@icure/api 5.0.24 → 5.0.26

package/icc-x-api/icc-crypto-x-api.js

@@ -415,8 +415,9 @@ class IccCryptoXApi {
                 const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, ownerId);
                 const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys);
                 const encryptedDelegation = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId).buffer, importedAESHcPartyKey.rawKey);
-                const encryptedSecretForeignKey = parentObject &&
-                    this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey);
+                const encryptedSecretForeignKey = parentObject
+                    ? yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
+                    : undefined;
                 return {
                     owner: modifiedOwner,
                     delegations: _.fromPairs([
@@ -431,8 +432,8 @@ class IccCryptoXApi {
                             ],
                         ],
                     ]),
-                    cryptedForeignKeys: (encryptedSecretForeignKey &&
-                        _.fromPairs([
+                    cryptedForeignKeys: (encryptedSecretForeignKey
+                        ? _.fromPairs([
                             [
                                 ownerId,
                                 [
@@ -443,8 +444,8 @@ class IccCryptoXApi {
                                     },
                                 ],
                             ],
-                        ])) ||
-                        {},
+                        ])
+                        : _) || {},
                     secretForeignKeys: (secretForeignKeyOfParent && [secretForeignKeyOfParent]) || [],
                     secretId: secretId,
                 };
@@ -670,50 +671,46 @@ class IccCryptoXApi {
         return __awaiter(this, arguments, void 0, function* () {
             this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'appendEncryptionKeys', arguments); //modifiedObject should never be null
             this.throwDetailedExceptionForInvalidParameter('secretEncryptionKeyOfObject', secretEncryptionKeyOfObject, 'appendEncryptionKeys', arguments);
-            return this.getDataOwner(ownerId)
-                .then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
-                const publicKeys = yield this.getPublicKeys();
-                const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
-                const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, delegateId, publicKeys);
-                return {
-                    previousDecryptedEncryptionKeys: yield Promise.all(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => (d.key &&
-                        d.owner === ownerId &&
-                        this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                            console.log(`Cannot decrypt encryption key from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                            return Promise.resolve();
-                        })) ||
-                        Promise.resolve())),
-                    encryptedEncryptionKey: yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretEncryptionKeyOfObject)),
-                };
-            }))
-                .then(({ previousDecryptedEncryptionKeys, encryptedEncryptionKey }) => {
-                //try to limit the extent of the modifications to the delegations by preserving the redundant encryption keys already present and removing duplicates
-                //For delegate delegateId, we create:
-                // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for the existing encryption keys and the new key concatenated
-                // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
-                // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
-                const encryptionKeysCryptedDecrypted = _.merge(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => ({
-                    d,
-                })), (previousDecryptedEncryptionKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
-                    .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                    .map(({ d, k }) => ({ d, k: k || this.randomUuid() }))
-                    .concat([
-                    {
-                        d: {
-                            owner: ownerId,
-                            delegatedTo: delegateId,
-                            key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKey),
-                        },
-                        k: modifiedObject.id + ':' + secretEncryptionKeyOfObject,
+            const owner = (yield this.getDataOwner(ownerId)).dataOwner;
+            const publicKeys = yield this.getPublicKeys();
+            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
+            modifiedObject = (modifiedObject === null || modifiedObject === void 0 ? void 0 : modifiedObject.id) === owner.id ? modifiedOwner : modifiedObject;
+            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, delegateId, publicKeys);
+            const previousDecryptedEncryptionKeys = yield Promise.all(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => (d.key &&
+                d.owner === ownerId &&
