@icure/api 4.2.35 → 4.2.36

package/icc-x-api/icc-crypto-x-api.js

@@ -0,0 +1,1075 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IccCryptoXApi = void 0;
+const AES_1 = require("./crypto/AES");
+const RSA_1 = require("./crypto/RSA");
+const utils_1 = require("./crypto/utils");
+const shamir_1 = require("./crypto/shamir");
+const _ = require("lodash");
+const binary_utils_1 = require("./utils/binary-utils");
+class IccCryptoXApi {
+    constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
+    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}) {
+        this.hcPartyKeysCache = {};
+        //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
+        //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
+        this.hcPartyKeysRequestsCache = {};
+        this.cacheLastDeletionTimestamp = undefined;
+        this.dataOwnerCache = {};
+        this.keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.';
+        this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
+        this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
+        this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
+        this.hcpartyBaseApi = hcpartyBaseApi;
+        this.patientBaseApi = patientBaseApi;
+        this.deviceBaseApi = deviceBaseApi;
+        this._crypto = crypto;
+        this.generateKeyConcurrencyMap = {};
+        this._AES = new AES_1.AESUtils(crypto);
+        this._RSA = new RSA_1.RSAUtils(crypto);
+        this._utils = new utils_1.UtilsClass();
+        this._shamir = new shamir_1.ShamirClass(crypto);
+    }
+    get crypto() {
+        return this._crypto;
+    }
+    get shamir() {
+        return this._shamir;
+    }
+    get utils() {
+        return this._utils;
+    }
+    get RSA() {
+        return this._RSA;
+    }
+    get AES() {
+        return this._AES;
+    }
+    emptyHcpCache(hcpartyId) {
+        delete this.hcPartyKeysRequestsCache[hcpartyId];
+        delete this.dataOwnerCache[hcpartyId];
+        delete this.dataOwnerCache[hcpartyId];
+    }
+    /**
+     * Gets all delegate encrypted HcParty keys of the delegate with the given `delegateHcPartyId`, and for each key the delegator id
+     * If the keys are not cached, they are retrieved from the backend.
+     *
+     * @param delegateHcPartyId The Health Care Party id
+     * @returns  \{delegatorId: delegateEncryptedHcPartyKey\}
+     */
+    getHcPartyKeysForDelegate(
+    //TODO: suggested name: getAllEncryptedHcPKeysOfDelegate
+    delegateHcPartyId) {
+        return (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
+            (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.forceGetHcPartyKeysForDelegate(delegateHcPartyId)));
+    }
+    forceGetHcPartyKeysForDelegate(delegateHcPartyId) {
+        return Promise.all([
+            this.patientBaseApi.getPatientHcPartyKeysForDelegate(delegateHcPartyId).catch(() => { }),
+            this.hcpartyBaseApi.getHcPartyKeysForDelegate(delegateHcPartyId).catch(() => { }),
+        ]).then(([a, b]) => Object.assign({}, a, b));
+    }
+    randomUuid() {
+        return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(/[018]/g, (c) => (Number(c) ^ (this._crypto.getRandomValues(new Uint8Array(1))[0] & (15 >> (Number(c) / 4)))).toString(16) //Keep that inlined or you will loose the random
+        );
+    }
+    sha256(data) {
+        return this._crypto.subtle.digest('SHA-256', data);
+    }
+    encryptedShamirRSAKey(hcp, notaries, threshold) {
+        return this._RSA.loadKeyPairImported(hcp.id).then((keyPair) => this._RSA.exportKey(keyPair.privateKey, 'pkcs8').then((exportedKey) => {
+            const privateKey = exportedKey;
+            const nLen = notaries.length;
+            const shares = nLen == 1 ? [privateKey] : this._shamir.share((0, binary_utils_1.ua2hex)(privateKey), nLen, threshold || nLen).map((share) => (0, binary_utils_1.hex2ua)(share));
+            return _.reduce(notaries, (queue, notary, idx) => {
+                return queue.then((hcp) => __awaiter(this, void 0, void 0, function* () {
+                    const hcParty = hcp.hcPartyKeys[notary.id] ? hcp : (yield this.generateKeyForDelegate(hcp.id, notary.id));
+                    try {
+                        const importedAESHcPartyKey = yield this.decryptHcPartyKey(hcParty.id, notary.id, hcParty.hcPartyKeys[notary.id][1], false);
+                        const encryptedShamirPartition = yield this.AES.encrypt(importedAESHcPartyKey.key, shares[idx]);
+                        hcParty.privateKeyShamirPartitions = hcParty.privateKeyShamirPartitions || {};
+                        hcParty.privateKeyShamirPartitions[notary.id] = (0, binary_utils_1.ua2hex)(encryptedShamirPartition);
+                    }
+                    catch (e) {
+                        console.log('Error during encryptedShamirRSAKey', notary.id, e);
+                    }
+                    return hcParty;
+                }));
+            }, Promise.resolve(hcp));
+        }));
+    }
+    /* Reconstructs the hcp's private key from the notaries' shamir shares and stores it in localstorage.
+    The retrieval procedure of the shares is not designed or implemented yet.  Therefore, it currently only
+    works if the private key of the notaries are stored in local storage (e.g. notaries = [hcp parent]).
+     * @param hcp : the hcp whose key we want to reconstruct
+     * @param notaries : holders of the shamir shares
+    **/
+    decryptedShamirRSAKey(hcp, notaries) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const nLen = notaries.length;
+                let decryptedPrivatedKey;
+                if (nLen == 1) {
+                    const importedAESHcPartyKey = yield this.decryptHcPartyKey(hcp.id, notaries[0].id, hcp.hcPartyKeys[notaries[0].id][1], false);
+                    const cryptedPrivatedKey = hcp.privateKeyShamirPartitions[notaries[0].id];
+                    decryptedPrivatedKey = (0, binary_utils_1.ua2hex)(yield this.AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(cryptedPrivatedKey)));
+                }
+                else {
+                    const decryptedShares = yield _.reduce(notaries, (queue, notary) => {
+                        return queue.then((shares) => __awaiter(this, void 0, void 0, function* () {
+                            try {
+                                // TODO: now, we get the encrypted shares in db and decrypt them. This assumes that the
+                                // the notaries' private keys are in localstorage. We should implement a way for the notaries to
+                                // give hcp the decrypted shares without having to also share their private keys.
+                                const importedAESHcPartyKey = yield this.decryptHcPartyKey(hcp.id, notary.id, hcp.hcPartyKeys[notary.id][1], false);
+                                const encryptedShare = hcp.privateKeyShamirPartitions[notary.id];
+                                const decryptedShamirPartition = (0, binary_utils_1.ua2hex)(yield this.AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(encryptedShare)));
+                                shares.push(decryptedShamirPartition);
+                            }
+                            catch (e) {
+                                console.log('Error during encryptedShamirRSAKey', notary.id, e);
+                            }
+                            return shares;
+                        }));
+                    }, Promise.resolve([]));
+                    decryptedPrivatedKey = this._shamir.combine(decryptedShares);
+                }
+                const importedPrivateKey = yield this.RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(decryptedPrivatedKey), ['decrypt']);
+                const importedPublicKey = yield this.RSA.importKey('spki', (0, binary_utils_1.hex2ua)(hcp.publicKey), ['encrypt']);
+                const exportedKeyPair = yield this.RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk');
+                this.RSA.storeKeyPair(hcp.id, exportedKeyPair);
+            }
+            catch (e) {
+                console.log('Cannot decrypt shamir RSA key');
+            }
+        });
+    }
+    /**
+     * Gets the decryptedHcPartyKey for the given `encryptedHcPartyKey`
+     *
+     * If the decrypted key exists in the cache, retrieves it from there.
