);
-                resolve(pt === 'shibboleth');
-            })
-                .catch(() => resolve(false));
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const publicKeys = Array.from(new Set([dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x)));
+            return yield publicKeys.reduce((pres, publicKey) => __awaiter(this, void 0, void 0, function* () {
+                const res = yield pres;
+                if (res) {
+                    return true;
+                }
+                try {
+                    const k = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)), ['encrypt']);
+                    const cipher = yield this._RSA.encrypt(k, (0, binary_utils_1.utf8_2ua)('shibboleth'));
+                    const kp = this.loadKeyPairNotImported(dataOwner.id, publicKey.slice(-32));
+                    const plainText = yield this._RSA
+                        .importKeyPair('jwk', kp.privateKey, 'jwk', kp.publicKey)
+                        .then((ikp) => this._RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)))
+                        .then((x) => (0, binary_utils_1.ua2utf8)(x));
+                    return plainText === 'shibboleth';
+                }
+                catch (e) {
+                    return false;
+                }
+            }), Promise.resolve(false));
         });
     }
     throwDetailedExceptionForInvalidParameter(argName, argValue, methodName, methodArgs) {
@@ -1039,18 +1471,23 @@ class IccCryptoXApi {
         throw '### THIS SHOULD NOT HAPPEN: ' + argName + ' has an invalid value: ' + argValue + details;
     }
     getEncryptionDecryptionKeys(dataOwnerId, document) {
-        return !document.id
-            ? Promise.resolve(null)
-            : this.extractKeysFromDelegationsForHcpHierarchy(dataOwnerId, document.id, (document.encryptionKeys && Object.keys(document.encryptionKeys).length && document.encryptionKeys) || document.delegations)
-                .then(({ extractedKeys }) => _.uniq(extractedKeys))
-                .catch(() => null);
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return !document.id
+                    ? undefined
+                    : _.uniq((yield this.extractKeysFromDelegationsForHcpHierarchy(dataOwnerId, document.id, (document.encryptionKeys && Object.keys(document.encryptionKeys).length && document.encryptionKeys) || document.delegations)).extractedKeys);
+            }
+            catch (e) {
+                return undefined;
+            }
+        });
     }
     encryptDecrypt(method, content, edKey, user, documentObject) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!content || !(edKey || ((user === null || user === void 0 ? void 0 : user.healthcarePartyId) && documentObject)))
                 return content;
             if (edKey) {
-                const importedEdKey = yield this._AES.importKey('raw', binary_utils_1.hex2ua(edKey.replace(/-/g, '')));
+                const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(edKey.replace(/-/g, '')));
                 try {
                     return this._AES[method](importedEdKey, content);
                 }
@@ -1059,7 +1496,7 @@ class IccCryptoXApi {
                 }
             }
             const sfks = yield this.extractKeysFromDelegationsForHcpHierarchy(user === null || user === void 0 ? void 0 : user.healthcarePartyId, documentObject === null || documentObject === void 0 ? void 0 : documentObject.id, documentObject === null || documentObject === void 0 ? void 0 : documentObject.encryptionKeys);
-            const importedEdKey = yield this._AES.importKey('raw', binary_utils_1.hex2ua(sfks.extractedKeys[0].replace(/-/g, '')));
+            const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(sfks.extractedKeys[0].replace(/-/g, '')));
             try {
                 return this._AES[method](importedEdKey, content);
             }