+                this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                    console.log(`Cannot decrypt encryption key from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                    return Promise.resolve();
+                })) ||
+                Promise.resolve()));
+            const encryptedEncryptionKey = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretEncryptionKeyOfObject));
+            //try to limit the extent of the modifications to the delegations by preserving the redundant encryption keys already present and removing duplicates
+            //For delegate delegateId, we create:
+            // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for the existing encryption keys and the new key concatenated
+            // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
+            // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
+            const encryptionKeysCryptedDecrypted = _.merge(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => ({
+                d,
+            })), (previousDecryptedEncryptionKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
+                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
+                .map(({ d, k }) => ({ d, k: k || this.randomUuid() }))
+                .concat([
+                {
+                    d: {
+                        owner: ownerId,
+                        delegatedTo: delegateId,
+                        key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKey),
                     },
-                ]);
-                const allEncryptionKeys = _.cloneDeep(modifiedObject.encryptionKeys);
-                allEncryptionKeys[delegateId] = _.uniqBy(encryptionKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
-                return {
-                    encryptionKeys: allEncryptionKeys,
-                    secretId: secretEncryptionKeyOfObject,
-                };
-            });
+                    k: modifiedObject.id + ':' + secretEncryptionKeyOfObject,
+                },
+            ]);
+            const allEncryptionKeys = _.cloneDeep(modifiedObject.encryptionKeys || {});
+            allEncryptionKeys[delegateId] = _.uniqBy(encryptionKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
+            return {
+                modifiedObject: modifiedObject,
+                encryptionKeys: allEncryptionKeys,
+                secretId: secretEncryptionKeyOfObject,
+            };
         });
     }
     /**
@@ -731,25 +728,18 @@ class IccCryptoXApi {
     addDelegationsAndEncryptionKeys(
     //TODO: suggested name: updateChildGenericDelegationsFromDelegatorToDelegate
     parent, child, ownerId, delegateId, secretDelegationKey, secretEncryptionKey) {
-        if (parent)
-            this.throwDetailedExceptionForInvalidParameter('parent.id', parent.id, 'addDelegationsAndEncryptionKeys', arguments);
-        this.throwDetailedExceptionForInvalidParameter('child.id', child.id, 'addDelegationsAndEncryptionKeys', arguments);
-        return (secretDelegationKey
-            ? this.extendedDelegationsAndCryptedForeignKeys(child, parent, ownerId, delegateId, secretDelegationKey)
-            : Promise.resolve({ modifiedObject: child, delegations: {}, cryptedForeignKeys: {}, secretId: null }))
-            .then((extendedChildObjectSPKsAndCFKs) => secretEncryptionKey
-            ? this.appendEncryptionKeys(extendedChildObjectSPKsAndCFKs.modifiedObject, ownerId, delegateId, secretEncryptionKey).then(
-            //TODO: extendedDelegationsAndCryptedForeignKeys and appendEncryptionKeys can be done in parallel
-            (extendedChildObjectEKs) => ({
-                extendedSPKsAndCFKs: extendedChildObjectSPKsAndCFKs,
-                extendedEKs: extendedChildObjectEKs,
-            }))
-            : Promise.resolve({
-                extendedSPKsAndCFKs: extendedChildObjectSPKsAndCFKs,
-                extendedEKs: { encryptionKeys: {} },
-            }))
-            .then(({ extendedSPKsAndCFKs: extendedChildObjectSPKsAndCFKs, extendedEKs: extendedChildObjectEKs }) => {
-            return _.assign(extendedChildObjectSPKsAndCFKs.modifiedObject, {
+        return __awaiter(this, arguments, void 0, function* () {
+            if (parent)
+                this.throwDetailedExceptionForInvalidParameter('parent.id', parent.id, 'addDelegationsAndEncryptionKeys', arguments);
+            this.throwDetailedExceptionForInvalidParameter('child.id', child.id, 'addDelegationsAndEncryptionKeys', arguments);
+            const extendedChildObjectSPKsAndCFKs = secretDelegationKey
+                ? yield this.extendedDelegationsAndCryptedForeignKeys(child, parent, ownerId, delegateId, secretDelegationKey)
+                : { modifiedObject: child, delegations: {}, cryptedForeignKeys: {}, secretId: null };
+            const extendedChildObjectEKs = secretEncryptionKey
+                ? yield this.appendEncryptionKeys(extendedChildObjectSPKsAndCFKs.modifiedObject, ownerId, delegateId, secretEncryptionKey)
+                : { encryptionKeys: {}, modifiedObject: extendedChildObjectSPKsAndCFKs.modifiedObject };
+            const latestObject = extendedChildObjectEKs.modifiedObject;
+            return _.assign(latestObject, {
                 // Conservative version ... We might want to be more aggressive with the deduplication of keys