+     * Otherwise, decrypts it using the RSA key of the delegator or delegate (depending on the value of `encryptedForDelegator`)
+     * @param delegatorId : the id of the delegator HcP
+     * @param delegateHcPartyId : the id of the delegate HcP
+     * @param encryptedHcPartyKey : can be delegatorEncryptedHcPartyKey or delegateEncryptedHcPartyKey (depending on the value of `encryptedForDelegator`)
+     * @param encryptedForDelegator : default false - for the `encryptedHcPartyKey` RSA encrypted for delegate; true for the `encryptedHcPartyKey` RSA encrypted for delegator;
+     * @returns - **delegatorId** the input param  `delegatorId`
+     * - **key** the decrypted `encryptedHcPartyKey`
+     */
+    decryptHcPartyKey(delegatorId, delegateHcPartyId, encryptedHcPartyKey, encryptedForDelegator = false //TODO: suggestion: break this into 2 separate methods: decryptDelegatorEncryptedHcPartyKey() and decryptDelegateEncryptedHcPartyKey()
+    ) {
+        const cacheKey = delegatorId + '|' + delegateHcPartyId + '|' + (encryptedForDelegator ? '->' : '<-');
+        const res = this.hcPartyKeysCache[cacheKey];
+        const hcPartyKeyOwner = encryptedForDelegator ? delegatorId : delegateHcPartyId;
+        if (res) {
+            return Promise.resolve(res);
+        }
+        else {
+            const keyPair = this._RSA.rsaKeyPairs[hcPartyKeyOwner];
+            return (keyPair
+                ? Promise.resolve(keyPair)
+                : Promise.resolve(this._RSA.loadKeyPairNotImported(hcPartyKeyOwner)).then((keyPairInJwk) => this.cacheKeyPair(keyPairInJwk, hcPartyKeyOwner)))
+                .then((keyPair) => this._RSA.decrypt(keyPair.privateKey, (0, binary_utils_1.hex2ua)(encryptedHcPartyKey)))
+                .catch((e) => {
+                console.log(`Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId} as ${encryptedForDelegator ? 'delegator' : 'delegate'}`);
+                throw e;
+            })
+                .then((decryptedHcPartyKey) => this._AES.importKey('raw', decryptedHcPartyKey).then((decryptedImportedHcPartyKey) => ({
+                decryptedHcPartyKey,
+                decryptedImportedHcPartyKey,
+            })))
+                .then(({ decryptedHcPartyKey, decryptedImportedHcPartyKey }) => (this.hcPartyKeysCache[cacheKey] = {
+                delegatorId: delegatorId,
+                key: decryptedImportedHcPartyKey,
+                rawKey: (0, binary_utils_1.ua2hex)(new Uint8Array(decryptedHcPartyKey)),
+            }));
+        }
+    }
+    /**
+     * Cache the RSA private/public key pair for the HcP with the given id `hcPartyKeyOwner`
+     */
+    cacheKeyPair(keyPairInJwk, hcPartyKeyOwner) {
+        if (!keyPairInJwk) {
+            throw 'No RSA private key for Healthcare party(' + hcPartyKeyOwner + ').';
+        }
+        return this._RSA.importKeyPair('jwk', keyPairInJwk.privateKey, 'jwk', keyPairInJwk.publicKey).then((importedKeyPair) => {
+            return (this._RSA.rsaKeyPairs[hcPartyKeyOwner] = importedKeyPair);
+        });
+    }
+    /**
+     * Gets the secret ID (SFKs) that should be used in the prescribed context (condfidential or not) from decrypted SPKs of the given `parent`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
+     * @param parent : the object of which delegations (SPKs) to decrypt
+     * @param hcpartyId : the id of the delegate HcP
+     * @param confidential : wether the key is going to be used for a confidential piece or data or not
+     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
+     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    extractPreferredSfk(parent, hcpartyId, confidential) {
+        return this.extractSFKsHierarchyFromDelegations(parent, hcpartyId).then((secretForeignKeys) => {
+            const keys = secretForeignKeys
+                .filter(({ extractedKeys }) => extractedKeys.length > 0)
+                .filter((x, idx) => (confidential ? x.hcpartyId === hcpartyId : idx === 0))[0];
+            return ((keys &&
+                (confidential
+                    ? keys.extractedKeys.find((k) => !secretForeignKeys.some(({ extractedKeys, hcpartyId: parentHcpId }) => hcpartyId !== parentHcpId && extractedKeys.includes(k)))
+                    : keys.extractedKeys[0])) ||
+                null);
+        });
+    }
+    /**
+     * Gets an array of decrypted HcPartyKeys, shared between the delegate with ID `delegateHcPartyId` and the delegators in `delegatorsHcPartyIdsSet`
+     *
+     * 1. Get the keys for the delegateHealthCareParty (cache/backend).
+     * 2. For each key in the delegators, decrypt it with the delegate's private key
+     * 3. Filter out undefined keys and return them
+     *
+     * @param delegatorsHcPartyIdsSet array of delegator HcP IDs that could have delegated something to the HcP with ID `delegateHcPartyId`
+     * @param delegateHcPartyId the HcP for which the HcPs with IDs in `delegatorsHcPartyIdsSet` could have delegated something
+     * @param minCacheDurationInSeconds The minimum cache duration
+     * @returns - **delegatorId** : the id of the delegator HcP that shares the **key** with the `delegateHcPartyId`
+     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `delegateHcPartyId`
+     */
+    decryptAndImportAesHcPartyKeysForDelegators(
+    //TODO:  suggested name: getDecryptedHcPKeysSharedBetweenDelegateAndDelegators
+    delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds = 60) {
+        return (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
+            (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.getHcPartyKeysForDelegate(delegateHcPartyId))).then((delegatorIDsWithDelegateEncryptedHcPartyKey) => {
+            // [key: delegatorId] = delegateEncryptedHcPartyKey
+            // For each delegatorId, obtain the AES key (decrypted HcParty Key) shared with the delegate, decrypted by the delegate
+            return Promise.all(delegatorsHcPartyIdsSet.map((delegatorId) => {
+                if (!delegatorIDsWithDelegateEncryptedHcPartyKey[delegatorId]) {
+                    return undefined;
+                }
+                return this.decryptHcPartyKey(delegatorId, delegateHcPartyId, delegatorIDsWithDelegateEncryptedHcPartyKey[delegatorId]).catch(() => {
+                    console.log(`failed to decrypt hcPartyKey from ${delegatorId} to ${delegateHcPartyId}`);
+                    return undefined;
+                });
+            })).then((hcPartyKeys) => {
+                const filteredHcPartyKeys = hcPartyKeys.filter((hcPartyKey) => !!hcPartyKey);
+                if (filteredHcPartyKeys.length > 0) {
+                    return filteredHcPartyKeys;
+                }
+                const nowTimestamp = +new Date();
+                if (!this.cacheLastDeletionTimestamp || (nowTimestamp - this.cacheLastDeletionTimestamp) / 1000 >= minCacheDurationInSeconds) {
+                    delete this.hcPartyKeysRequestsCache[delegateHcPartyId];
+                    this.cacheLastDeletionTimestamp = nowTimestamp;
+                    return this.decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId);
+                }
+                return filteredHcPartyKeys;
+            });
+        });
+    }
+    /**
+     * Gets an array of decrypted HcPartyKeys from the given `delegations`, that are shared with / can be decrypted by the HcP with the given `healthcarePartyId` (or by its parents when `fallbackOnParent` is true)
+     *
+     * 1. Checks whether the delegations' object has a delegation for the
+     * given healthCarePartyId.