                 // For each delegate, we are going to concatenate to the src (the new delegations), the object in dest (the current delegations)
                 // for which we do not find an equivalent delegation (same delegator, same delegate)
@@ -890,7 +880,14 @@ class IccCryptoXApi {
                 });
                 return this.decryptKeyInDelegationLikes(delegations[dataOwnerId], collatedAesKeysFromDelegatorToHcpartyId, objectId);
             })
-            : Promise.resolve([])).then((extractedKeys) => __awaiter(this, void 0, void 0, function* () {
+            : Promise.resolve([]))
+            .then((extractedKeys) => __awaiter(this, void 0, void 0, function* () {
+            if (extractedKeys.length == 0) {
+                return yield this._extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(hcp, delegations, objectId);
+            }
+            return extractedKeys;
+        }))
+            .then((extractedKeys) => __awaiter(this, void 0, void 0, function* () {
             var _a;
             const parentExtractedKeys = hcp.parentId
                 ? yield this.extractKeysFromDelegationsForHcpHierarchy(hcp.parentId, objectId, delegations)
@@ -902,6 +899,56 @@ class IccCryptoXApi {
             throw e;
         });
     }
+    /**
+     * This method covers the use case when a DataOwner found back access to its data, and needs to use the delegations of its delegates instead
+     * of its own ones
+     *
+     * @param dataOwner The current data owner from whom we want to decrypt the aesExchangeKeys
+     * @param delegations The object delegations to decrypt
+     * @param objectId The object to decrypt id
+     * @private
+     */
+    _extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(dataOwner, delegations, objectId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // Find other keys through aesExchangeKeys
+            const dataOwnerPubKeys = yield this.getPublicKeys();
+            const keysToDecrypt = (0, utils_1.fold)(Object.entries(dataOwner.aesExchangeKeys), {}, (acc, [pub, aesForPub]) => {
+                Object.entries(aesForPub).forEach(([delegateId, aesKeys]) => {
+                    if (delegateId != dataOwner.id) {
+                        const aesAcc = {};
+                        Object.entries(aesKeys)
+                            .filter(([encrPubKey]) => dataOwnerPubKeys.some((pubKey) => pubKey.slice(-32) == encrPubKey))
+                            .forEach(([pubKeyFingerprint, aesEncr]) => {
+                            aesAcc[pubKeyFingerprint] = aesEncr;
+                        });
+                        if (acc[delegateId] == undefined) {
+                            acc[delegateId] = {};
+                        }
+                        acc[delegateId][pub] = aesAcc;
+                    }
+                });
+                return acc;
+            });
+            const decryptedAndImportedAesHcPartyKeys = yield (0, utils_1.foldAsync)(Object.entries(keysToDecrypt), [], (delKeysAcc, [delegateId, keysForDelegate]) => __awaiter(this, void 0, void 0, function* () {
+                try {
+                    delKeysAcc.push(yield this.decryptAnyAesExchangeKeyForOwner(keysForDelegate, dataOwner.id, dataOwner.id, delegateId, dataOwnerPubKeys));
+                }
+                catch (e) {
+                    console.log(`Could not decrypt aesExchangeKeys for delegate ${delegateId}`);
+                }
+                return delKeysAcc;
+            }));
+            const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce((map, k) => { var _a; return (Object.assign(Object.assign({}, map), { [k.delegatorId]: ((_a = map[k.delegatorId]) !== null && _a !== void 0 ? _a : []).concat([k]) })); }, {});
+            const delegateIdsWithNewExtractedAesKeys = Object.keys(keysToDecrypt);
+            const delegationsToDecrypt = (0, utils_1.fold)(Object.entries(delegations), [], (acc, [delegateId, del]) => {
+                if (delegateIdsWithNewExtractedAesKeys.find((id) => id == delegateId) != undefined) {
+                    acc.push(...delegations[delegateId]);
+                }
+                return acc;
+            });
+            return this.decryptKeyInDelegationLikes(delegationsToDecrypt, collatedAesKeysFromDelegatorToHcpartyId, objectId);
+        });
+    }
     /**
      * Gets an array of generic secret IDs decrypted from a list of generic delegations (SPKs, CFKs, EKs) `delegationsArray`
      * If a particular generic delegation thows an exception when decrypted, the return value for it's secret ID will be 'false' and a message is logged to console
@@ -997,7 +1044,7 @@ class IccCryptoXApi {
             }
             const publicKey = this.getPublicKeyFromPrivateKey(privateKey, dataOwner);
             const keyPair = yield this._RSA.importKeyPair('jwk', privateKey, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
-            this.rsaKeyPairs[healthcarePartyId] = keyPair;
+            this.rsaKeyPairs[publicKey.slice(-32)] = keyPair;
             const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
             return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
         });
@@ -1217,6 +1264,66 @@ class IccCryptoXApi {
             }
         });
     }
+    /**
+     * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
+     * AES key using the new user public key.