+     * 2. Enumerates all the delegators (delegation.owner) present in
+     * the delegations.
+     * 3. Decrypt's delegators' keys and returns them.
+     *
+     * @param dataOwnerId : the id of the delegate HCP
+     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates
+     * @param fallbackOnParent  default true; use parent's healthCarePartyId in case there's no delegation for the `healthcarePartyId`
+     * @returns  - **delegatorId** : the id of the delegator HcP that shares the **key** with the `healthcarePartyId`
+     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `healthcarePartyId`
+     */
+    decryptAndImportAesHcPartyKeysInDelegations(
+    //TODO: suggested name: getDecryptedHcPKeysOfDelegateAndParentsFromGenericDelegations
+    dataOwnerId, delegations, fallbackOnParent = true) {
+        const delegatorIds = {};
+        const delegationsArray = delegations[dataOwnerId];
+        if (delegationsArray && delegationsArray.length) {
+            delegationsArray.forEach(function (delegationItem) {
+                delegatorIds[delegationItem.owner] = true; //TODO: why is set to true?
+            });
+        }
+        else if (fallbackOnParent) {
+            return this.getDataOwner(dataOwnerId).then(({ dataOwner: hcp }) => hcp.parentId ? this.decryptAndImportAesHcPartyKeysInDelegations(hcp.parentId, delegations) : Promise.resolve([]));
+        }
+        return this.decryptAndImportAesHcPartyKeysForDelegators(Object.keys(delegatorIds), dataOwnerId);
+    }
+    /**
+     * Retreive the owner HealthCareParty key and use it to encrypt
+     * both the delegations (createdObject.id) and the cryptedForeignKeys
+     * (parentObject.id), and returns them in an object.
+     */
+    initObjectDelegations(createdObject, parentObject, ownerId, secretForeignKeyOfParent) {
+        this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initObjectDelegations', arguments);
+        if (parentObject)
+            this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject.id, 'initObjectDelegations', arguments);
+        const secretId = this.randomUuid();
+        return this.getDataOwner(ownerId)
+            .then(({ dataOwner: owner }) => {
+            return this.getOrCreateHcPartyKey(owner, ownerId);
+        })
+            .then((encryptedHcPartyKey) => this.decryptHcPartyKey(ownerId, ownerId, encryptedHcPartyKey, true))
+            .then((importedAESHcPartyKey) => Promise.all([
+            this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId).buffer, importedAESHcPartyKey.rawKey),
+            parentObject
+                ? this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
+                : Promise.resolve(null),
+        ]))
+            .then((encryptedDelegationAndSecretForeignKey) => ({
+            delegations: _.fromPairs([
+                [
+                    ownerId,
+                    [
+                        {
+                            owner: ownerId,
+                            delegatedTo: ownerId,
+                            key: (0, binary_utils_1.ua2hex)(encryptedDelegationAndSecretForeignKey[0]),
+                        },
+                    ],
+                ],
+            ]),
+            cryptedForeignKeys: (encryptedDelegationAndSecretForeignKey[1] &&
+                _.fromPairs([
+                    [
+                        ownerId,
+                        [
+                            {
+                                owner: ownerId,
+                                delegatedTo: ownerId,
+                                key: (0, binary_utils_1.ua2hex)(encryptedDelegationAndSecretForeignKey[1]),
+                            },
+                        ],
+                    ],
+                ])) ||
+                {},
+            secretForeignKeys: (secretForeignKeyOfParent && [secretForeignKeyOfParent]) || [],
+            secretId: secretId,
+        }));
+    }
+    /**
+     * Gets updated instances of SPKs and CKFs for the child object `modifiedObject`.
+     * These updated SPKs and CKFs contain new SPKs/CFKs to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
+     *
+     * 1. if `secretIdOfModifiedObject` is not provided, the method will throw an exception; this `secretIdOfModifiedObject` is used to generate a new delegation (SPK) in step 3;
+     *  the `secretIdOfModifiedObject` is returned, unmodified, as `secretId`
+     * 2. if the owner (delegator) did not perform a delegation to the delegate, then this HcP delegation (creation of a new HcPKey) is performed now
+     * 3. creates a new delegation (Secret Primary Keys) on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
+     * 4. if `parentObject` != null, creates a new CFK on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
+     * 5. this new delegation (from step 3) is added to the list of existing delegations (Secret Primary Keys) on the `modifiedObject` for the delegate given by `delegateId`
+     * 6. if the CFK (from step 4) can be created, this new CFK is added to the list of existing CFKs on the `modifiedObject` for the delegate given by `delegateId`
+     * 7. then some duplicates delegations (SPKs) and CKFs are removed
+     *
+     * @param modifiedObject : the object of which SPKs and CFKs will be cloned, the clones will be modified and then used as returned values ; it's a 'child' of `parentObject`; will NOT be mutated
+     * @param parentObject : will NOT be mutated
+     * @param ownerId : the HcP id of the delegator
+     * @param delegateId : the HcP id of the delegate
+     * @param secretIdOfModifiedObject : the secret id used in the child object to generate its SPK
+     * @returns - **delegations**  existing delegations (SPKs) of the `modifiedObject`, appended with results from step 5
+     * - **cryptedForeignKeys** existing CFKs of the `modifiedObject`, appended with results from steps 6
+     * - **secretId** which is the given input parameter `secretIdOfModifiedObject`
+     */
+    extendedDelegationsAndCryptedForeignKeys(
+    //TODO: suggested name: getExtendedChildObjectSPKandCFKwithDelegationFromDelegatorToDelegate
+    modifiedObject, parentObject, ownerId, delegateId, secretIdOfModifiedObject) {
+        this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments); //modifiedObject should never be null
+        if (parentObject)
+            this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments);
+        this.throwDetailedExceptionForInvalidParameter('secretIdOfModifiedObject', secretIdOfModifiedObject, 'extendedDelegationsAndCryptedForeignKeys', arguments);
+        return this.getDataOwner(ownerId)
+            .then(({ dataOwner: owner }) => this.getOrCreateHcPartyKey(owner, delegateId))
+            .then((encryptedHcPartyKey) => this.decryptHcPartyKey(ownerId, delegateId, encryptedHcPartyKey, true))
+            .then((importedAESHcPartyKey) => Promise.all([
+            Promise.all(((modifiedObject.delegations || {})[delegateId] || []).map((d) => (d.key &&
+                d.owner === ownerId &&
+                this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                    console.log(`Cannot decrypt delegation from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                    return null;
+                })) ||
+                Promise.resolve(null))),
+            Promise.all(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => (d.key &&
+                d.owner === ownerId &&
+                this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                    console.log(`Cannot decrypt cryptedForeignKeys from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                    return null;
+                })) ||
+                Promise.resolve(null))),
+            this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretIdOfModifiedObject).buffer, importedAESHcPartyKey.rawKey),
+            parentObject
+                ? this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
+                : Promise.resolve(null),
+        ]))
+            .then(([previousDecryptedDelegations, previousDecryptedCryptedForeignKeys, cryptedDelegation, cryptedForeignKey]) => {
+            //try to limit the extent of the modifications to the delegations by preserving the redundant delegation already present and removing duplicates
+            //For delegate delegateId, we create:
+            // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for each existing delegation and the new key concatenated
+            // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
+            // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
+            const delegationCryptedDecrypted = _.merge(((modifiedObject.delegations || {})[delegateId] || []).map((d) => ({
+                d,
+            })), (previousDecryptedDelegations || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
+                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
+                .map(({ d, k }) => ({ d, k: k || this.randomUuid() })) // Use some unique id that ensures the delegation not created by us are going to be held
+                .concat([
+                {
+                    d: {
+                        owner: ownerId,
+                        delegatedTo: delegateId,
+                        key: (0, binary_utils_1.ua2hex)(cryptedDelegation),
+                    },
+                    k: modifiedObject.id + ':' + secretIdOfModifiedObject,
+                },
+            ]);
+            const allDelegations = _.cloneDeep(modifiedObject.delegations);
+            //Only keep one version of the decrypted key
+            allDelegations[delegateId] = _.uniqBy(delegationCryptedDecrypted, (x) => x.k).map((x) => x.d);
+            const cryptedForeignKeysCryptedDecrypted = _.merge(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => ({
+                d,
+            })), (previousDecryptedCryptedForeignKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
+                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
+                .map(({ d, k }) => ({ d, k: k || this.randomUuid() })) // Use some unique id that ensures the delegation not created by us are going to be held
+                .concat(cryptedForeignKey
+                ? [
+                    {
+                        d: {
+                            owner: ownerId,
+                            delegatedTo: delegateId,
+                            key: (0, binary_utils_1.ua2hex)(cryptedForeignKey),
+                        },
+                        k: modifiedObject.id + ':' + parentObject.id,
+                    },
+                ]
+                : []);
+            const allCryptedForeignKeys = _.cloneDeep(modifiedObject.cryptedForeignKeys || {});
+            if (cryptedForeignKeysCryptedDecrypted.length > 0) {
+                allCryptedForeignKeys[delegateId] = _.uniqBy(cryptedForeignKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
+            }
+            return {
+                delegations: allDelegations,
+                cryptedForeignKeys: allCryptedForeignKeys,
+                secretId: secretIdOfModifiedObject,
+            };
+        });
+    }
+    getOrCreateHcPartyKey(owner, delegateId) {
+        return !owner.hcPartyKeys[delegateId]
+            ? this.generateKeyForDelegate(owner.id, delegateId).then((owner) => owner.hcPartyKeys[delegateId][0])
+            : Promise.resolve(owner.hcPartyKeys[delegateId][0]);
+    }
+    /**
+     * Retrieve the owners HealthCareParty key, decrypt it, and
+     * use it to encrypt & initialize the "encryptionKeys" object
+     * and return it.
+     * @param createdObject
+     * @param ownerId
+     */
+    initEncryptionKeys(createdObject, ownerId) {
+        this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initEncryptionKeys', arguments);
+        const secretId = this.randomUuid();
+        return this.getDataOwner(ownerId)
+            .then(({ dataOwner: owner }) => this.getOrCreateHcPartyKey(owner, ownerId))
+            .then((encryptedHcPartyKey) => this.decryptHcPartyKey(ownerId, ownerId, encryptedHcPartyKey, true))
+            .then((importedAESHcPartyKey) => this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId)))
+            .then((encryptedEncryptionKeys) => ({
+            encryptionKeys: _.fromPairs([
+                [
+                    ownerId,
+                    [
+                        {
+                            owner: ownerId,
+                            delegatedTo: ownerId,
+                            key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKeys),
+                        },
+                    ],
+                ],
+            ]),
+            secretId: secretId,
+        }));
+    }
+    /**
+     * Gets an updated instance of the EKs of `modifiedObject`.
+     * The updated EKs contain a new EK to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`.
+     * @param modifiedObject : the object of which EKs will be cloned, the clone will be used to append the new EK, and then used as return value; will NOT be mutated
+     * @param ownerId : delegator HcP id
+     * @param delegateId : delegate HcP id
+     * @param secretEncryptionKeyOfObject : secret Id for the EK (Content Encryption Key)
+     * @returns
+     *   - **encryptionKeys** existing EKs of the `modifiedObject`, appended with a new EK item (owner: `ownerId`, delegatedTo: `delegateId`, encrypted key with secretId:
+     *     `secretEncryptionKeyOfObject` )
+     *   - **secretId** which is the given input parameter `secretEncryptionKeyOfObject`
+     */
+    appendEncryptionKeys(
+    //TODO: suggested name: getExtendedEKwithDelegationFromDelegatorToDelegate
+    modifiedObject, ownerId, delegateId, secretEncryptionKeyOfObject) {
+        this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'appendEncryptionKeys', arguments); //modifiedObject should never be null
+        this.throwDetailedExceptionForInvalidParameter('secretEncryptionKeyOfObject', secretEncryptionKeyOfObject, 'appendEncryptionKeys', arguments);
+        return this.getDataOwner(ownerId)
+            .then(({ dataOwner: owner }) => this.getOrCreateHcPartyKey(owner, delegateId))
+            .then((encryptedHcPartyKey) => this.decryptHcPartyKey(ownerId, delegateId, encryptedHcPartyKey, true))
+            .then((importedAESHcPartyKey) => Promise.all([
+            Promise.all(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => (d.key &&
+                d.owner === ownerId &&
+                this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                    console.log(`Cannot decrypt encryption key from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                    return null;
+                })) ||
+                Promise.resolve(null))),
+            this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretEncryptionKeyOfObject)),
+        ]))
+            .then(([previousDecryptedEncryptionKeys, encryptedEncryptionKey]) => {
+            //try to limit the extent of the modifications to the delegations by preserving the redundant encryption keys already present and removing duplicates
+            //For delegate delegateId, we create:
+            // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for the existing encryption keys and the new key concatenated
+            // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
+            // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
+            const encryptionKeysCryptedDecrypted = _.merge(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => ({
+                d,
+            })), (previousDecryptedEncryptionKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
+                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
+                .map(({ d, k }) => ({ d, k: k || this.randomUuid() }))
+                .concat([
+                {
+                    d: {
+                        owner: ownerId,
+                        delegatedTo: delegateId,
+                        key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKey),
+                    },
+                    k: modifiedObject.id + ':' + secretEncryptionKeyOfObject,
+                },
+            ]);
+            const allEncryptionKeys = _.cloneDeep(modifiedObject.encryptionKeys);
+            allEncryptionKeys[delegateId] = _.uniqBy(encryptionKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
+            return {
+                encryptionKeys: allEncryptionKeys,
+                secretId: secretEncryptionKeyOfObject,
+            };
+        });
+    }
+    /**
+     * Gets an updated `child` object that will have its SPKs, CFKs, KSs updated to include delegations from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
+     * The SFKs of `child` are not updated, so this method assumes this is not the initial delegation on the `child` object
+     * The method also performs some deduplication of all types of delegations.
+     * @param parent : the parent object of `child`; will NOT be mutated
+     * @param child : the object that will be mutated and returned
+     * @param ownerId delegator HcP id
+     * @param delegateId delegate HcP id
+     * @param secretDelegationKey  the secret Id used in the child object to generate the SPK
+     * @param secretEncryptionKey  the secret Id used in the child object to generate the EK (Content Encryption Key)
+     * @returns - an updated `child` object that will contain updated SPKs, CFKs, EKs
+     *  */
+    addDelegationsAndEncryptionKeys(
+    //TODO: suggested name: updateChildGenericDelegationsFromDelegatorToDelegate
+    parent, child, ownerId, delegateId, secretDelegationKey, secretEncryptionKey) {
+        if (parent)
+            this.throwDetailedExceptionForInvalidParameter('parent.id', parent.id, 'addDelegationsAndEncryptionKeys', arguments);
+        this.throwDetailedExceptionForInvalidParameter('child.id', child.id, 'addDelegationsAndEncryptionKeys', arguments);
+        return (secretDelegationKey
+            ? this.extendedDelegationsAndCryptedForeignKeys(child, parent, ownerId, delegateId, secretDelegationKey)
+            : Promise.resolve({ delegations: {}, cryptedForeignKeys: {} }))
+            .then((extendedChildObjectSPKsAndCFKs) => secretEncryptionKey
+            ? this.appendEncryptionKeys(child, ownerId, delegateId, secretEncryptionKey).then(
+            //TODO: extendedDelegationsAndCryptedForeignKeys and appendEncryptionKeys can be done in parallel
+            (extendedChildObjectEKs) => ({
+                extendedSPKsAndCFKs: extendedChildObjectSPKsAndCFKs,
+                extendedEKs: extendedChildObjectEKs,
+            }))
+            : Promise.resolve({
+                extendedSPKsAndCFKs: extendedChildObjectSPKsAndCFKs,
+                extendedEKs: { encryptionKeys: {} },
+            }))
+            .then(({ extendedSPKsAndCFKs: extendedChildObjectSPKsAndCFKs, extendedEKs: extendedChildObjectEKs }) => {
+            return _.assign(child, {
+                // Conservative version ... We might want to be more aggressive with the deduplication of keys
+                // For each delegate, we are going to concatenate to the src (the new delegations), the object in dest (the current delegations)
+                // for which we do not find an equivalent delegation (same delegator, same delegate)
+                delegations: _.assignWith(child.delegations, extendedChildObjectSPKsAndCFKs.delegations, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
+                cryptedForeignKeys: _.assignWith(child.cryptedForeignKeys, extendedChildObjectSPKsAndCFKs.cryptedForeignKeys, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
+                encryptionKeys: _.assignWith(child.encryptionKeys, extendedChildObjectEKs.encryptionKeys, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
+            });
+        });
+    }
+    /**
+     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
+     * @param document : the object of which delegations (SPKs) to decrypt
+     * @param hcpartyId : the id of the delegate HcP
+     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
+     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent; is this ok?
+    extractDelegationsSFKs(
+    //TODO: suggested name: getSecretIDsSPKofHcpAndParentsFromDocument
+    document, hcpartyId) {
+        if (!document || !hcpartyId) {
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId }); //TODO: thow exception instead?
+        }
+        const delegationsForAllDelegates = document.delegations;
+        if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
+            console.log(`There is no delegation in document (${document.id})`);
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, delegationsForAllDelegates);
+    }
+    /**
+     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
+     * @param document : the object of which delegations (SPKs) to decrypt
+     * @param hcpartyId : the id of the delegate HcP
+     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
+     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    extractSFKsHierarchyFromDelegations(document, hcpartyId) {
+        if (!document || !hcpartyId) {
+            return Promise.resolve([]);
+        }
+        const delegationsForAllDelegates = document.delegations;
+        if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
+            console.log(`There is no delegation in document (${document.id})`);
+            return Promise.resolve([]);
+        }
+        return this.extractKeysHierarchyFromDelegationLikes(hcpartyId, document.id, delegationsForAllDelegates);
+    }
+    // noinspection JSUnusedGlobalSymbols
+    extractCryptedFKs(
+    //TODO: suggested name: getSecretIDsCFKofHcpAndParentsFromDocument
+    document, hcpartyId) {
+        if (!document || !document.cryptedForeignKeys) {
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        const cfksForAllDelegates = document.cryptedForeignKeys;
+        if (!cfksForAllDelegates || !Object.keys(cfksForAllDelegates).length) {
+            console.log(`There is no cryptedForeignKeys in document (${document.id})`);
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, cfksForAllDelegates);
+    }
+    extractEncryptionsSKs(
+    //TODO: suggested name: getSecretIDsEKofHcpAndParentsFromDocument
+    document, hcpartyId) {
+        if (!document.encryptionKeys) {
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        const eckeysForAllDelegates = document.encryptionKeys;
+        if (!eckeysForAllDelegates || !Object.keys(eckeysForAllDelegates).length) {
+            //console.log(`There is no encryption key in document (${document.id})`)
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, eckeysForAllDelegates);
+    }
+    extractDelegationsSFKsAndEncryptionSKs(ety, ownerId) {
+        const delegationsSfksOwnerPromise = this.extractDelegationsSFKs(ety, ownerId).then((xks) => xks.extractedKeys); //Will climb up hierarchy
+        const encryptionKeysOwnerPromise = this.extractEncryptionsSKs(ety, ownerId).then((xks) => xks.extractedKeys); //Will climb up hierarchy
+        return Promise.all([delegationsSfksOwnerPromise, encryptionKeysOwnerPromise]);
+    }
+    /**
+     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
+     * 1. Get HealthCareParty from it's Id.
+     * 2. Decrypt the keys of the given HCP.
+     * 3. Decrypt the parent's key if it has parent.
+     * 4. Return the decrypted key corresponding to the Health Care Party.
+     * @param hcpartyId : the id of the delegate HcP (including its parents) for which to decrypt `extractedKeys`
+     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
+     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
+     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both HCP with given `hcpartyId` and its parents; can contain duplicates
+     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HCP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent
+    extractKeysHierarchyFromDelegationLikes(
+    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
+    hcpartyId, objectId, delegations) {
+        return this.getDataOwner(hcpartyId).then(({ dataOwner: hcp }) => (delegations[hcpartyId] && delegations[hcpartyId].length
+            ? this.decryptAndImportAesHcPartyKeysInDelegations(hcpartyId, delegations, false).then((decryptedAndImportedAesHcPartyKeys) => {
+                const collatedAesKeysFromDelegatorToHcpartyId = {};
+                decryptedAndImportedAesHcPartyKeys.forEach((k) => (collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] = k));
+                return this.decryptKeyInDelegationLikes(delegations[hcpartyId], collatedAesKeysFromDelegatorToHcpartyId, objectId);
+            })
+            : Promise.resolve([])).then((extractedKeys) => hcp.parentId
+            ? this.extractKeysHierarchyFromDelegationLikes(hcp.parentId, objectId, delegations).then((parentResponse) => parentResponse.concat({ extractedKeys: extractedKeys, hcpartyId: hcpartyId }))
+            : [{ extractedKeys: extractedKeys, hcpartyId: hcpartyId }]));
+    }
+    /**
+     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
+     * 1. Get Data Owner (HCP, Patient or Device) from it's Id.
+     * 2. Decrypt the keys of the given data owner.
+     * 3. Decrypt the parent's key if it has parent.
+     * 4. Return the decrypted key corresponding to the Health Care Party.
+     * @param dataOwnerId : the id of the delegate data owner (including its parents) for which to decrypt `extractedKeys`
+     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
+     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
+     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both data owner with given `dataOwnerId` and its parents; can contain duplicates
+     * - **dataOwnerId** the given `dataOwnerId` OR, if a parent exist, the data owner id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned dataOwnerId will be the one of the parent
+    extractKeysFromDelegationsForHcpHierarchy(
+    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
+    dataOwnerId, objectId, delegations) {
+        return this.getDataOwner(dataOwnerId).then(({ dataOwner: hcp }) => (delegations[dataOwnerId] && delegations[dataOwnerId].length
+            ? this.decryptAndImportAesHcPartyKeysInDelegations(dataOwnerId, delegations, false).then((decryptedAndImportedAesHcPartyKeys) => {
+                const collatedAesKeysFromDelegatorToHcpartyId = {};
+                decryptedAndImportedAesHcPartyKeys.forEach((k) => (collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] = k));
+                return this.decryptKeyInDelegationLikes(delegations[dataOwnerId], collatedAesKeysFromDelegatorToHcpartyId, objectId);
+            })
+            : Promise.resolve([])).then((extractedKeys) => hcp.parentId
+            ? this.extractKeysFromDelegationsForHcpHierarchy(hcp.parentId, objectId, delegations).then((parentResponse) => _.assign(parentResponse, {
+                extractedKeys: parentResponse.extractedKeys.concat(extractedKeys),
+            }))
+            : { extractedKeys: extractedKeys, hcpartyId: dataOwnerId }));
+    }
+    /**
+     * Gets an array of generic secret IDs decrypted from a list of generic delegations (SPKs, CFKs, EKs) `delegationsArray`
+     * If a particular generic delegation thows an exception when decrypted, the return value for it's secret ID will be 'false' and a message is logged to console
+     * For each one of the delegations in the `delegationsArray`, it tries to decrypt with the decryptedHcPartyKey of the owner of that delegation;
+     *
+     * @param delegationsArray : generic delegations array
+     * @param aesKeys : **key** HcP ids of delegators/owners in the `delegationsArray`, each with its own decryptedHcPartyKey
+     * @param masterId : is the object id to which the generic delegation belongs to
+     * - used only to check whether the object.id matches the one stored in the decrypted generic delegation item
+     * - even if there's no match, the secret ID is kept as a valid result (and a message logged to console)
+     * @returns array of generic secret IDs (secretIdSPK, parentId, secretIdEK)
+     */
+    decryptKeyInDelegationLikes(
+    //TODO: suggested name: getSecretIdsFromGenericDelegations
+    delegationsArray, aesKeys, masterId) {
+        const decryptPromises = [];
+        for (let i = 0; i < (delegationsArray || []).length; i++) {
+            var genericDelegationItem = delegationsArray[i];
+            const aesKey = aesKeys[genericDelegationItem.owner];
+            if (aesKey) {
+                decryptPromises.push(this._AES
+                    .decrypt(aesKey.key, (0, binary_utils_1.hex2ua)(genericDelegationItem.key), aesKey.rawKey)
+                    .then((decryptedGenericDelegationKey) => {
+                    const results = (0, binary_utils_1.ua2string)(decryptedGenericDelegationKey).split(':');
+                    const objectId = results[0]; //must be the ID of the object, for checksum
+                    const genericSecretId = results[1];
+                    const details = 'object ID: ' + masterId + '; generic delegation from ' + genericDelegationItem.owner + ' to ' + genericDelegationItem.delegatedTo;
+                    if (!objectId)
+                        console.warn('Object id is empty; ' + details);
+                    if (!genericSecretId)
+                        console.warn('Secret id is empty; ' + details);
+                    if (objectId !== masterId) {
+                        /*console.log(
+                          "Cryptographic mistake: object ID is not equal to the expected concatenated id within decrypted generic delegation. This may happen when patients have been merged; " +
+                            details
+                        )*/
+                    }
+                    return genericSecretId;
+                })
+                    .catch((err) => {
+                    console.log(`Could not decrypt generic delegation in object with ID: ${masterId} from ${genericDelegationItem.owner} to ${genericDelegationItem.delegatedTo}: ${err}`);
+                    return undefined;
+                }));
+            }
+            else {
+                console.log(`Could not find aes key for object with ID: ${masterId}`);
+            }
+        }
+        return Promise.all(decryptPromises).then((genericSecretId) => genericSecretId.filter((id) => !!id));
+    }
+    loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, privateKey) {
+        return this.getDataOwner(healthcarePartyId)
+            .then(({ dataOwner }) => dataOwner.publicKey)
+            .then((publicKey) => {
+            if (!publicKey) {
+                throw new Error('No public key has been defined for hcp');
+            }
+            return this._RSA.importKeyPair('jwk', this._utils.pkcs8ToJwk(privateKey), 'jwk', this._utils.spkiToJwk((0, binary_utils_1.hex2ua)(publicKey)));
+        })
+            .then((keyPair) => {
+            this._RSA.rsaKeyPairs[healthcarePartyId] = keyPair;
+            return this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
+        })
+            .then((exportedKeyPair) => {
+            return this._RSA.storeKeyPair(healthcarePartyId, exportedKeyPair);
+        });
+    }
+    // noinspection JSUnusedGlobalSymbols
+    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privKey) {
+        return this.getDataOwner(healthcarePartyId)
+            .then(({ dataOwner }) => {
+            const pubKey = this._utils.spkiToJwk((0, binary_utils_1.hex2ua)(dataOwner.publicKey));
+            privKey.n = pubKey.n;
+            privKey.e = pubKey.e;
+            return this._RSA.importKeyPair('jwk', privKey, 'jwk', pubKey);
+        })
+            .then((keyPair) => {
+            this._RSA.rsaKeyPairs[healthcarePartyId] = keyPair;
+            return this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
+        })
+            .then((exportedKeyPair) => {
+            return this._RSA.storeKeyPair(healthcarePartyId, exportedKeyPair);
+        });
+    }
+    // noinspection JSUnusedGlobalSymbols
+    loadKeyPairsInBrowserLocalStorage(healthcarePartyId, file) {
+        const fr = new FileReader();
+        return new Promise((resolve, reject) => {
+            fr.onerror = reject;
+            fr.onabort = reject;
+            fr.onload = (e) => {
+                //TODO remove any
+                const privateKey = e.target.result;
+                this.loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, (0, binary_utils_1.hex2ua)(privateKey)).then(resolve).catch(reject);
+            };
+            fr.readAsText(file);
+        });
+    }
+    // noinspection JSUnusedGlobalSymbols
+    saveKeychainInBrowserLocalStorage(id, keychain) {
+        localStorage.setItem(this.keychainLocalStoreIdPrefix + id, (0, binary_utils_1.b2a)(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), '')));
+    }
+    saveKeychainInBrowserLocalStorageAsBase64(id, keyChainB64) {
+        localStorage.setItem(this.keychainLocalStoreIdPrefix + id, keyChainB64);
+    }
+    // noinspection JSUnusedGlobalSymbols
+    saveKeychainValidityDateInBrowserLocalStorage(id, date) {
+        if (!id)
+            return;
+        if (!date) {
+            localStorage.removeItem(this.keychainValidityDateLocalStoreIdPrefix + id);
+        }
+        else {
+            localStorage.setItem(this.keychainValidityDateLocalStoreIdPrefix + id, date);
+        }
+    }
+    /**
+     * Populate the HCP.options dict with an encrypted eHealth certificate and unencryped expiry date.
+     * Any potentially unencrypted certificates will be pruned from the HCP.
+     * @param hcpId Id of the hcp to modify
+     * @returns modified HCP
+     */
+    saveKeyChainInHCPFromLocalStorage(hcpId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
+                let aesKey = null;
+                try {
+                    aesKey = _.find(yield this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id], hcp.id), (delegator) => delegator.delegatorId === hcp.id).key;
+                }
+                catch (e) {
+                    console.error('Error while importing the AES key.');
+                }
+                if (!aesKey) {
+                    console.error('No encryption key!');
+                }
+                const opts = hcp.options || {};
+                const crt = this.getKeychainInBrowserLocalStorageAsBase64(hcp.id);
+                if (!!aesKey && !!crt) {
+                    let crtEncrypted = null;
+                    try {
+                        crtEncrypted = yield this.AES.encrypt(aesKey, new Uint8Array((0, binary_utils_1.string2ua)(atob(crt))));
+                    }
+                    catch (e) {
+                        console.error('Error while encrypting the certificate', e);
+                    }
+                    // add the encrypted certificate to the options
+                    _.set(opts, this.hcpPreferenceKeyEhealthCert, (0, binary_utils_1.ua2string)(new Uint8Array(crtEncrypted)));
+                }
+                const crtValidityDate = this.getKeychainValidityDateInBrowserLocalStorage(hcp.id);
+                if (!!crtValidityDate) {
+                    _.set(opts, this.hcpPreferenceKeyEhealthCertDate, crtValidityDate);
+                }
+                hcp.options = opts;
+                return hcp;
+            }));
+        });
+    }
+    importKeychainInBrowserFromHCP(hcpId) {
+        return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
+            let crtCryp = null;
+            if (!!hcp.options && !!hcp.options[this.hcpPreferenceKeyEhealthCert]) {
+                crtCryp = (0, binary_utils_1.string2ua)(hcp.options[this.hcpPreferenceKeyEhealthCert]);
+            }
+            const crtValidityDate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCertDate);
+            // store the validity date
+            if (!!crtValidityDate) {
+                this.saveKeychainValidityDateInBrowserLocalStorage(hcp.id, crtValidityDate);
+            }
+            let crt = null;
+            let decryptionKey = null;
+            try {
+                decryptionKey = _.find(yield this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id], hcp.id), (delegator) => delegator.delegatorId === hcp.id).key;
+            }
+            catch (e) {
+                console.error('Error while importing the AES key.');
+            }
+            if (!decryptionKey) {
+                throw new Error('No encryption key! eHealth certificate cannot be decrypted.');
+            }
+            if (!!crtCryp && decryptionKey) {
+                try {
+                    crt = yield this.AES.decrypt(decryptionKey, crtCryp);
+                }
+                catch (e) {
+                    console.error(e);
+                }
+            }
+            if (!crt) {
+                throw new Error(`Error while saving certificate in browser local storage! Hcp ${hcp.id} has no certificate.`);
+            }
+            else {
+                this.saveKeychainInBrowserLocalStorageAsBase64(hcp.id, btoa(String.fromCharCode.apply(null, Array.from(new Uint8Array(crt)))));
+            }
+            return;
+        }));
+    }
+    /**
+     * Synchronizes the eHealth certificate from the database into the LocalStorage, returning information on the presence
+     * of certificate data in either place.
+     *
+     * @param hcpId The healthcare party id
+     * @returns A Promise for an object that represents the existence of a certificate in local storage and in the DB,
+     * through the two boolean properties "local" and "remote".
+     */
+    syncEhealthCertificateFromDatabase(hcpId) {
+        return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => {
+            const remoteCertificate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCert);
+            const localCertificate = this.getKeychainInBrowserLocalStorageAsBase64(hcp.id);
+            if (remoteCertificate) {
+                return this.importKeychainInBrowserFromHCP(hcp.id)
+                    .then(() => ({ local: true, remote: true }))
+                    .catch(() => ({ local: !!localCertificate, remote: true }));
+            }
+            else {
+                return { local: !!localCertificate, remote: !!remoteCertificate };
+            }
+        });
+    }
+    getKeychainInBrowserLocalStorageAsBase64(id) {
+        return localStorage.getItem(this.keychainLocalStoreIdPrefix + id);
+    }
+    getKeychainValidityDateInBrowserLocalStorage(id) {
+        return localStorage.getItem(this.keychainValidityDateLocalStoreIdPrefix + id);
+    }
+    // noinspection JSUnusedGlobalSymbols
+    loadKeychainFromBrowserLocalStorage(id) {
+        const lsItem = localStorage.getItem('org.taktik.icure.ehealth.keychain.' + id);
+        return lsItem !== null ? (0, binary_utils_1.b64_2uas)(lsItem) : null;
+    }
+    generateKeyForDelegate(ownerId, delegateId) {
+        //Preload hcp and patient because we need them and they are going to be invalidated from the caches
+        return this._utils.notConcurrent(this.generateKeyConcurrencyMap, ownerId, () => Promise.all([this.getDataOwner(ownerId), this.getDataOwner(delegateId)]).then(([{ type: ownerType, dataOwner: owner }, { dataOwner: delegate }]) => {
+            if ((owner.hcPartyKeys || {})[delegateId]) {
+                return owner;
+            }
+            const genProm = new Promise((resolve, reject) => {
+                delegate.publicKey
+                    ? this._AES
+                        .generateCryptoKey(true)
+                        .then((AESKey) => {
+                        const ownerPubKey = this._utils.spkiToJwk((0, binary_utils_1.hex2ua)(owner.publicKey));
+                        const delegatePubKey = this._utils.spkiToJwk((0, binary_utils_1.hex2ua)(delegate.publicKey));
+                        return Promise.all([
+                            this._RSA.importKey('jwk', ownerPubKey, ['encrypt']),
+                            this._RSA.importKey('jwk', delegatePubKey, ['encrypt']),
+                        ]).then(([ownerImportedKey, delegateImportedKey]) => Promise.all([
+                            this._RSA.encrypt(ownerImportedKey, (0, binary_utils_1.hex2ua)(AESKey)),
+                            this._RSA.encrypt(delegateImportedKey, (0, binary_utils_1.hex2ua)(AESKey)),
+                        ]));
+                    })
+                        .then(([ownerKey, delegateKey]) => (owner.hcPartyKeys[delegateId] = [(0, binary_utils_1.ua2hex)(ownerKey), (0, binary_utils_1.ua2hex)(delegateKey)]))
+                        .then(() => {
+                        return ownerType === 'hcp'
+                            ? (this.dataOwnerCache[owner.id] = this.hcpartyBaseApi
+                                .modifyHealthcareParty(owner)
+                                .then((x) => ({ type: 'hcp', dataOwner: x }))).then((x) => resolve(['hcp', x.dataOwner]))
+                            : ownerType === 'patient'
+                                ? (this.dataOwnerCache[owner.id] = this.patientBaseApi
+                                    .modifyPatient(owner)
+                                    .then((x) => ({ type: 'patient', dataOwner: x }))).then((x) => resolve(['patient', x.dataOwner]))
+                                : (this.dataOwnerCache[owner.id] = this.deviceBaseApi
+                                    .updateDevice(owner)
+                                    .then((x) => ({ type: 'device', dataOwner: x }))).then((x) => resolve(['device', x.dataOwner]));
+                    })
+                        .catch((e) => reject(e))
+                    : reject(new Error(`Missing public key for delegate ${delegateId}`));
+            });
+            // invalidate the hcPartyKeys cache for the delegate hcp (who was not modified, but the view for its
+            // id was updated)
+            this.hcPartyKeysRequestsCache[delegateId] = genProm.then(() => {
+                return this.forceGetHcPartyKeysForDelegate(delegateId);
+            });
+            return genProm.then((res) => {
+                return res[1];
+            });
+        }));
+    }
+    getDataOwner(ownerId) {
+        var _a;
+        return ((_a = this.dataOwnerCache[ownerId]) !== null && _a !== void 0 ? _a : (this.dataOwnerCache[ownerId] = this.patientBaseApi
+            .getPatient(ownerId)
+            .then((x) => ({ type: 'patient', dataOwner: x }))
+            .catch(() => this.deviceBaseApi.getDevice(ownerId).then((x) => ({ type: 'device', dataOwner: x })))
+            .catch(() => this.hcpartyBaseApi.getHealthcareParty(ownerId).then((x) => ({ type: 'hcp', dataOwner: x })))
+            .catch((e) => {
+            delete this.dataOwnerCache[ownerId];
+            throw e;
+        })));
+    }
+    // noinspection JSUnusedGlobalSymbols
+    checkPrivateKeyValidity(dataOwner) {
+        return new Promise((resolve) => {
+            this._RSA
+                .importKey('jwk', this._utils.spkiToJwk((0, binary_utils_1.hex2ua)(dataOwner.publicKey)), ['encrypt'])
+                .then((k) => this._RSA.encrypt(k, (0, binary_utils_1.utf8_2ua)('shibboleth')))
+                .then((cipher) => {
+                const kp = this._RSA.loadKeyPairNotImported(dataOwner.id);
+                return this._RSA
+                    .importKeyPair('jwk', kp.privateKey, 'jwk', kp.publicKey)
+                    .then((ikp) => this._RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)));
+            })
+                .then((plainText) => {
+                const pt = (0, binary_utils_1.ua2utf8)(plainText);
+                console.log(pt);
+                resolve(pt === 'shibboleth');
+            })
+                .catch(() => resolve(false));
+        });
+    }
+    throwDetailedExceptionForInvalidParameter(argName, argValue, methodName, methodArgs) {
+        if (argValue)
+            return;
+        let details = '\nMethod name: icc-crypto-x-api.' + methodName + '()\nArguments:';
+        if (methodArgs) {
+            try {
+                const argsArray = [...methodArgs];
+                _.each(argsArray, (arg, index) => (details += '\n[' + index + ']: ' + JSON.stringify(arg)));
+            }
+            catch (ex) {
+                details += '; a problem occured while logging arguments details: ' + ex;
+            }
+        }
+        throw '### THIS SHOULD NOT HAPPEN: ' + argName + ' has an invalid value: ' + argValue + details;
+    }
+    getEncryptionDecryptionKeys(dataOwnerId, document) {
+        return !document.id
+            ? Promise.resolve(null)
+            : this.extractKeysFromDelegationsForHcpHierarchy(dataOwnerId, document.id, (document.encryptionKeys && Object.keys(document.encryptionKeys).length && document.encryptionKeys) || document.delegations)
+                .then(({ extractedKeys }) => _.uniq(extractedKeys))
+                .catch(() => null);
+    }
+    encryptDecrypt(method, content, edKey, user, documentObject) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!content || !(edKey || ((user === null || user === void 0 ? void 0 : user.healthcarePartyId) && documentObject)))
+                return content;
+            if (edKey) {
+                const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(edKey.replace(/-/g, '')));
+                try {
+                    return yield this._AES[method](importedEdKey, content);
+                }
+                catch (e) {
+                    return content;
+                }
+            }
+            const sfks = yield this.extractKeysFromDelegationsForHcpHierarchy(user === null || user === void 0 ? void 0 : user.healthcarePartyId, documentObject === null || documentObject === void 0 ? void 0 : documentObject.id, documentObject === null || documentObject === void 0 ? void 0 : documentObject.encryptionKeys);
+            const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(sfks.extractedKeys[0].replace(/-/g, '')));
+            try {
+                return yield this._AES[method](importedEdKey, content);
+            }
+            catch (e) {
+                return content;
+            }
+        });
+    }
+}
+exports.IccCryptoXApi = IccCryptoXApi;
+//# sourceMappingURL=icc-crypto-x-api.js.map