+     *
+     * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
+     * @param ownerId Id of the data owner to which we would like to give access back
+     * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
+     *
+     * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
+     */
+    giveAccessBackTo(delegateUser, ownerId, ownerNewPublicKey) {
+        var _a, _b, _c, _d;
+        return __awaiter(this, void 0, void 0, function* () {
+            const delegateId = (_b = (_a = delegateUser.healthcarePartyId) !== null && _a !== void 0 ? _a : delegateUser.patientId) !== null && _b !== void 0 ? _b : delegateUser.deviceId;
+            if (!delegateId) {
+                throw new Error(`DelegateUser ${delegateUser.id} must be a data Owner`);
+            }
+            const delegatePublicKeys = yield this.getPublicKeys();
+            const newPubKeyCryptoKey = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(ownerNewPublicKey)), ['encrypt']);
+            const dataOwnerToUpdate = yield this.getDataOwner(ownerId);
+            const newAesExchangeKeys = yield (0, utils_1.foldAsync)(Object.entries((_c = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => __awaiter(this, void 0, void 0, function* () {
+                var _e;
+                const existingKeys = (_e = pubAcc[pubKey]) !== null && _e !== void 0 ? _e : {};
+                pubAcc[pubKey] = yield (0, utils_1.foldAsync)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => __awaiter(this, void 0, void 0, function* () {
+                    if (delId == delegateId && pubKey != ownerNewPublicKey) {
+                        // Add the AES Key encrypted with the new public key in the aesExchangeKeys
+                        try {
+                            // First, we decrypt it using the delegate RSA Public Key
+                            const encrAesKeyInfo = yield this.decryptHcPartyKey(delegateId, dataOwnerToUpdate.dataOwner.id, delegateId, pubKey, delKeys, delegatePublicKeys).then((delegatorAndKeys) => __awaiter(this, void 0, void 0, function* () {
+                                // Then, we encrypt it using the owner new RSA Public Key (provided in argument)
+                                return yield this.encryptAesKeyOnlyForProvidedKeys(delegatorAndKeys === null || delegatorAndKeys === void 0 ? void 0 : delegatorAndKeys.rawKey, dataOwnerToUpdate, [newPubKeyCryptoKey])
+                                    .then((encrAes) => Object.values(encrAes)[0])
+                                    .then((encrAesInfo) => {
+                                    return { pubKeyUsedToEncryptAes: Object.keys(encrAesInfo)[0], encryptedAes: Object.values(encrAesInfo)[0] };
+                                });
+                            }));
+                            delKeys[encrAesKeyInfo.pubKeyUsedToEncryptAes] = encrAesKeyInfo.encryptedAes;
+                        }
+                        catch (e) {
+                            console.log(`${delegateId} could not re-encrypt AES Key of ${dataOwnerToUpdate.dataOwner.id}`);
+                        }
+                        finally {
+                            delAcc[delId] = delKeys;
+                        }
+                    }
+                    else {
+                        // Otherwise, we don't transform the aesExchangeKeys for this delegate
+                        delAcc[delId] = delKeys;
+                    }
+                    return delAcc;
+                }));
+                return pubAcc;
+            }));
+            // After adding the potential new aesExchangeKeys, we save the updated data owner
+            return this._saveDataOwner({
+                type: dataOwnerToUpdate.type,
+                dataOwner: Object.assign(Object.assign({}, dataOwnerToUpdate.dataOwner), { aesExchangeKeys: newAesExchangeKeys }),
+            });
+        });
+    }
     addNewKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, generateTransferKey = true) {
         return __awaiter(this, void 0, void 0, function* () {
             return this.addNewKeyPairForOwner(maintenanceTasksApi, user, yield this.getDataOwner(ownerId), generateTransferKey);
@@ -1234,7 +1341,22 @@ class IccCryptoXApi {
             }).then((dataOwnerWithUpdatedAesKeys) => generateTransferKey
                 ? this.createOrUpdateTransferKeysFor(dataOwnerWithUpdatedAesKeys, gen, { pubKey: publicKey, privKey: privateKey })
                 : dataOwnerWithUpdatedAesKeys);
-            const modifiedDataOwnerAndType = ownerType === 'hcp'
+            const modifiedDataOwnerAndType = yield this._saveDataOwner({ type: ownerType, dataOwner: ownerToUpdate });
+            const sentMaintenanceTasks = yield this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, publicKey);
+            return {
+                dataOwner: sentMaintenanceTasks.length
+                    ? yield this.retrieveDataOwnerInfoAfterPotentialUpdate(modifiedDataOwnerAndType.dataOwner)
+                    : modifiedDataOwnerAndType.dataOwner,
+                publicKey: publicKeyHex,
+                privateKey: (0, binary_utils_1.ua2hex)((yield this.RSA.exportKey(privateKey, 'pkcs8'))),
+            };
+        });
+    }
+    _saveDataOwner(dataOwner) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const ownerType = dataOwner.type;
+            const ownerToUpdate = dataOwner.dataOwner;
+            return ownerType === 'hcp'
                 ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.hcpartyBaseApi
                     .modifyHealthcareParty(ownerToUpdate)
                     .then((x) => ({ type: 'hcp', dataOwner: x })))
@@ -1245,14 +1367,6 @@ class IccCryptoXApi {
                     : yield (this.dataOwnerCache[ownerToUpdate.id] = this.deviceBaseApi
                         .updateDevice(ownerToUpdate)
                         .then((x) => ({ type: 'device', dataOwner: x })));
-            const sentMaintenanceTasks = yield this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, publicKey);
-            return {
-                dataOwner: sentMaintenanceTasks.length
-                    ? yield this.retrieveDataOwnerInfoAfterPotentialUpdate(modifiedDataOwnerAndType.dataOwner)
-                    : modifiedDataOwnerAndType.dataOwner,
-                publicKey: publicKeyHex,
-                privateKey: (0, binary_utils_1.ua2hex)((yield this.RSA.exportKey(privateKey, 'pkcs8'))),
-            };
         });
     }
     createOrUpdateAesExchangeKeysFor(cdo, decryptedAesExchangeKey, keyToEncrypt) {
@@ -1285,11 +1399,16 @@ class IccCryptoXApi {
     encryptAesKeyFor(aesKey, dataOwner, doNewPublicKey) {
         return __awaiter(this, void 0, void 0, function* () {
             const dataOwnerAllPubKeys = [doNewPublicKey].concat(yield this.getDataOwnerPublicKeys(dataOwner));
-            const encrAes = {};
-            for (const pubKey of dataOwnerAllPubKeys) {
+            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerAllPubKeys);
+        });
+    }
+    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerPubKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const encryptedAesForDataOwner = yield (0, utils_1.foldAsync)(dataOwnerPubKeys, {}, (encrAes, pubKey) => __awaiter(this, void 0, void 0, function* () {
                 encrAes[(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(pubKey, (0, binary_utils_1.hex2ua)(aesKey)));
-            }
-            return { [dataOwner.id]: encrAes };
+                return encrAes;
+            }));
+            return { [dataOwner.id]: encryptedAesForDataOwner };
         });
     }
     retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {