@icure/api 5.0.36 → 5.0.38

package/icc-x-api/icc-crypto-x-api.ts

@@ -1,2257 +0,0 @@
-/* eslint-disable */
-import { IccDeviceApi, IccHcpartyApi, IccPatientApi } from '../icc-api'
-import { AESUtils } from './crypto/AES'
-import { RSAUtils } from './crypto/RSA'
-import { ShamirClass } from './crypto/shamir'
-
-import * as _ from 'lodash'
-import {
-  Delegation,
-  Device,
-  Document,
-  EncryptedEntity,
-  EncryptedParentEntity,
-  HealthcareParty,
-  MaintenanceTask,
-  Patient,
-  PropertyStub,
-  PropertyTypeStub,
-  TypedValueObject,
-  User,
-} from '../icc-api/model/models'
-import { b2a, b64_2uas, hex2ua, string2ua, ua2hex, ua2string, ua2utf8, utf8_2ua } from './utils/binary-utils'
-import { fold, foldAsync, jwk2spki, notConcurrent, pkcs8ToJwk, spkiToJwk } from './utils'
-import { IccMaintenanceTaskXApi } from './icc-maintenance-task-x-api'
-import { StorageFacade } from './storage/StorageFacade'
-import { LocalStorageImpl } from './storage/LocalStorageImpl'
-import { KeyStorageFacade } from './storage/KeyStorageFacade'
-import { KeyStorageImpl } from './storage/KeyStorageImpl'
-
-interface DelegatorAndKeys {
-  delegatorId: string
-  key: CryptoKey
-  rawKey: string
-}
-
-type CachedDataOwner =
-  | {
-      type: 'patient'
-      dataOwner: Patient
-    }
-  | {
-      type: 'device'
-      dataOwner: Device
-    }
-  | {
-      type: 'hcp'
-      dataOwner: HealthcareParty
-    }
-
-export class IccCryptoXApi {
-  get crypto(): Crypto {
-    return this._crypto
-  }
-
-  get shamir(): ShamirClass {
-    return this._shamir
-  }
-
-  get RSA(): RSAUtils {
-    return this._RSA
-  }
-
-  get AES(): AESUtils {
-    return this._AES
-  }
-
-  get keyStorage(): KeyStorageFacade {
-    return this._keyStorage
-  }
-
-  get storage(): StorageFacade<string> {
-    return this._storage
-  }
-
-  hcPartyKeysCache: {
-    [key: string]: DelegatorAndKeys
-  } = {}
-
-  //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
-  //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
-  hcPartyKeysRequestsCache: {
-    [delegateId: string]: Promise<{ [key: string]: { [key: string]: { [key: string]: string } } }>
-  } = {}
-
-  cacheLastDeletionTimestamp: number | undefined = undefined
-
-  dataOwnerCache: { [key: string]: Promise<CachedDataOwner> } = {}
-
-  emptyHcpCache(hcpartyId: string) {
-    delete this.hcPartyKeysRequestsCache[hcpartyId]
-    delete this.dataOwnerCache[hcpartyId]
-  }
-
-  /**
-   * Gets all delegate encrypted HcParty keys of the delegate with the given `delegateHcPartyId`, and for each key the delegator id
-   * If the keys are not cached, they are retrieved from the backend.
-   *
-   * @param delegateHcPartyId The Health Care Party id
-   * @returns  \{delegatorId: delegateEncryptedHcPartyKey\}
-   */
-  private getEncryptedAesExchangeKeysForDelegate(
-    delegateHcPartyId: string
-  ): Promise<{ [key: string]: { [key: string]: { [key: string]: string } } }> {
-    return (
-      this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
-      (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.forceGetEncryptedAesExchangeKeysForDelegate(delegateHcPartyId))
-    )
-  }
-
-  private forceGetEncryptedAesExchangeKeysForDelegate(
-    delegateHcPartyId: string
-  ): Promise<{ [key: string]: { [key: string]: { [key: string]: string } } }> {
-    return Promise.all([
-      this.patientBaseApi.getPatientAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => {}),
-      this.hcpartyBaseApi.getAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => {}),
-      this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => {}),
-    ]).then(([a, b, c]) => ({ ...a, ...b, ...c }))
-  }
-
-  keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.'
-  keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.'
-  hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt'
-  hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate'
-  rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.'
-
-  private hcpartyBaseApi: IccHcpartyApi
-  private patientBaseApi: IccPatientApi
-  private deviceBaseApi: IccDeviceApi
-  private readonly _crypto: Crypto
-
-  private generateKeyConcurrencyMap: { [key: string]: PromiseLike<HealthcareParty | Patient> }
-  private rsaKeyPairs: { [pubKeyFingerprint: string]: { publicKey: CryptoKey; privateKey: CryptoKey } } = {}
-
-  private readonly _AES: AESUtils
-  private readonly _RSA: RSAUtils
-  private readonly _shamir: ShamirClass
-  private readonly _storage: StorageFacade<string>
-  private readonly _keyStorage: KeyStorageFacade
-
-  constructor(
-    host: string,
-    headers: { [key: string]: string },
-    hcpartyBaseApi: IccHcpartyApi, //Init with a hcparty x api for better performances
-    patientBaseApi: IccPatientApi,
-    deviceBaseApi: IccDeviceApi,
-    crypto: Crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : ({} as Crypto),
-    storage: StorageFacade<string>,
-    keyStorage: KeyStorageFacade
-  ) {
-    this.hcpartyBaseApi = hcpartyBaseApi
-    this.patientBaseApi = patientBaseApi
-    this.deviceBaseApi = deviceBaseApi
-    this._crypto = crypto
-    this.generateKeyConcurrencyMap = {}
-
-    this._AES = new AESUtils(crypto)
-    this._RSA = new RSAUtils(crypto)
-    this._shamir = new ShamirClass(crypto)
-    this._storage = storage
-    this._keyStorage = keyStorage
-  }
-
-  async loadAllKeysFromLocalStorage(dataOwnerId: string): Promise<void> {
-    const pubKeys = await this.getDataOwnerHexPublicKeys((await this.getDataOwner(dataOwnerId)).dataOwner)
-
-    for (const pk of pubKeys) {
-      const fingerprint = pk.slice(-32)
-      if (!this.rsaKeyPairs[fingerprint]) {
-        await this.cacheKeyPair(this.loadKeyPairNotImported(dataOwnerId, fingerprint))
-      }
-    }
-  }
-
-  async getCachedRsaKeyPairForFingerprint(
-    dataOwnerId: string,
-    pubKeyOrFingerprint: string
-  ): Promise<{ publicKey: CryptoKey; privateKey: CryptoKey }> {
-    const fingerprint = pubKeyOrFingerprint.slice(-32)
-    return this.rsaKeyPairs[fingerprint] ?? (await this.cacheKeyPair(this.loadKeyPairNotImported(dataOwnerId, fingerprint)))
-  }
-
-  async getPublicKeys() {
-    return await Object.values(this.rsaKeyPairs).reduce(async (p, rsa) => {
-      return (await p).concat([jwk2spki(await this.RSA.exportKey(rsa.publicKey, 'jwk'))])
-    }, Promise.resolve([] as string[]))
-  }
-
-  async getPublicKeysAsSpki(): Promise<string[]> {
-    return await Object.values(this.rsaKeyPairs).reduce(async (p, rsa) => {
-      return (await p).concat([ua2hex(await this.RSA.exportKey(rsa.publicKey, 'spki'))])
-    }, Promise.resolve([] as string[]))
-  }
-
-  randomUuid() {
-    return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(
-      /[018]/g,
-      (c) => (Number(c) ^ ((this._crypto.getRandomValues(new Uint8Array(1))! as Uint8Array)[0] & (15 >> (Number(c) / 4)))).toString(16) //Keep that inlined or you will loose the random
-    )
-  }
-
-  sha256(data: ArrayBuffer | Uint8Array) {
-    return this._crypto.subtle.digest('SHA-256', data)
-  }
-
-  encryptShamirRSAKey(hcp: HealthcareParty, notaries: Array<HealthcareParty>, threshold?: number): Promise<HealthcareParty> {
-    return this.loadKeyPairImported(hcp.id!).then((keyPair) =>
-      this._RSA.exportKey(keyPair.privateKey, 'pkcs8').then(async (exportedKey) => {
-        const privateKey = exportedKey as ArrayBuffer
-        const nLen = notaries.length
-        const shares = nLen == 1 ? [privateKey] : this._shamir.share(ua2hex(privateKey), nLen, threshold || nLen).map((share) => hex2ua(share))
-        const publicKeys = await this.getPublicKeys()
-
-        return _.reduce(
-          notaries,
-          (queue, notary, idx) => {
-            return queue.then(async (hcp) => {
-              const { owner: hcParty, aesExchangeKeys } = await this.getOrCreateHcPartyKeys(hcp, notary.id!)
-              const [publicKeyIdentifier, hcPartyKeys] = Object.entries(aesExchangeKeys)[0]
-
-              try {
-                const importedAESHcPartyKey = await this.decryptHcPartyKey(
-                  notary.id!,
-                  hcParty.id!,
-                  notary.id!,
-                  publicKeyIdentifier,
-                  hcPartyKeys,
-                  publicKeys
-                )
-                const encryptedShamirPartition = await this.AES.encrypt(importedAESHcPartyKey.key, shares[idx])
-
-                hcParty.privateKeyShamirPartitions = hcParty.privateKeyShamirPartitions || {}
-                hcParty.privateKeyShamirPartitions[notary.id!] = ua2hex(encryptedShamirPartition)
-              } catch (e) {
-                console.log('Error during encryptedShamirRSAKey', notary.id, e)
-              }
-              return hcParty
-            })
-          },
-          Promise.resolve(hcp)
-        )
-      })
-    )
-  }
-
-  /* Reconstructs the hcp's private key from the notaries' shamir shares and stores it in localstorage.
-  The retrieval procedure of the shares is not designed or implemented yet.  Therefore, it currently only
-  works if the private key of the notaries are stored in local storage (e.g. notaries = [hcp parent]).
-   * @param hcp : the hcp whose key we want to reconstruct
-   * @param notaries : holders of the shamir shares
-  **/
-  async decryptShamirRSAKey(hcp: HealthcareParty, notaries: Array<HealthcareParty>): Promise<void> {
-    try {
-      const publicKeys = await this.getPublicKeys()
-      const nLen = notaries.length
-      let decryptedPrivatedKey
-      if (nLen == 1) {
-        const notaryHcPartyId = notaries[0].id!
-        const encryptedAesKeyMap = await this.getEncryptedAesExchangeKeys(hcp, notaryHcPartyId)
-        const importedAESHcPartyKey = await Promise.all(
-          Object.entries(encryptedAesKeyMap).map(
-            async ([idPubKey, keysMap]) => await this.decryptHcPartyKey(notaryHcPartyId, hcp.id!, notaryHcPartyId, idPubKey, keysMap, publicKeys)
-          )
-        )
-        const cryptedPrivatedKey = hcp.privateKeyShamirPartitions![notaryHcPartyId]
-        decryptedPrivatedKey = ua2hex(
-          await this.AES.decryptSome(
-            importedAESHcPartyKey.map((k) => k.key),
-            hex2ua(cryptedPrivatedKey)
-          )
-        )
-      } else {
-        const decryptedShares: string[] = await _.reduce(
-          notaries,
-          (queue, notary) => {
-            return queue.then(async (shares: string[]) => {
-              try {
-                // TODO: now, we get the encrypted shares in db and decrypt them. This assumes that the
-                // the notaries' private keys are in localstorage. We should implement a way for the notaries to
-                // give hcp the decrypted shares without having to also share their private keys.
-                const encryptedAesKeyMap = await this.getEncryptedAesExchangeKeys(hcp, notary.id!)
-                const importedAESHcPartyKey = await Promise.all(
-                  Object.entries(encryptedAesKeyMap).map(
-                    async ([idPubKey, keysMap]) => await this.decryptHcPartyKey(notary.id!, hcp.id!, notary.id!, idPubKey, keysMap, publicKeys)
-                  )
-                )
-                const encryptedShare = hcp.privateKeyShamirPartitions![notary.id!]
-                const decryptedShamirPartition = ua2hex(
-                  await this.AES.decryptSome(
-                    importedAESHcPartyKey.map((k) => k.key),
-                    hex2ua(encryptedShare)
-                  )
-                )
-                shares.push(decryptedShamirPartition)
-              } catch (e) {
-                console.log('Error during encryptedShamirRSAKey', notary.id, e)
-              }
-              return shares
-            })
-          },
-          Promise.resolve([] as string[])
-        )
-
-        decryptedPrivatedKey = this._shamir.combine(decryptedShares)
-      }
-
-      const importedPrivateKey = await this._RSA.importKey('pkcs8', hex2ua(decryptedPrivatedKey), ['decrypt'])
-      const importedPublicKey = await this._RSA.importKey('spki', hex2ua(hcp.publicKey!), ['encrypt'])
-
-      const exportedKeyPair = await this._RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk')
-      this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${hcp.id!}`, exportedKeyPair)
-    } catch (e) {
-      console.log('Cannot decrypt shamir RSA key')
-    }
-  }
-
-  /**
-   * Gets the decryptedHcPartyKey for the given `encryptedHcPartyKey`
-   *
-   * If the decrypted key exists in the cache, retrieves it from there.
-   * Otherwise, decrypts it using the RSA key of the delegator or delegate (depending on the value of `encryptedForDelegator`)
-   *
-   * @param loggedHcPartyId The logged DataOwner id or the id of his parent
-   * @param delegatorId The id of Delegator eg, the DataOwner where this AES exchange key is stored
-   * @param delegateHcPartyId The id of the delegate : the data owner for whom this aes exchange key has been created
-   * @param publicKey The public key of the delegator : A unique aes exchange key is created for each public key of the delegator. This is the public key corresponding to the encryptedHcPartyKeys
-   * @param encryptedHcPartyKeys The encryptedHcPartyKeys to be decrypted
-   * @param publicKeys The public keys for which we might have a private key
-   *
-   * @returns - **delegatorId** the input param  `delegatorId`
-   * - **key** the decrypted `encryptedHcPartyKey`
-   */
-
-  async decryptHcPartyKey(
-    loggedHcPartyId: string,
-    delegatorId: string,
-    delegateHcPartyId: string,
-    publicKey: string,
-    encryptedHcPartyKeys: { [key: string]: string },
-    publicKeys: string[]
-  ): Promise<DelegatorAndKeys> {
-    if (!publicKeys.length) {
-      const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: no public key`
-      console.warn(reason)
-      throw new Error(reason)
-    }
-
-    const cacheKey = `${delegateHcPartyId}|${publicKey.slice(-32)}|${delegatorId}`
-    const res = this.hcPartyKeysCache[cacheKey]
-
-    if (res) {
-      return res
-    }
-
-    const result = await publicKeys.reduce(async (res, pk) => {
-      const delegatorAndKeys = await res
-      if (delegatorAndKeys) {
-        return delegatorAndKeys
-      }
-
-      const fingerprint = pk.slice(-32)
-      const keyPair = this.rsaKeyPairs[fingerprint] ?? (await this.cacheKeyPair(this.loadKeyPairNotImported(loggedHcPartyId, fingerprint)))
-      if (!keyPair) {
-        return
-      }
-
-      let encryptedHcPartyKey = encryptedHcPartyKeys[fingerprint]
-      if (!encryptedHcPartyKey) {
-        const delegate = await this.getDataOwner(delegateHcPartyId, false) //it is faster to just try to decrypt if not in cache
-        if (!delegate?.dataOwner || delegate.dataOwner.publicKey?.endsWith(fingerprint)) {
-          encryptedHcPartyKey = encryptedHcPartyKeys['']
-        } else {
-          return
-        }
-      }
-
-      try {
-        const decryptedAesExchangeKey = await this._RSA.decrypt(keyPair.privateKey, hex2ua(encryptedHcPartyKey))
-        const importedAesExchangeKey = await this._AES.importKey('raw', decryptedAesExchangeKey)
-
-        return (this.hcPartyKeysCache[cacheKey] = {
-          delegatorId: delegatorId,
-          key: importedAesExchangeKey,
-          rawKey: ua2hex(new Uint8Array(decryptedAesExchangeKey)),
-        })
-      } catch (e) {
-        const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId} for pubKey ${fingerprint}: impossible to decrypt`
-        console.log(reason)
-      }
-    }, Promise.resolve(undefined as DelegatorAndKeys | void))
-
-    const availablePublicKeys = publicKeys.filter((pk) => this.rsaKeyPairs[pk.slice(-32)])
-
-    if (!result) {
-      //Try to find another key from the transfer keys
-      const hcp = (await this.getDataOwner(loggedHcPartyId))!
-      const candidates = Object.entries(hcp.dataOwner.transferKeys ?? {})
-        .filter(([fp, _]) => availablePublicKeys.some((pk) => pk.slice(-32) === fp.slice(-32))) // only keep keys that we will be able to decrypt
-        .flatMap(([pk, keys]) => Object.entries(keys).map(([k, v]) => [pk, k, v]))
-        .filter(([_, k]) => !publicKeys.some((apk) => apk.slice(-32) === k.slice(-32)))
-      if (candidates.length) {
-        const newPublicKeys = await candidates.reduce(async (p, [decryptionKeyFingerprint, privateKeyFingerprint, encryptedPrivateKey]) => {
-          const newKeys = await p
-          const aesExchangeKeys = Object.entries(hcp.dataOwner.aesExchangeKeys!).find(
-            ([fp, _]) => fp.slice(-32) === privateKeyFingerprint.slice(-32)
-          )?.[1][loggedHcPartyId]
-          if (aesExchangeKeys) {
-            const encryptedAesExchangeKey = Object.entries(aesExchangeKeys).find(
-              ([fp, _]) => fp.slice(-32) === decryptionKeyFingerprint.slice(-32)
-            )?.[1]
-            if (encryptedAesExchangeKey) {
-              const keyPair = this.rsaKeyPairs[decryptionKeyFingerprint.slice(-32)]
-              if (!keyPair) {
-                return newKeys
-              }
-              const decryptedAesExchangeKey = await this._RSA.decrypt(keyPair.privateKey, hex2ua(encryptedAesExchangeKey))
-              const importedAesExchangeKey = await this._AES.importKey('raw', decryptedAesExchangeKey)
-
-              const decryptedPrivateKey = await this._AES.decrypt(importedAesExchangeKey, hex2ua(encryptedPrivateKey))
-
-              const newPublicKey = Object.keys(hcp.dataOwner.aesExchangeKeys!).find((fp) => fp.slice(-32) === privateKeyFingerprint.slice(-32))!
-              await this.cacheKeyPair({
-                publicKey: spkiToJwk(hex2ua(newPublicKey)),
-                privateKey: pkcs8ToJwk(decryptedPrivateKey),
-              })
-
-              return newKeys.concat([newPublicKey])
-            }
-          }
-          return newKeys
-        }, Promise.resolve([] as string[]))
-
-        if (newPublicKeys.length) {
-          return await this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, newPublicKeys)
-        }
-      }
-
-      const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: impossible to decrypt. No private key was found or could be used to decrypt the aes exchange keys`
-      console.log(reason)
-      throw new Error(reason)
-    }
-
-    return result
-  }
-
-  /**
-   * Cache the RSA private/public key pair for the HcP with the given id `hcPartyKeyOwner`
-   */
-  cacheKeyPair(keyPairInJwk: { publicKey: JsonWebKey; privateKey: JsonWebKey }): Promise<{ publicKey: CryptoKey; privateKey: CryptoKey }> {
-    return this._RSA.importKeyPair('jwk', keyPairInJwk.privateKey, 'jwk', keyPairInJwk.publicKey).then((importedKeyPair) => {
-      const pk = jwk2spki(keyPairInJwk.publicKey)
-      return (this.rsaKeyPairs[pk.slice(-32)] = importedKeyPair)
-    })
-  }
-
-  /**
-   * Gets the secret ID (SFKs) that should be used in the prescribed context (confidential or not) from decrypted SPKs of the given `parent`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-   * @param parent :the object of which delegations (SPKs) to decrypt
-   * @param hcpartyId :the id of the delegate HcP
-   * @param confidential :weather the key is going to be used for a confidential piece or data or not
-   * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-   * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
-   */
-  async extractPreferredSfk(parent: EncryptedParentEntity, hcpartyId: string, confidential: boolean) {
-    const secretForeignKeys = await this.extractSFKsHierarchyFromDelegations(parent, hcpartyId)
-    const keys = secretForeignKeys
-      .filter(({ extractedKeys }) => extractedKeys.length > 0)
-      .filter((x, idx) => (confidential ? x.hcpartyId === hcpartyId : idx === 0))[0]
-
-    return (
-      (keys &&
-        (confidential
-          ? keys.extractedKeys.find(
-              (k) => !secretForeignKeys.some(({ extractedKeys, hcpartyId: parentHcpId }) => hcpartyId !== parentHcpId && extractedKeys.includes(k))
-            )
-          : keys.extractedKeys[0])) ||
-      undefined
-    )
-  }
-
-  /**
-   * Gets an array of decrypted HcPartyKeys, shared between the delegate with ID `delegateHcPartyId` and the delegators in `delegatorsHcPartyIdsSet`
-   *
-   * 1. Get the keys for the delegateHealthCareParty (cache/backend).
-   * 2. For each key in the delegators, decrypt it with the delegate's private key
-   * 3. Filter out undefined keys and return them
-   *
-   * @param delegatorsHcPartyIdsSet array of delegator HcP IDs that could have delegated something to the HcP with ID `delegateHcPartyId`
-   * @param delegateHcPartyId the HcP for which the HcPs with IDs in `delegatorsHcPartyIdsSet` could have delegated something
-   * @param minCacheDurationInSeconds The minimum cache duration
-   * @returns - **delegatorId** : the id of the delegator HcP that shares the **key** with the `delegateHcPartyId`
-   *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `delegateHcPartyId`
-   */
-  async decryptAndImportAesHcPartyKeysForDelegators(
-    delegatorsHcPartyIdsSet: Array<string>,
-    delegateHcPartyId: string,
-    minCacheDurationInSeconds: number = 60
-  ): Promise<Array<DelegatorAndKeys>> {
-    const aesExchangeKeys = await this.getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId).then(
-      async (delegatorIdsWithDelegateEncryptedHcPartyKeys: { [key: string]: { [key: string]: { [key: string]: string } } }) => {
-        // [key: delegatorId] = delegateEncryptedHcPartyKey
-        // For each delegatorId, obtain the AES key (decrypted HcParty Key) shared with the delegate, decrypted by the delegate
-        return (
-          await Promise.all(
-            delegatorsHcPartyIdsSet.map(async (delegatorId: string) => {
-              const encryptedHcPartyKeysForPubKeyFingerprint = delegatorIdsWithDelegateEncryptedHcPartyKeys[delegatorId]
-              if (!encryptedHcPartyKeysForPubKeyFingerprint) {
-                return [] as DelegatorAndKeys[]
-              }
-              const decryptedKeys = await Promise.all(
-                Object.entries(encryptedHcPartyKeysForPubKeyFingerprint).map(async ([delegatorPubKeyFinerprint, encryptedAesExchangeKeys]) => {
-                  try {
-                    return await this.decryptHcPartyKey(
-                      delegateHcPartyId,
-                      delegatorId,
-                      delegateHcPartyId,
-                      delegatorPubKeyFinerprint,
-                      encryptedAesExchangeKeys,
-                      Object.keys(this.rsaKeyPairs)
-                    )
-                  } catch (e) {
-                    console.log(`failed to decrypt hcPartyKey from ${delegatorId} to ${delegateHcPartyId}`)
-                    return
-                  }
-                })
-              )
-              return decryptedKeys.filter((x) => !!x) as DelegatorAndKeys[]
-            })
-          )
-        ).reduce((acc, x) => [...acc, ...x], [])
-      }
-    )
-
-    if (aesExchangeKeys.length > 0) {
-      return aesExchangeKeys
-    }
-
-    const nowTimestamp = +new Date()
-    if (!this.cacheLastDeletionTimestamp || (nowTimestamp - this.cacheLastDeletionTimestamp) / 1000 >= minCacheDurationInSeconds) {
-      delete this.hcPartyKeysRequestsCache[delegateHcPartyId]
-      this.cacheLastDeletionTimestamp = nowTimestamp
-      return this.decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds)
-    }
-
-    return []
-  }
-
-  /**
-   * Gets an array of decrypted HcPartyKeys from the given `delegations`, that are shared with / can be decrypted by the HcP with the given `healthcarePartyId` (or by its parents when `fallbackOnParent` is true)
-   *
-   * 1. Checks whether the delegations' object has a delegation for the
-   * given healthCarePartyId.
-   * 2. Enumerates all the delegators (delegation.owner) present in
-   * the delegations.
-   * 3. Decrypt's delegators' keys and returns them.
-   *
-   * @param dataOwnerId : the id of the delegate HCP
-   * @param delegations : delegations (can be SPKs, CFKs, EKs) for all delegates
-   * @param fallbackOnParent  default true; use parent's healthCarePartyId in case there's no delegation for the `healthcarePartyId`
-   * @returns  - **delegatorId** : the id of the delegator HcP that shares the **key** with the `healthcarePartyId`
-   *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `healthcarePartyId`
-   */
-  async getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(
-    dataOwnerId: string,
-    delegations: { [key: string]: Array<Delegation> },
-    fallbackOnParent = true
-  ): Promise<Array<DelegatorAndKeys>> {
-    const delegationsArray = delegations[dataOwnerId] ?? []
-
-    if (!delegationsArray.length && fallbackOnParent) {
-      const { dataOwner: hcp } = await this.getDataOwner(dataOwnerId)
-      return (hcp as any).parentId
-        ? await this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations((hcp as any).parentId, delegations)
-        : []
-    } else {
-      const delegatorIds = new Set<string>()
-      delegationsArray.forEach((del) => delegatorIds.add(del.owner!))
-      return this.decryptAndImportAesHcPartyKeysForDelegators(Array.from(delegatorIds), dataOwnerId)
-    }
-  }
-
-  /**
-   * Retrieve the owner HealthCareParty key and use it to encrypt
-   * both the delegations (createdObject.id) and the cryptedForeignKeys
-   * (parentObject.id), and returns them in an object.
-   */
-  async initObjectDelegations(
-    createdObject: any,
-    parentObject: any,
-    ownerId: string,
-    secretForeignKeyOfParent: string | null
-  ): Promise<{
-    owner: HealthcareParty | Device | Patient
-    delegations: any
-    cryptedForeignKeys: any
-    secretForeignKeys: any[]
-    secretId: string
-  }> {
-    const publicKeys = await this.getPublicKeys()
-
-    this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initObjectDelegations', arguments)
-
-    if (parentObject) this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject.id, 'initObjectDelegations', arguments)
-
-    const secretId = this.randomUuid()
-    return this.getDataOwner(ownerId).then(async ({ dataOwner: owner }) => {
-      const { owner: modifiedOwner, aesExchangeKeys } = await this.getOrCreateHcPartyKeys(owner, ownerId)
-      const importedAESHcPartyKey = await this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys)
-
-      const encryptedDelegation = await this._AES.encrypt(
-        importedAESHcPartyKey.key,
-        string2ua(createdObject.id + ':' + secretId).buffer as ArrayBuffer,
-        importedAESHcPartyKey.rawKey
-      )
-      const encryptedSecretForeignKey = parentObject
-        ? await this._AES.encrypt(
-            importedAESHcPartyKey.key,
-            string2ua(createdObject.id + ':' + parentObject.id).buffer as ArrayBuffer,
-            importedAESHcPartyKey.rawKey
-          )
-        : undefined
-
-      return {
-        owner: modifiedOwner,
-        delegations: _.fromPairs([
-          [
-            ownerId,
-            [
-              {
-                owner: ownerId,
-                delegatedTo: ownerId,
-                key: ua2hex(encryptedDelegation!),
-              },
-            ],
-          ],
-        ]),
-        cryptedForeignKeys:
-          (encryptedSecretForeignKey
-            ? _.fromPairs([
-                [
-                  ownerId,
-                  [
-                    {
-                      owner: ownerId,
-                      delegatedTo: ownerId,
-                      key: ua2hex(encryptedSecretForeignKey!),
-                    },
-                  ],
-                ],
-              ])
-            : {}) || {},
-        secretForeignKeys: (secretForeignKeyOfParent && [secretForeignKeyOfParent]) || [],
-        secretId: secretId,
-      }
-    })
-  }
-
-  private async decryptAnyAesExchangeKeyForOwner(
-    aesExchangeKeys: { [p: string]: { [p: string]: string } },
-    loggedHcPartyId: string,
-    delegatorId: string,
-    delegateHcPartyId: string,
-    publicKeys: string[]
-  ) {
-    const importedAESHcPartyKey = await Object.entries(aesExchangeKeys).reduce(async (acc, [publicKeyIdentifier, hcPartyKeys]) => {
-      const accValue = await acc
-      if (accValue) {
-        return accValue
-      }
-      try {
-        return await this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKeyIdentifier, hcPartyKeys, publicKeys)
-      } catch (e) {
-        return undefined
-      }
-    }, Promise.resolve(undefined as DelegatorAndKeys | undefined))
-
-    if (!importedAESHcPartyKey) {
-      throw new Error(`No hcParty key can be decrypted from ${delegatorId} to ${delegateHcPartyId} using currently available private keys`)
-    }
-    return importedAESHcPartyKey
-  }
-
-  /**
-   * Gets updated instances of SPKs and CKFs for the child object `modifiedObject`.
-   * These updated SPKs and CKFs contain new SPKs/CFKs to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
-   *
-   * 1. if `secretIdOfModifiedObject` is not provided, the method will throw an exception; this `secretIdOfModifiedObject` is used to generate a new delegation (SPK) in step 3;
-   *  the `secretIdOfModifiedObject` is returned, unmodified, as `secretId`
-   * 2. if the owner (delegator) did not perform a delegation to the delegate, then this HcP delegation (creation of a new HcPKey) is performed now
-   * 3. creates a new delegation (Secret Primary Keys) on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
-   * 4. if `parentObject` != null, creates a new CFK on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
-   * 5. this new delegation (from step 3) is added to the list of existing delegations (Secret Primary Keys) on the `modifiedObject` for the delegate given by `delegateId`
-   * 6. if the CFK (from step 4) can be created, this new CFK is added to the list of existing CFKs on the `modifiedObject` for the delegate given by `delegateId`
-   * 7. then some duplicates delegations (SPKs) and CKFs are removed
-   *
-   * @param modifiedObject : the object of which SPKs and CFKs will be cloned, the clones will be modified and then used as returned values ; it's a 'child' of `parentObject`; will NOT be mutated
-   * @param parentObject : will NOT be mutated
-   * @param ownerId : the HcP id of the delegator
-   * @param delegateId : the HcP id of the delegate
-   * @param secretIdOfModifiedObject : the secret id used in the child object to generate its SPK
-   * @returns - **delegations**  existing delegations (SPKs) of the `modifiedObject`, appended with results from step 5
-   * - **cryptedForeignKeys** existing CFKs of the `modifiedObject`, appended with results from steps 6
-   * - **secretId** which is the given input parameter `secretIdOfModifiedObject`
-   */
-
-  extendedDelegationsAndCryptedForeignKeys<T extends EncryptedEntity, P extends EncryptedParentEntity>(
-    //TODO: suggested name: getExtendedChildObjectSPKandCFKwithDelegationFromDelegatorToDelegate
-    modifiedObject: T,
-    parentObject: P | null,
-    ownerId: string,
-    delegateId: string,
-    secretIdOfModifiedObject: string | null
-  ): Promise<{
-    modifiedObject: T
-    delegations: { [key: string]: Array<Delegation> }
-    cryptedForeignKeys: { [key: string]: Array<Delegation> }
-    secretId: string | null //TODO: why input parameter secretIdOfModifiedObject is returned?
-  }> {
-    this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments) //modifiedObject should never be null
-
-    if (parentObject)
-      this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject?.id, 'extendedDelegationsAndCryptedForeignKeys', arguments)
-
-    this.throwDetailedExceptionForInvalidParameter(
-      'secretIdOfModifiedObject',
-      secretIdOfModifiedObject,
-      'extendedDelegationsAndCryptedForeignKeys',
-      arguments
-    )
-
-    return this.getDataOwner(ownerId)
-      .then(async ({ dataOwner: owner }) => {
-        const publicKeys = await this.getPublicKeys()
-        const { owner: modifiedOwner, aesExchangeKeys } = await this.getOrCreateHcPartyKeys(owner, delegateId)
-        const importedAESHcPartyKey = await this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, delegateId, ownerId, publicKeys)
-
-        modifiedObject = modifiedObject?.id === owner.id ? (modifiedOwner as T) : modifiedObject
-
-        return {
-          previousDecryptedDelegations: await Promise.all(
-            ((modifiedObject.delegations || {})[delegateId] || []).map(
-              (d: Delegation) =>
-                (d.key &&
-                  d.owner === ownerId &&
-                  this._AES.decrypt(importedAESHcPartyKey.key, hex2ua(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                    console.log(
-                      `Cannot decrypt delegation from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`,
-                      modifiedObject
-                    )
-                    return Promise.resolve()
-                  })) ||
-                Promise.resolve()
-            ) as Array<Promise<ArrayBuffer>>
-          ),
-
-          previousDecryptedCryptedForeignKeys: await Promise.all(
-            ((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map(
-              (d: Delegation) =>
-                (d.key &&
-                  d.owner === ownerId &&
-                  this._AES.decrypt(importedAESHcPartyKey.key, hex2ua(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                    console.log(
-                      `Cannot decrypt cryptedForeignKeys from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`,
-                      modifiedObject
-                    )
-                    return Promise.resolve()
-                  })) ||
-                Promise.resolve()
-            ) as Array<Promise<ArrayBuffer>>
-          ),
-
-          cryptedDelegation: await this._AES.encrypt(
-            importedAESHcPartyKey.key,
-            string2ua(modifiedObject.id + ':' + secretIdOfModifiedObject!).buffer as ArrayBuffer,
-            importedAESHcPartyKey.rawKey
-          ),
-
-          cryptedForeignKey: parentObject
-            ? await this._AES.encrypt(
-                importedAESHcPartyKey.key,
-                string2ua(modifiedObject.id + ':' + parentObject.id).buffer as ArrayBuffer,
-                importedAESHcPartyKey.rawKey
-              )
-            : undefined,
-        }
-      })
-      .then(({ previousDecryptedDelegations, previousDecryptedCryptedForeignKeys, cryptedDelegation, cryptedForeignKey }) => {
-        //try to limit the extent of the modifications to the delegations by preserving the redundant delegation already present and removing duplicates
-        //For delegate delegateId, we create:
-        // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for each existing delegation and the new key concatenated
-        // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
-        // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
-        const delegationCryptedDecrypted = (
-          _.merge(
-            ((modifiedObject.delegations || {})[delegateId] || []).map((d: Delegation) => ({
-              d,
-            })),
-            (previousDecryptedDelegations || []).map((dd) => (dd ? ua2string(dd) : null)).map((k) => ({ k }))
-          ) as { d: Delegation; k: string }[]
-        )
-          .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-          .map(({ d, k }) => ({
-            d,
-            k: k || this.randomUuid(),
-          })) // Use some unique id that ensures the delegation not created by us are going to be held
-          .concat([
-            {
-              d: {
-                owner: ownerId,
-                delegatedTo: delegateId,
-                key: ua2hex(cryptedDelegation!),
-              },
-              k: modifiedObject.id + ':' + secretIdOfModifiedObject!,
-            },
-          ])
-
-        const allDelegations = _.cloneDeep(modifiedObject.delegations || {})
-
-        //Only keep one version of the decrypted key
-        allDelegations[delegateId] = _.uniqBy(delegationCryptedDecrypted, (x: any) => x.k).map((x: any) => x.d)
-
-        const cryptedForeignKeysCryptedDecrypted = (
-          _.merge(
-            ((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d: Delegation) => ({
-              d,
-            })),
-            (previousDecryptedCryptedForeignKeys || []).map((dd) => (dd ? ua2string(dd) : null)).map((k) => ({ k }))
-          ) as { d: Delegation; k: string }[]
-        )
-          .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-          .map(({ d, k }: { d: Delegation; k: string }) => ({
-            d,
-            k: k || this.randomUuid(),
-          })) // Use some unique id that ensures the delegation not created by us are going to be held
-          .concat(
-            cryptedForeignKey
-              ? [
-                  {
-                    d: {
-                      owner: ownerId,
-                      delegatedTo: delegateId,
-                      key: ua2hex(cryptedForeignKey),
-                    },
-                    k: modifiedObject.id + ':' + parentObject?.id,
-                  },
-                ]
-              : []
-          )
-
-        const allCryptedForeignKeys = _.cloneDeep(modifiedObject.cryptedForeignKeys || {})
-        if (cryptedForeignKeysCryptedDecrypted.length > 0) {
-          allCryptedForeignKeys[delegateId] = _.uniqBy(cryptedForeignKeysCryptedDecrypted, (x: any) => x.k).map((x: any) => x.d)
-        }
-
-        return {
-          modifiedObject,
-          delegations: allDelegations,
-          cryptedForeignKeys: allCryptedForeignKeys,
-          secretId: secretIdOfModifiedObject,
-        }
-      })
-  }
-
-  // What we need is to find aes exchange keys on the owner ! Even just with whom he shared information, we don't care about aes exchange keys
-  private async _getDelegateIdsOf(owner: HealthcareParty | Patient | Device): Promise<string[]> {
-    const mapOfAesExchKeysDelegates = Object.entries(owner.aesExchangeKeys ?? {}).reduce(
-      (map, [, aesExchKeys]) => map.concat(Object.keys(aesExchKeys).filter((delegateId) => !map.includes(delegateId))),
-      [] as string[]
-    )
-
-    return owner.hcPartyKeys
-      ? mapOfAesExchKeysDelegates.concat(Object.keys(owner.hcPartyKeys).filter((delegateId) => !mapOfAesExchKeysDelegates.includes(delegateId)))
-      : mapOfAesExchKeysDelegates
-  }
-
-  async getEncryptedAesExchangeKeys(
-    owner: HealthcareParty | Patient | Device,
-    delegateId: string
-  ): Promise<{ [pubKeyIdentifier: string]: { [pubKeyFingerprint: string]: string } }> {
-    const publicKeys = await this.getPublicKeys()
-    const mapOfAesExchangeKeys = Object.entries(owner.aesExchangeKeys ?? {})
-      .filter((e) => e[1][delegateId] && Object.keys(e[1][delegateId]).some((k1) => publicKeys.some((pk) => pk.endsWith(k1))))
-      .reduce((map, e) => {
-        const candidates = Object.entries(e[1][delegateId]) //[fingerprint of delegate pub key, key], [fingerprint of owner pub key, key]
-        const [publicKeyFingerprint, encryptedAesExchangeKey] = candidates[candidates.findIndex(([k, v]) => publicKeys.some((pk) => pk.endsWith(k)))]
-        return { ...map, [e[0]]: { [publicKeyFingerprint]: encryptedAesExchangeKey } }
-      }, {} as { [pubKeyIdentifier: string]: { [pubKeyFingerprint: string]: string } })
-
-    if (!owner.publicKey || mapOfAesExchangeKeys[owner.publicKey] || !owner.hcPartyKeys?.[delegateId]) {
-      return mapOfAesExchangeKeys
-    }
-    const delegate = (await this.getDataOwner(delegateId)).dataOwner
-    if (delegate.publicKey && publicKeys.includes(delegate.publicKey)) {
-      return {
-        ...mapOfAesExchangeKeys,
-        [owner.publicKey]: { [(await this.getDataOwner(delegateId)).dataOwner.publicKey?.slice(-32)!]: owner.hcPartyKeys[delegateId][1] },
-      }
-    } else if (publicKeys.includes(owner.publicKey)) {
-      return { ...mapOfAesExchangeKeys, [owner.publicKey]: { [owner.publicKey.slice(-32)]: owner.hcPartyKeys[delegateId][0] } }
-    }
-    return mapOfAesExchangeKeys
-  }
-
-  async getOrCreateHcPartyKeys(
-    owner: HealthcareParty | Patient | Device,
-    delegateId: string
-  ): Promise<{
-    owner: HealthcareParty | Patient | Device
-    aesExchangeKeys: { [pubKeyIdentifier: string]: { [pubKeyFingerprint: string]: string } }
-  }> {
-    const aesExchangeKeys = await this.getEncryptedAesExchangeKeys(owner, delegateId)
-    if (Object.keys(aesExchangeKeys).length) {
-      return { owner, aesExchangeKeys }
-    }
-
-    const modifiedOwner = await this.generateKeyForDelegate(owner.id!, delegateId)
-    return { owner: modifiedOwner, aesExchangeKeys: await this.getEncryptedAesExchangeKeys(modifiedOwner, delegateId) }
-  }
-
-  /**
-   * Retrieve the owners HealthCareParty key, decrypt it, and
-   * use it to encrypt & initialize the "encryptionKeys" object
-   * and return it.
-   * @param createdObject
-   * @param ownerId
-   */
-  initEncryptionKeys(
-    createdObject: any,
-    ownerId: string
-  ): Promise<{
-    encryptionKeys: any
-    secretId: string
-  }> {
-    this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initEncryptionKeys', arguments)
-
-    const secretId = this.randomUuid()
-    return this.getDataOwner(ownerId).then(async ({ dataOwner: owner }) => {
-      const publicKeys = await this.getPublicKeys()
-      const { owner: modifiedOwner, aesExchangeKeys } = await this.getOrCreateHcPartyKeys(owner, ownerId)
-      const importedAESHcPartyKey = await this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys)
-      const encryptedEncryptionKeys = await this._AES.encrypt(
-        importedAESHcPartyKey.key,
-        string2ua(createdObject.id + ':' + secretId),
-        importedAESHcPartyKey.rawKey
-      )
-
-      return {
-        encryptionKeys: _.fromPairs([
-          [
-            ownerId,
-            [
-              {
-                owner: ownerId,
-                delegatedTo: ownerId,
-                key: ua2hex(encryptedEncryptionKeys),
-              },
-            ],
-          ],
-        ]),
-        secretId: secretId,
-      }
-    })
-  }
-
-  /**
-   * Gets an updated instance of the EKs of `modifiedObject`.
-   * The updated EKs contain a new EK to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`.
-   * @param modifiedObject : the object of which EKs will be cloned, the clone will be used to append the new EK, and then used as return value; will NOT be mutated
-   * @param ownerId : delegator HcP id
-   * @param delegateId : delegate HcP id
-   * @param secretEncryptionKeyOfObject : secret Id for the EK (Content Encryption Key)
-   * @returns
-   *   - **encryptionKeys** existing EKs of the `modifiedObject`, appended with a new EK item (owner: `ownerId`, delegatedTo: `delegateId`, encrypted key with secretId:
-   *     `secretEncryptionKeyOfObject` )
-   *   - **secretId** which is the given input parameter `secretEncryptionKeyOfObject`
-   */
-  async appendEncryptionKeys<T extends EncryptedEntity>(
-    //TODO: suggested name: getExtendedEKwithDelegationFromDelegatorToDelegate
-    modifiedObject: T,
-    ownerId: string,
-    delegateId: string,
-    secretEncryptionKeyOfObject: string
-  ): Promise<{
-    modifiedObject: T
-    encryptionKeys: { [key: string]: Array<Delegation> }
-    secretId: string | null //secretEncryptionKeyOfObject is returned to avoid the need for a new decryption when chaining calls
-  }> {
-    this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'appendEncryptionKeys', arguments) //modifiedObject should never be null
-
-    this.throwDetailedExceptionForInvalidParameter('secretEncryptionKeyOfObject', secretEncryptionKeyOfObject, 'appendEncryptionKeys', arguments)
-
-    const owner = (await this.getDataOwner(ownerId)).dataOwner
-    const publicKeys = await this.getPublicKeys()
-    const { owner: modifiedOwner, aesExchangeKeys } = await this.getOrCreateHcPartyKeys(owner, delegateId)
-    modifiedObject = modifiedObject?.id === owner.id ? (modifiedOwner as T) : modifiedObject
-    const importedAESHcPartyKey = await this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, delegateId, publicKeys)
-    const previousDecryptedEncryptionKeys = await Promise.all(
-      ((modifiedObject.encryptionKeys || {})[delegateId] || []).map(
-        (d: Delegation) =>
-          (d.key &&
-            d.owner === ownerId &&
-            this._AES.decrypt(importedAESHcPartyKey.key, hex2ua(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-              console.log(
-                `Cannot decrypt encryption key from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`,
-                modifiedObject
-              )
-              return Promise.resolve()
-            })) ||
-          Promise.resolve()
-      ) as Array<Promise<ArrayBuffer>>
-    )
-    const encryptedEncryptionKey = await this._AES.encrypt(
-      importedAESHcPartyKey.key,
-      string2ua(modifiedObject.id + ':' + secretEncryptionKeyOfObject)
-    )
-    //try to limit the extent of the modifications to the delegations by preserving the redundant encryption keys already present and removing duplicates
-    //For delegate delegateId, we create:
-    // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for the existing encryption keys and the new key concatenated
-    // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
-    // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
-    const encryptionKeysCryptedDecrypted = (
-      _.merge(
-        ((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d: Delegation) => ({
-          d,
-        })),
-        (previousDecryptedEncryptionKeys || []).map((dd) => (dd ? ua2string(dd) : null)).map((k) => ({ k }))
-      ) as { d: Delegation; k: string }[]
-    )
-      .filter(({ d, k }: { d: Delegation; k: string }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-      .map(({ d, k }: { d: Delegation; k: string }) => ({ d, k: k || this.randomUuid() }))
-      .concat([
-        {
-          d: {
-            owner: ownerId,
-            delegatedTo: delegateId,
-            key: ua2hex(encryptedEncryptionKey),
-          },
-          k: modifiedObject.id + ':' + secretEncryptionKeyOfObject!,
-        },
-      ])
-
-    const allEncryptionKeys = _.cloneDeep(modifiedObject.encryptionKeys || {})
-    allEncryptionKeys[delegateId] = _.uniqBy(encryptionKeysCryptedDecrypted, (x: any) => x.k).map((x: any) => x.d)
-
-    return {
-      modifiedObject: modifiedObject,
-      encryptionKeys: allEncryptionKeys,
-      secretId: secretEncryptionKeyOfObject,
-    }
-  }
-
-  /**
-   * Gets an updated `child` object that will have its SPKs, CFKs, KSs updated to include delegations from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
-   * The SFKs of `child` are not updated, so this method assumes this is not the initial delegation on the `child` object
-   * The method also performs some deduplication of all types of delegations.
-   * @param parent : the parent object of `child`; will NOT be mutated
-   * @param child : the object that will be mutated and returned
-   * @param ownerId delegator HcP id
-   * @param delegateId delegate HcP id
-   * @param secretDelegationKey  the secret Id used in the child object to generate the SPK
-   * @param secretEncryptionKey  the secret Id used in the child object to generate the EK (Content Encryption Key)
-   * @returns - an updated `child` object that will contain updated SPKs, CFKs, EKs
-   *  */
-
-  async addDelegationsAndEncryptionKeys<T extends EncryptedEntity>(
-    //TODO: suggested name: updateChildGenericDelegationsFromDelegatorToDelegate
-    parent: EncryptedParentEntity | null,
-    child: T,
-    ownerId: string,
-    delegateId: string,
-    secretDelegationKey: string | null,
-    secretEncryptionKey: string | null
-  ): Promise<T> {
-    if (parent) this.throwDetailedExceptionForInvalidParameter('parent.id', parent.id, 'addDelegationsAndEncryptionKeys', arguments)
-
-    this.throwDetailedExceptionForInvalidParameter('child.id', child.id, 'addDelegationsAndEncryptionKeys', arguments)
-
-    const extendedChildObjectSPKsAndCFKs = secretDelegationKey
-      ? await this.extendedDelegationsAndCryptedForeignKeys(child, parent, ownerId, delegateId, secretDelegationKey)
-      : { modifiedObject: child, delegations: {}, cryptedForeignKeys: {}, secretId: null }
-
-    const extendedChildObjectEKs = secretEncryptionKey
-      ? await this.appendEncryptionKeys(extendedChildObjectSPKsAndCFKs.modifiedObject, ownerId, delegateId, secretEncryptionKey)
-      : { encryptionKeys: {}, modifiedObject: extendedChildObjectSPKsAndCFKs.modifiedObject }
-
-    const latestObject = extendedChildObjectEKs.modifiedObject
-
-    return _.assign(latestObject, {
-      // Conservative version ... We might want to be more aggressive with the deduplication of keys
-      // For each delegate, we are going to concatenate to the src (the new delegations), the object in dest (the current delegations)
-      // for which we do not find an equivalent delegation (same delegator, same delegate)
-      delegations: _.assignWith(child.delegations, extendedChildObjectSPKsAndCFKs.delegations, (dest, src) =>
-        (src || []).concat(_.filter(dest, (d: Delegation) => !src.some((s: Delegation) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))
-      ),
-      cryptedForeignKeys: _.assignWith(child.cryptedForeignKeys, extendedChildObjectSPKsAndCFKs.cryptedForeignKeys, (dest, src) =>
-        (src || []).concat(_.filter(dest, (d: Delegation) => !src.some((s: Delegation) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))
-      ),
-      encryptionKeys: _.assignWith(child.encryptionKeys, extendedChildObjectEKs.encryptionKeys, (dest, src) =>
-        (src || []).concat(_.filter(dest, (d: Delegation) => !src.some((s: Delegation) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))
-      ),
-    })
-  }
-
-  /**
-   * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-   * @param document : the object of which delegations (SPKs) to decrypt
-   * @param hcpartyId : the id of the delegate HcP
-   * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-   * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
-   */
-  //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent; is this ok?
-  extractDelegationsSFKs(
-    //TODO: suggested name: getSecretIDsSPKofHcpAndParentsFromDocument
-    document: EncryptedEntity | null,
-    hcpartyId?: string
-  ): Promise<{ extractedKeys: Array<string>; hcpartyId?: string }> {
-    if (!document || !hcpartyId) {
-      return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId }) //TODO: thow exception instead?
-    }
-    const delegationsForAllDelegates = document.delegations
-    if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
-      console.log(`There is no delegation in document (${document.id})`)
-      return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId })
-    }
-    return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id!, delegationsForAllDelegates)
-  }
-
-  /**
-   * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-   * @param document : the object of which delegations (SPKs) to decrypt
-   * @param hcpartyId : the id of the delegate HcP
-   * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-   * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
-   */
-  extractSFKsHierarchyFromDelegations(
-    document: EncryptedEntity | null,
-    hcpartyId?: string
-  ): Promise<Array<{ hcpartyId: string; extractedKeys: Array<string> }>> {
-    if (!document || !hcpartyId) {
-      return Promise.resolve([])
-    }
-    const delegationsForAllDelegates = document.delegations
-    if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
-      console.log(`There is no delegation in document (${document.id})`)
-      return Promise.resolve([])
-    }
-    return this.extractKeysHierarchyFromDelegationLikes(hcpartyId, document.id!, delegationsForAllDelegates)
-  }
-
-  // noinspection JSUnusedGlobalSymbols
-
-  extractCryptedFKs(
-    //TODO: suggested name: getSecretIDsCFKofHcpAndParentsFromDocument
-    document: EncryptedEntity | null,
-    hcpartyId: string
-  ): Promise<{ extractedKeys: Array<string>; hcpartyId: string }> {
-    if (!document || !document.cryptedForeignKeys) {
-      return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId })
-    }
-    const cfksForAllDelegates = document.cryptedForeignKeys
-    if (!cfksForAllDelegates || !Object.keys(cfksForAllDelegates).length) {
-      console.log(`There is no cryptedForeignKeys in document (${document.id})`)
-      return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId })
-    }
-    return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id!, cfksForAllDelegates)
-  }
-
-  extractEncryptionsSKs(
-    //TODO: suggested name: getSecretIDsEKofHcpAndParentsFromDocument
-    document: EncryptedEntity,
-    hcpartyId: string
-  ): Promise<{ extractedKeys: Array<string>; hcpartyId: string }> {
-    if (!document.encryptionKeys) {
-      return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId })
-    }
-    const eckeysForAllDelegates = document.encryptionKeys
-    if (!eckeysForAllDelegates || !Object.keys(eckeysForAllDelegates).length) {
-      return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId })
-    }
-    return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id!, eckeysForAllDelegates)
-  }
-
-  extractDelegationsSFKsAndEncryptionSKs(ety: EncryptedEntity, ownerId: string) {
-    const delegationsSfksOwnerPromise = this.extractDelegationsSFKs(ety, ownerId).then((xks) => xks.extractedKeys) //Will climb up hierarchy
-    const encryptionKeysOwnerPromise = this.extractEncryptionsSKs(ety, ownerId).then((xks) => xks.extractedKeys) //Will climb up hierarchy
-
-    return Promise.all([delegationsSfksOwnerPromise, encryptionKeysOwnerPromise])
-  }
-
-  /**
-   * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
-   * 1. Get HealthCareParty from it's Id.
-   * 2. Decrypt the keys of the given HCP.
-   * 3. Decrypt the parent's key if it has parent.
-   * 4. Return the decrypted key corresponding to the Health Care Party.
-   * @param hcpartyId : the id of the delegate HcP (including its parents) for which to decrypt `extractedKeys`
-   * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
-   * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
-   * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both HCP with given `hcpartyId` and its parents; can contain duplicates
-   * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HCP id of the top parent in the hierarchy  (even if that parent has no delegations)
-   */
-  //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent
-  async extractKeysHierarchyFromDelegationLikes(
-    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
-    hcpartyId: string,
-    objectId: string,
-    delegations: { [key: string]: Array<Delegation> }
-  ): Promise<Array<{ hcpartyId: string; extractedKeys: Array<string> }>> {
-    const { dataOwner: hcp } = await this.getDataOwner(hcpartyId)
-    const extractedKeys = []
-    if (delegations[hcpartyId]?.length) {
-      const decryptedAndImportedAesHcPartyKeys = await this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(
-        hcpartyId,
-        delegations,
-        false
-      )
-      const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce(
-        (map, k) => ({ ...map, [k.delegatorId]: (map[k.delegatorId] ?? []).concat([k]) }),
-        {} as { [key: string]: { key: CryptoKey; rawKey: string }[] }
-      )
-      extractedKeys.push(...(await this.decryptKeyInDelegationLikes(delegations[hcpartyId], collatedAesKeysFromDelegatorToHcpartyId, objectId)))
-    }
-
-    return (hcp as HealthcareParty).parentId
-      ? [
-          ...(await this.extractKeysHierarchyFromDelegationLikes((hcp as HealthcareParty).parentId!, objectId, delegations)),
-          { extractedKeys: extractedKeys, hcpartyId: hcpartyId },
-        ]
-      : [{ extractedKeys: extractedKeys, hcpartyId: hcpartyId }]
-  }
-
-  /**
-   * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
-   * 1. Get Data Owner (HCP, Patient or Device) from it's Id.
-   * 2. Decrypt the keys of the given data owner.
-   * 3. Decrypt the parent's key if it has parent.
-   * 4. Return the decrypted key corresponding to the Health Care Party.
-   * @param dataOwnerId : the id of the delegate data owner (including its parents) for which to decrypt `extractedKeys`
-   * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
-   * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
-   * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both data owner with given `dataOwnerId` and its parents; can contain duplicates
-   * - **dataOwnerId** the given `dataOwnerId` OR, if a parent exist, the data owner id of the top parent in the hierarchy  (even if that parent has no delegations)
-   */
-  //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned dataOwnerId will be the one of the parent
-  extractKeysFromDelegationsForHcpHierarchy(
-    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
-    dataOwnerId: string,
-    objectId: string,
-    delegations: { [key: string]: Array<Delegation> }
-  ): Promise<{ extractedKeys: Array<string>; hcpartyId: string }> {
-    return this.getDataOwner(dataOwnerId)
-      .then(({ dataOwner: hcp }) =>
-        (delegations[dataOwnerId] && delegations[dataOwnerId].length
-          ? this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, false).then(
-              (decryptedAndImportedAesHcPartyKeys) => {
-                const collatedAesKeysFromDelegatorToHcpartyId: {
-                  [key: string]: { key: CryptoKey; rawKey: string }[]
-                } = {}
-                decryptedAndImportedAesHcPartyKeys.forEach((k) => {
-                  ;(collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] ?? (collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] = [])).push(k)
-                })
-                return this.decryptKeyInDelegationLikes(delegations[dataOwnerId], collatedAesKeysFromDelegatorToHcpartyId, objectId!)
-              }
-            )
-          : Promise.resolve([])
-        )
-          .then(async (extractedKeys) => {
-            if (extractedKeys.length == 0) {
-              return await this._extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(hcp, delegations, objectId)
-            }
-            return extractedKeys
-          })
-          .then(async (extractedKeys) => {
-            const parentExtractedKeys = (hcp as HealthcareParty).parentId
-              ? await this.extractKeysFromDelegationsForHcpHierarchy((hcp as HealthcareParty).parentId!, objectId, delegations)
-              : { extractedKeys: [], hcpartyId: undefined }
-            return { extractedKeys: extractedKeys.concat(parentExtractedKeys.extractedKeys), hcpartyId: parentExtractedKeys.hcpartyId ?? dataOwnerId }
-          })
-      )
-      .catch((e) => {
-        console.error(`DataOwner with id ${dataOwnerId} cannot be resolved`)
-        throw e
-      })
-  }
-
-  /**
-   * This method covers the use case when a DataOwner found back access to its data, and needs to use the delegations of its delegates instead
-   * of its own ones
-   *
-   * @param dataOwner The current data owner from whom we want to decrypt the aesExchangeKeys
-   * @param delegations The object delegations to decrypt
-   * @param objectId The object to decrypt id
-   * @private
-   */
-  private async _extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(
-    dataOwner: Patient | Device | HealthcareParty,
-    delegations: { [p: string]: Array<Delegation> },
-    objectId: string
-  ) {
-    // Find other keys through aesExchangeKeys
-    const dataOwnerPubKeys = await this.getPublicKeys()
-    const keysToDecrypt = fold(
-      Object.entries(dataOwner.aesExchangeKeys!),
-      {} as { [delegateId: string]: { [pubKey: string]: { [pubKeyFingerprint: string]: string } } },
-      (acc, [pub, aesForPub]) => {
-        if (dataOwnerPubKeys.find((pubKey) => pubKey.slice(-32) == pub.slice(-32)) == undefined) {
-          // We get AES Keys only from delegates of keys we don't currently have
-          // Otherwise, decrypted AES Keys would have previously worked
-          Object.entries(aesForPub).forEach(([delegateId, aesKeys]) => {
-            if (delegateId != dataOwner.id) {
-              const aesAcc = {} as { [pubKeyFingerprint: string]: string }
-              Object.entries(aesKeys)
-                .filter(([encrPubKey]) => dataOwnerPubKeys.some((pubKey) => pubKey.slice(-32) == encrPubKey))
-                .forEach(([pubKeyFingerprint, aesEncr]) => {
-                  aesAcc[pubKeyFingerprint] = aesEncr
-                })
-
-              if (acc[delegateId] == undefined) {
-                acc[delegateId] = {}
-              }
-              acc[delegateId][pub] = aesAcc
-            }
-          })
-        }
-        return acc
-      }
-    )
-
-    const decryptedAndImportedAesHcPartyKeys = await foldAsync(
-      Object.entries(keysToDecrypt),
-      [] as DelegatorAndKeys[],
-      async (delKeysAcc, [delegateId, keysForDelegate]) => {
-        try {
-          delKeysAcc.push(await this.decryptAnyAesExchangeKeyForOwner(keysForDelegate, dataOwner.id!, dataOwner.id!, delegateId, dataOwnerPubKeys))
-        } catch (e) {
-          console.log(`Could not decrypt aesExchangeKeys for delegate ${delegateId}`)
-        }
-        return delKeysAcc
-      }
-    )
-
-    const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce(
-      (map, k) => ({ ...map, [k.delegatorId]: (map[k.delegatorId] ?? []).concat([k]) }),
-      {} as { [key: string]: { key: CryptoKey; rawKey: string }[] }
-    )
-
-    const delegateIdsWithNewExtractedAesKeys = Object.keys(keysToDecrypt)
-    const delegationsToDecrypt = fold(Object.entries(delegations), [] as Delegation[], (acc, [delegateId, del]) => {
-      if (delegateIdsWithNewExtractedAesKeys.find((id) => id == delegateId) != undefined) {
-        acc.push(...delegations[delegateId])
-      }
-      return acc
-    })
-
-    return this.decryptKeyInDelegationLikes(delegationsToDecrypt, collatedAesKeysFromDelegatorToHcpartyId, objectId!)
-  }
-
-  /**
-   * Gets an array of generic secret IDs decrypted from a list of generic delegations (SPKs, CFKs, EKs) `delegationsArray`
-   * If a particular generic delegation thows an exception when decrypted, the return value for it's secret ID will be 'false' and a message is logged to console
-   * For each one of the delegations in the `delegationsArray`, it tries to decrypt with the decryptedHcPartyKey of the owner of that delegation;
-   *
-   * @param delegationsArray : generic delegations array
-   * @param aesKeys : **key** HcP ids of delegators/owners in the `delegationsArray`, each with its own decryptedHcPartyKey
-   * @param masterId : is the object id to which the generic delegation belongs to
-   * - used only to check whether the object.id matches the one stored in the decrypted generic delegation item
-   * - even if there's no match, the secret ID is kept as a valid result (and a message logged to console)
-   * @returns array of generic secret IDs (secretIdSPK, parentId, secretIdEK)
-   */
-  async decryptKeyInDelegationLikes(
-    //TODO: suggested name: getSecretIdsFromGenericDelegations
-    delegationsArray: Array<Delegation>,
-    aesKeysForDataOwnerId: { [key: string]: { key: CryptoKey; rawKey: string }[] },
-    masterId: string
-  ): Promise<Array<string>> {
-    const decryptPromises: Array<Promise<string | undefined>> = delegationsArray.map(async (genericDelegationItem) => {
-      const aesKeys = aesKeysForDataOwnerId[genericDelegationItem.owner!]
-      if (aesKeys?.length) {
-        return aesKeys.reduce(async (acc, aesKey) => {
-          const accValue = await acc
-          if (accValue) {
-            return accValue
-          }
-          try {
-            const decryptedGenericDelegationKey = await this._AES.decrypt(aesKey.key, hex2ua(genericDelegationItem.key!), aesKey.rawKey)
-            const results = ua2string(decryptedGenericDelegationKey).split(':')
-
-            const objectId = results[0] //must be the ID of the object, for checksum
-            const genericSecretId = results[1]
-
-            const details =
-              'object ID: ' + masterId + '; generic delegation from ' + genericDelegationItem.owner + ' to ' + genericDelegationItem.delegatedTo
-
-            if (!objectId) console.warn('Object id is empty; ' + details)
-            if (!genericSecretId) console.warn('Secret id is empty; ' + details)
-
-            if (objectId !== masterId) {
-              /*console.log(
-                "Cryptographic mistake: object ID is not equal to the expected concatenated id within decrypted generic delegation. This may happen when patients have been merged; " +
-                  details
-              )*/
-            }
-            return genericSecretId
-          } catch (err) {
-            console.log(
-              `Could not decrypt generic delegation in object with ID: ${masterId} from ${genericDelegationItem.owner} to ${genericDelegationItem.delegatedTo}: ${err}`
-            )
-
-            return undefined
-          }
-        }, Promise.resolve(undefined as string | undefined))
-      } else {
-        console.log(`Could not find aes key for object with ID: ${masterId}`)
-      }
-    })
-    return Promise.all(decryptPromises).then((genericSecretId) => genericSecretId.filter((id) => !!id) as string[])
-  }
-
-  getPublicKeyFromPrivateKey(privateKey: JsonWebKey, dataOwner: Patient | Device | HealthcareParty) {
-    if (!privateKey.n || !privateKey.e) {
-      throw new Error('No public key can be deduced from incomplete private key')
-    }
-
-    const publicKeyFromPrivateKey = jwk2spki(privateKey)
-    const publicKeys = [dataOwner.publicKey].concat(Object.keys(dataOwner.aesExchangeKeys ?? {})).filter((x) => !!x)
-
-    if (!publicKeys.length) {
-      throw new Error('No public key has been defined for hcp')
-    }
-
-    const publicKey = publicKeys.find((it) => it === publicKeyFromPrivateKey)
-    if (!publicKey) {
-      throw new Error('No public key can be found for this private key')
-    }
-
-    return publicKey
-  }
-
-  async loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId: string, privateKey: Uint8Array) {
-    const { dataOwner } = await this.getDataOwner(healthcarePartyId)
-
-    const privateKeyInJwk = pkcs8ToJwk(privateKey)
-    const publicKey = this.getPublicKeyFromPrivateKey(privateKeyInJwk, dataOwner)
-
-    const keyPair: { publicKey: CryptoKey; privateKey: CryptoKey } = await this._RSA.importKeyPair(
-      'jwk',
-      privateKeyInJwk,
-      'jwk',
-      spkiToJwk(hex2ua(publicKey))
-    )
-    this.rsaKeyPairs[publicKey.slice(-32)] = keyPair
-    const exportedKeyPair = await this._RSA.exportKeys(keyPair, 'jwk', 'jwk')
-
-    return this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair)
-  }
-
-  async loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId: string, privateKey: JsonWebKey) {
-    const { dataOwner } = await this.getDataOwner(healthcarePartyId)
-
-    if ((!privateKey.n || !privateKey.e) && dataOwner.publicKey) {
-      //Fallback on default publicKey
-      console.warn('An incomplete key has been completed using the default public key of the data owner')
-      const publicKeyInJwk = spkiToJwk(hex2ua(dataOwner.publicKey))
-      privateKey.n = publicKeyInJwk.n
-      privateKey.e = publicKeyInJwk.e
-    }
-
-    const publicKey = this.getPublicKeyFromPrivateKey(privateKey, dataOwner)
-
-    const keyPair = await this._RSA.importKeyPair('jwk', privateKey, 'jwk', spkiToJwk(hex2ua(publicKey)))
-    this.rsaKeyPairs[publicKey.slice(-32)] = keyPair
-    const exportedKeyPair = await this._RSA.exportKeys(keyPair, 'jwk', 'jwk')
-
-    return this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair)
-  }
-
-  // noinspection JSUnusedGlobalSymbols
-  loadKeyPairsInBrowserLocalStorage(healthcarePartyId: string, file: Blob): Promise<void> {
-    const fr = new FileReader()
-    return new Promise((resolve, reject) => {
-      fr.onerror = reject
-      fr.onabort = reject
-      fr.onload = (e: any) => {
-        //TODO remove any
-        const privateKey = e.target.result as string
-        this.loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, hex2ua(privateKey))
-          .then(() => resolve())
-          .catch(reject)
-      }
-      fr.readAsText(file)
-    })
-  }
-
-  // noinspection JSUnusedGlobalSymbols
-  saveKeychainInBrowserLocalStorage(id: string, keychain: number) {
-    this._storage.setItem(
-      this.keychainLocalStoreIdPrefix + id,
-      b2a(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), ''))
-    )
-  }
-
-  saveKeychainInBrowserLocalStorageAsBase64(id: string, keyChainB64: string) {
-    this._storage.setItem(this.keychainLocalStoreIdPrefix + id, keyChainB64)
-  }
-
-  // noinspection JSUnusedGlobalSymbols
-  saveKeychainValidityDateInBrowserLocalStorage(id: string, date: string) {
-    if (!id) return
-
-    if (!date) {
-      this._storage.deleteItem(this.keychainValidityDateLocalStoreIdPrefix + id)
-    } else {
-      this._storage.setItem(this.keychainValidityDateLocalStoreIdPrefix + id, date)
-    }
-  }
-
-  /**
-   * Populate the HCP.options dict with an encrypted eHealth certificate and unencryped expiry date.
-   * Any potentially unencrypted certificates will be pruned from the HCP.
-   * @param hcpId Id of the hcp to modify
-   * @returns modified HCP
-   */
-  async saveKeyChainInHCPFromLocalStorage(hcpId: string): Promise<HealthcareParty> {
-    return await this.hcpartyBaseApi.getHealthcareParty(hcpId).then(async (hcp: HealthcareParty) => {
-      let aesKey: CryptoKey | null = null
-      try {
-        aesKey = _.find(
-          await this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id!], hcp.id!),
-          (delegator: DelegatorAndKeys) => delegator.delegatorId === hcp.id
-        )!.key
-      } catch (e) {
-        console.error('Error while importing the AES key.')
-      }
-      if (!aesKey) {
-        console.error('No encryption key!')
-      }
-
-      const opts = hcp.options || {}
-
-      const crt = this.getKeychainInBrowserLocalStorageAsBase64(hcp.id!!)
-      if (!!aesKey && !!crt) {
-        let crtEncrypted: ArrayBuffer | null = null
-        try {
-          crtEncrypted = await this.AES.encrypt(aesKey, new Uint8Array(string2ua(atob(crt))))
-        } catch (e) {
-          console.error('Error while encrypting the certificate', e)
-        }
-
-        // add the encrypted certificate to the options
-        _.set(opts, this.hcpPreferenceKeyEhealthCert, ua2string(new Uint8Array(crtEncrypted!)))
-      }
-
-      const crtValidityDate = this.getKeychainValidityDateInBrowserLocalStorage(hcp.id!!)
-      if (!!crtValidityDate) {
-        _.set(opts, this.hcpPreferenceKeyEhealthCertDate, crtValidityDate)
-      }
-
-      hcp.options = opts
-      return hcp
-    })
-  }
-
-  importKeychainInBrowserFromHCP(hcpId: string): Promise<void> {
-    return this.hcpartyBaseApi.getHealthcareParty(hcpId).then(async (hcp: HealthcareParty) => {
-      let crtCryp: Uint8Array | null = null
-      if (!!hcp.options && !!hcp.options[this.hcpPreferenceKeyEhealthCert]) {
-        crtCryp = string2ua(hcp.options[this.hcpPreferenceKeyEhealthCert])
-      }
-
-      const crtValidityDate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCertDate)
-
-      // store the validity date
-      if (!!crtValidityDate) {
-        this.saveKeychainValidityDateInBrowserLocalStorage(hcp.id!!, crtValidityDate)
-      }
-
-      let crt: ArrayBuffer | null = null
-      let decryptionKey: CryptoKey | null = null
-      try {
-        decryptionKey = _.find(
-          await this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id!], hcp.id!),
-          (delegator: DelegatorAndKeys) => delegator.delegatorId === hcp.id
-        )!.key
-      } catch (e) {
-        console.error('Error while importing the AES key.')
-      }
-      if (!decryptionKey) {
-        throw new Error('No encryption key! eHealth certificate cannot be decrypted.')
-      }
-
-      if (!!crtCryp && decryptionKey) {
-        try {
-          crt = await this.AES.decrypt(decryptionKey, crtCryp)
-        } catch (e) {
-          console.error(e)
-        }
-      }
-
-      if (!crt) {
-        throw new Error(`Error while saving certificate in browser local storage! Hcp ${hcp.id} has no certificate.`)
-      } else {
-        this.saveKeychainInBrowserLocalStorageAsBase64(hcp.id!!, btoa(String.fromCharCode.apply(null, Array.from(new Uint8Array(crt)))))
-      }
-
-      return
-    })
-  }
-
-  /**
-   * Synchronizes the eHealth certificate from the database into the LocalStorage, returning information on the presence
-   * of certificate data in either place.
-   *
-   * @param hcpId The healthcare party id
-   * @returns A Promise for an object that represents the existence of a certificate in local storage and in the DB,
-   * through the two boolean properties "local" and "remote".
-   */
-  syncEhealthCertificateFromDatabase(hcpId: string): Promise<{ remote: boolean; local: boolean }> {
-    return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp: HealthcareParty) => {
-      const remoteCertificate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCert)
-      const localCertificate = this.getKeychainInBrowserLocalStorageAsBase64(hcp.id!)
-
-      if (remoteCertificate) {
-        return this.importKeychainInBrowserFromHCP(hcp.id!)
-          .then(() => ({ local: true, remote: true }))
-          .catch(() => ({ local: !!localCertificate, remote: true }))
-      } else {
-        return { local: !!localCertificate, remote: !!remoteCertificate }
-      }
-    })
-  }
-
-  getKeychainInBrowserLocalStorageAsBase64(id: string) {
-    return this._storage.getItem(this.keychainLocalStoreIdPrefix + id)
-  }
-
-  getKeychainValidityDateInBrowserLocalStorage(id: string) {
-    return this._storage.getItem(this.keychainValidityDateLocalStoreIdPrefix + id)
-  }
-
-  // noinspection JSUnusedGlobalSymbols
-  loadKeychainFromBrowserLocalStorage(id: string) {
-    const lsItem = this._storage.getItem(this.keychainLocalStoreIdPrefix + id)
-    return lsItem !== undefined ? b64_2uas(lsItem) : null
-  }
-
-  /**
-   * loads the RSA key pair (hcparty) in JWK from local storage, not imported
-   *
-   * @param id  doc id - hcpartyId
-   * @param publicKeyFingerPrint the 32 last characters of public key this private key is associated with
-   * @returns {Object} it is in JWK - not imported
-   */
-  loadKeyPairNotImported(id: string, publicKeyFingerPrint?: string): { publicKey: JsonWebKey; privateKey: JsonWebKey } {
-    if (typeof Storage === 'undefined') {
-      console.log('Your browser does not support HTML5 Browser Local Storage !')
-      throw 'Your browser does not support HTML5 Browser Local Storage !'
-    }
-    //TODO decryption
-    const item = publicKeyFingerPrint
-      ? this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id + '.' + publicKeyFingerPrint.slice(-32)) ??
-        this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id)
-      : this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id)
-    if (!item) {
-      console.warn(`No key can be found in local storage for id ${id} and publicKeyFingerPrint ${publicKeyFingerPrint}`)
-    }
-    return item!
-  }
-
-  /**
-   * Loads and imports the RSA key pair (hcparty) from local storage
-   *
-   * @param id  doc id - hcPartyId
-   * @returns {Promise} -> {CryptoKey} - imported RSA
-   */
-  loadKeyPairImported(id: string) {
-    return new Promise((resolve: (value: { publicKey: CryptoKey; privateKey: CryptoKey }) => any, reject) => {
-      try {
-        const jwkKeyPair = this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id)
-        if (jwkKeyPair !== undefined) {
-          if (jwkKeyPair.publicKey && jwkKeyPair.privateKey) {
-            this._RSA.importKeyPair('jwk', jwkKeyPair.privateKey, 'jwk', jwkKeyPair.publicKey).then(resolve, (err) => {
-              console.error('Error in RSA.importKeyPair: ' + err)
-              reject(err)
-            })
-          } else {
-            const message = 'Error in RSA.importKeyPair: Invalid key'
-            console.error(message)
-            reject(Error(message))
-          }
-        } else {
-          const message = 'Error in RSA.importKeyPair: Missing key'
-          console.error(message)
-          reject(Error(message))
-        }
-      } catch (err) {
-        reject(err)
-      }
-    })
-  }
-
-  /**
-   * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
-   * AES key using the new user public key.
-   *
-   * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
-   * @param ownerId Id of the data owner to which we would like to give access back
-   * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
-   *
-   * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
-   */
-  async giveAccessBackTo(delegateUser: User, ownerId: string, ownerNewPublicKey: string): Promise<CachedDataOwner> {
-    const delegateId = delegateUser.healthcarePartyId ?? delegateUser.patientId ?? delegateUser.deviceId
-    if (!delegateId) {
-      throw new Error(`DelegateUser ${delegateUser.id} must be a data Owner`)
-    }
-
-    const delegatePublicKeys = await this.getPublicKeys()
-    const newPubKeyCryptoKey = await this._RSA.importKey('jwk', spkiToJwk(hex2ua(ownerNewPublicKey)), ['encrypt'])
-    const dataOwnerToUpdate = await this.getDataOwner(ownerId)
-
-    const newAesExchangeKeys = await foldAsync(
-      Object.entries(dataOwnerToUpdate.dataOwner.aesExchangeKeys ?? {}),
-      dataOwnerToUpdate.dataOwner.aesExchangeKeys ?? {},
-      async (pubAcc, [pubKey, newAesExcKeys]) => {
-        const existingKeys = pubAcc[pubKey] ?? {}
-
-        pubAcc[pubKey] = await foldAsync(Object.entries(newAesExcKeys), existingKeys, async (delAcc, [delId, delKeys]) => {
-          if (delId == delegateId && pubKey != ownerNewPublicKey) {
-            // Add the AES Key encrypted with the new public key in the aesExchangeKeys
-            try {
-              // First, we decrypt it using the delegate RSA Public Key
-              const encrAesKeyInfo = await this.decryptHcPartyKey(
-                delegateId,
-                dataOwnerToUpdate.dataOwner.id!,
-                delegateId,
-                pubKey,
-                delKeys,
-                delegatePublicKeys
-              ).then(async (delegatorAndKeys) => {
-                // Then, we encrypt it using the owner new RSA Public Key (provided in argument)
-                return await this.encryptAesKeyOnlyForProvidedKeys(delegatorAndKeys?.rawKey, dataOwnerToUpdate, [newPubKeyCryptoKey])
-                  .then((encrAes) => Object.values(encrAes)[0])
-                  .then((encrAesInfo) => {
-                    return { pubKeyUsedToEncryptAes: Object.keys(encrAesInfo)[0], encryptedAes: Object.values(encrAesInfo)[0] }
-                  })
-              })
-
-              delKeys[encrAesKeyInfo.pubKeyUsedToEncryptAes] = encrAesKeyInfo.encryptedAes
-            } catch (e) {
-              console.log(`${delegateId} could not re-encrypt AES Key of ${dataOwnerToUpdate.dataOwner.id}`)
-            } finally {
-              delAcc[delId] = delKeys
-            }
-          } else {
-            // Otherwise, we don't transform the aesExchangeKeys for this delegate
-            delAcc[delId] = delKeys
-          }
-          return delAcc
-        })
-        return pubAcc
-      }
-    )
-
-    // After adding the potential new aesExchangeKeys, we save the updated data owner
-    return this._saveDataOwner({
-      type: dataOwnerToUpdate.type,
-      dataOwner: { ...dataOwnerToUpdate.dataOwner, aesExchangeKeys: newAesExchangeKeys },
-    } as CachedDataOwner)
-  }
-
-  async addNewKeyPairForOwnerId(
-    maintenanceTasksApi: IccMaintenanceTaskXApi,
-    user: User,
-    ownerId: string,
-    generateTransferKey: boolean = true,
-    sendMaintenanceTasks: boolean = true
-  ): Promise<{ dataOwner: HealthcareParty | Patient | Device; publicKey: string; privateKey: string }> {
-    return this.addNewKeyPairForOwner(maintenanceTasksApi, user, await this.getDataOwner(ownerId), generateTransferKey, sendMaintenanceTasks)
-  }
-
-  async addNewKeyPairForOwner(
-    maintenanceTasksApi: IccMaintenanceTaskXApi,
-    user: User,
-    cdo: CachedDataOwner,
-    generateTransferKey: boolean = true,
-    sendMaintenanceTasks: boolean = true
-  ): Promise<{ dataOwner: HealthcareParty | Patient | Device; publicKey: string; privateKey: string }> {
-    const generatedKeypair = await this.RSA.generateKeyPair()
-    return this.addKeyPairForOwner(maintenanceTasksApi, user, cdo, generatedKeypair, generateTransferKey, sendMaintenanceTasks)
-  }
-
-  async addRawKeyPairForOwnerId(
-    maintenanceTasksApi: IccMaintenanceTaskXApi,
-    user: User,
-    ownerId: string,
-    keypair: { publicKey: string; privateKey: string },
-    generateTransferKey: boolean = true,
-    sendMaintenanceTasks: boolean = true
-  ): Promise<{ dataOwner: HealthcareParty | Patient | Device; publicKey: string; privateKey: string }> {
-    return this.addRawKeyPairForOwner(maintenanceTasksApi, user, await this.getDataOwner(ownerId), keypair, generateTransferKey, sendMaintenanceTasks)
-  }
-
-  async addRawKeyPairForOwner(
-    maintenanceTasksApi: IccMaintenanceTaskXApi,
-    user: User,
-    cdo: CachedDataOwner,
-    keypair: { publicKey: string; privateKey: string },
-    generateTransferKey: boolean = true,
-    sendMaintenanceTasks: boolean = true
-  ): Promise<{ dataOwner: HealthcareParty | Patient | Device; publicKey: string; privateKey: string }> {
-    const importedPrivateKey = await this._RSA.importKey('pkcs8', hex2ua(keypair.privateKey), ['decrypt'])
-    const importedPublicKey = await this._RSA.importKey('spki', hex2ua(keypair.publicKey), ['encrypt'])
-
-    return this.addKeyPairForOwner(
-      maintenanceTasksApi,
-      user,
-      cdo,
-      { publicKey: importedPublicKey, privateKey: importedPrivateKey },
-      generateTransferKey,
-      sendMaintenanceTasks
-    )
-  }
-
-  async addKeyPairForOwner(
-    maintenanceTasksApi: IccMaintenanceTaskXApi,
-    user: User,
-    cdo: CachedDataOwner,
-    keypair: { publicKey: CryptoKey; privateKey: CryptoKey },
-    generateTransferKey: boolean = true,
-    sendMaintenanceTasks: boolean = true
-  ): Promise<{ dataOwner: HealthcareParty | Patient | Device; publicKey: string; privateKey: string }> {
-    const publicKeyHex = ua2hex(await this.RSA.exportKey(keypair.publicKey!, 'spki'))
-
-    const gen = (await this._AES.generateCryptoKey(true)) as string
-
-    await this.cacheKeyPair({
-      publicKey: await this.RSA.exportKey(keypair.publicKey!, 'jwk'),
-      privateKey: await this.RSA.exportKey(keypair.privateKey!, 'jwk'),
-    })
-
-    const { type: ownerType, dataOwner: ownerToUpdate } = await this.createOrUpdateAesExchangeKeysFor(cdo, gen, {
-      pubKey: keypair.publicKey,
-      privKey: keypair.privateKey,
-    }).then(async (dataOwnerWithUpdatedAesKeys) =>
-      generateTransferKey
-        ? await this.createOrUpdateTransferKeysFor(dataOwnerWithUpdatedAesKeys, gen, { pubKey: keypair.publicKey, privKey: keypair.privateKey })
-        : dataOwnerWithUpdatedAesKeys
-    )
-
-    const modifiedDataOwnerAndType = await this._saveDataOwner({ type: ownerType, dataOwner: ownerToUpdate })
-    const sentMaintenanceTasks = sendMaintenanceTasks
-      ? await this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, keypair.publicKey)
-      : []
-
-    return {
-      dataOwner: sentMaintenanceTasks.length
-        ? await this.retrieveDataOwnerInfoAfterPotentialUpdate(modifiedDataOwnerAndType.dataOwner)
-        : modifiedDataOwnerAndType.dataOwner,
-      publicKey: publicKeyHex,
-      privateKey: ua2hex((await this.RSA.exportKey(keypair.privateKey!, 'pkcs8')) as ArrayBuffer),
-    }
-  }
-
-  private async _saveDataOwner(dataOwner: CachedDataOwner): Promise<CachedDataOwner> {
-    const ownerType = dataOwner.type
-    const ownerToUpdate = dataOwner.dataOwner
-
-    return ownerType === 'hcp'
-      ? await (this.dataOwnerCache[ownerToUpdate.id!] = this.hcpartyBaseApi
-          .modifyHealthcareParty(ownerToUpdate as HealthcareParty)
-          .then((x) => ({ type: 'hcp', dataOwner: x } as CachedDataOwner)))
-      : ownerType === 'patient'
-      ? await (this.dataOwnerCache[ownerToUpdate.id!] = this.patientBaseApi
-          .modifyPatient(ownerToUpdate as Patient)
-          .then((x) => ({ type: 'patient', dataOwner: x } as CachedDataOwner)))
-      : await (this.dataOwnerCache[ownerToUpdate.id!] = this.deviceBaseApi
-          .updateDevice(ownerToUpdate as Device)
-          .then((x) => ({ type: 'device', dataOwner: x } as CachedDataOwner)))
-  }
-
-  private async createOrUpdateAesExchangeKeysFor(
-    cdo: CachedDataOwner,
-    decryptedAesExchangeKey: string,
-    keyToEncrypt: { pubKey: CryptoKey; privKey: CryptoKey }
-  ): Promise<CachedDataOwner> {
-    const publicKeyHex = ua2hex(await this.RSA.exportKey(keyToEncrypt.pubKey!, 'spki'))
-    const existingAesExchangeKeys = cdo.dataOwner.aesExchangeKeys ?? {}
-    existingAesExchangeKeys[publicKeyHex] = await this.encryptAesKeyFor(decryptedAesExchangeKey, cdo.dataOwner, keyToEncrypt.pubKey)
-
-    return { type: cdo.type, dataOwner: { ...cdo.dataOwner, aesExchangeKeys: existingAesExchangeKeys } } as CachedDataOwner
-  }
-
-  private async createOrUpdateTransferKeysFor(
-    dataOwner: CachedDataOwner,
-    decryptedAesExchangeKey: string,
-    keyToEncrypt: { pubKey: CryptoKey; privKey: CryptoKey }
-  ): Promise<CachedDataOwner> {
-    const pubKeyToEncryptHex = ua2hex(await this.RSA.exportKey(keyToEncrypt.pubKey, 'spki'))
-
-    const encryptedKey = ua2hex(
-      await this._AES.encrypt(
-        await this._AES.importKey('raw', hex2ua(decryptedAesExchangeKey)),
-        (await this.RSA.exportKey(keyToEncrypt.privKey!, 'pkcs8')) as ArrayBuffer,
-        decryptedAesExchangeKey
-      )
-    )
-
-    const dataOwnerExistingPubKeys = Array.from(await this.getDataOwnerHexPublicKeys(dataOwner.dataOwner))
-
-    const transferKeys = fold(dataOwnerExistingPubKeys, dataOwner.dataOwner.transferKeys ?? {}, (pubAcc, pubKeyHex) => {
-      if (pubKeyHex !== pubKeyToEncryptHex) {
-        const existingKeys = pubAcc[pubKeyHex] ?? {}
-        existingKeys[pubKeyToEncryptHex] = encryptedKey
-        pubAcc[pubKeyHex] = existingKeys
-      }
-      return pubAcc
-    })
-
-    return { type: dataOwner.type, dataOwner: { ...dataOwner.dataOwner, transferKeys: transferKeys } } as CachedDataOwner
-  }
-
-  private async encryptAesKeyFor(
-    aesKey: string,
-    dataOwner: HealthcareParty | Patient | Device,
-    doNewPublicKey: CryptoKey
-  ): Promise<{ [delId: string]: { [pk: string]: string } }> {
-    const dataOwnerAllPubKeys = [doNewPublicKey].concat(await this.getDataOwnerPublicKeys(dataOwner))
-    return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerAllPubKeys)
-  }
-
-  private async encryptAesKeyOnlyForProvidedKeys(
-    aesKey: string,
-    dataOwner: HealthcareParty | Patient | Device,
-    dataOwnerPubKeys: CryptoKey[]
-  ): Promise<{ [delId: string]: { [pk: string]: string } }> {
-    const encryptedAesForDataOwner = await foldAsync(dataOwnerPubKeys, {} as { [pubKeyFingerprint: string]: string }, async (encrAes, pubKey) => {
-      encrAes[ua2hex(await this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = ua2hex(await this._RSA.encrypt(pubKey, hex2ua(aesKey)))
-      return encrAes
-    })
-
-    return { [dataOwner.id!]: encryptedAesForDataOwner }
-  }
-
-  private retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate: HealthcareParty | Patient | Device): Promise<CachedDataOwner> {
-    this.emptyHcpCache(dataOwnerToUpdate.id!)
-
-    return this.getDataOwner(dataOwnerToUpdate.id!).then(({ type, dataOwner }) => {
-      return {
-        type: type,
-        dataOwner: {
-          ...dataOwner,
-          transferKeys: dataOwnerToUpdate.transferKeys,
-          hcPartyKeys: fold(Object.entries(dataOwnerToUpdate.hcPartyKeys ?? {}), dataOwner.hcPartyKeys ?? {}, (acc, [delegateId, hcKeys]) => {
-            acc[delegateId] = hcKeys
-            return acc
-          }),
-          aesExchangeKeys: fold(
-            Object.entries(dataOwnerToUpdate.aesExchangeKeys ?? {}),
-            dataOwner.aesExchangeKeys ?? {},
-            (pubAcc, [pubKey, newAesExcKeys]) => {
-              const existingKeys = pubAcc[pubKey] ?? {}
-              pubAcc[pubKey] = fold(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => {
-                delAcc[delId] = delKeys
-                return delAcc
-              })
-              return pubAcc
-            }
-          ),
-        },
-      } as CachedDataOwner
-    })
-  }
-
-  private async sendMaintenanceTasks(
-    maintenanceTaskApi: IccMaintenanceTaskXApi,
-    user: User,
-    dataOwner: HealthcareParty | Patient | Device,
-    newPublicKey: CryptoKey
-  ): Promise<MaintenanceTask[]> {
-    const hexNewPubKey = ua2hex(await this.RSA.exportKey(newPublicKey, 'spki'))
-    const nonAccessiblePubKeys = Array.from(this.getDataOwnerHexPublicKeys(dataOwner).values())
-      .filter((existingPubKey) => existingPubKey != hexNewPubKey)
-      .filter(async (existingPubKey) => (await this.getPublicKeysAsSpki()).find((pubKey) => pubKey == existingPubKey) == undefined)
-
-    if (nonAccessiblePubKeys.length) {
-      const tasksForDelegates = Object.entries(await this.getEncryptedAesExchangeKeysForDelegate(dataOwner.id!))
-        .filter(([delegatorId]) => delegatorId != dataOwner.id)
-        .flatMap(([delegatorId, delegatorKeys]) => {
-          return Object.entries(delegatorKeys).flatMap(([, aesExchangeKeys]) => {
-            return Object.keys(aesExchangeKeys).map((delegatePubKey) => {
-              return { delegateId: delegatorId, maintenanceTask: this.createMaintenanceTask(dataOwner, delegatePubKey) }
-            })
-          })
-        })
-
-      const tasksForDelegator = (await this._getDelegateIdsOf(dataOwner))
-        .filter((delegateId) => delegateId != dataOwner.id)
-        .map((delegateId) => {
-          return { delegateId: delegateId, maintenanceTask: this.createMaintenanceTask(dataOwner, hexNewPubKey) }
-        })
-
-      return await tasksForDelegates.concat(tasksForDelegator).reduce(async (existingTasks, task) => {
-        const taskToCreate = await maintenanceTaskApi?.newInstance(user, task.maintenanceTask, [task.delegateId])
-        const createdTask: MaintenanceTask = taskToCreate ? await maintenanceTaskApi?.createMaintenanceTaskWithUser(user, taskToCreate) : undefined
-        return createdTask ? (await existingTasks).concat(createdTask) : await existingTasks
-      }, Promise.resolve([] as MaintenanceTask[]))
-    } else {
-      return []
-    }
-  }
-
-  private createMaintenanceTask(concernedDataOwner: HealthcareParty | Patient | Device, concernedPubKey: string) {
-    return new MaintenanceTask({
-      id: this.randomUuid(),
-      taskType: 'KEY_PAIR_UPDATE',
-      status: MaintenanceTask.StatusEnum.Pending,
-      properties: [
-        new PropertyStub({
-          id: 'dataOwnerConcernedId',
-          type: new PropertyTypeStub({ type: PropertyTypeStub.TypeEnum.STRING }),
-          typedValue: new TypedValueObject({
-            type: TypedValueObject.TypeEnum.STRING,
-            stringValue: concernedDataOwner.id,
-          }),
-        }),
-        new PropertyStub({
-          id: 'dataOwnerConcernedPubKey',
-          type: new PropertyTypeStub({ type: PropertyTypeStub.TypeEnum.STRING }),
-          typedValue: new TypedValueObject({
-            type: TypedValueObject.TypeEnum.STRING,
-            stringValue: concernedPubKey,
-          }),
-        }),
-      ],
-    })
-  }
-
-  private getDataOwnerHexPublicKeys(dataOwner: HealthcareParty | Patient | Device): Set<string> {
-    return new Set(
-      (dataOwner.publicKey ? [dataOwner.publicKey] : [])
-        .concat(dataOwner.aesExchangeKeys ? Object.keys(dataOwner.aesExchangeKeys) : [])
-        .filter((pubKey) => !!pubKey)
-    )
-  }
-
-  private async getDataOwnerPublicKeys(dataOwner: HealthcareParty | Patient | Device): Promise<CryptoKey[]> {
-    return await Promise.all(
-      Array.from(this.getDataOwnerHexPublicKeys(dataOwner)).map(
-        async (pubKey) => await this._RSA.importKey('jwk', spkiToJwk(hex2ua(pubKey)), ['encrypt'])
-      )
-    )
-  }
-
-  generateKeyForDelegate(ownerId: string, delegateId: string): PromiseLike<HealthcareParty | Patient> {
-    //Preload hcp and patient because we need them and they are going to be invalidated from the caches
-    return notConcurrent(this.generateKeyConcurrencyMap, ownerId, async () => {
-      const [{ type: ownerType, dataOwner: owner }, { dataOwner: delegate }] = await Promise.all([
-        this.getDataOwner(ownerId),
-        this.getDataOwner(delegateId),
-      ])
-
-      const availablePublicKeysFingerprints = Object.keys(this.rsaKeyPairs)
-      const ownerLegacyPublicKey = owner.publicKey
-      const isOwnerLegacyPublicKeyAvailable = ownerLegacyPublicKey
-        ? availablePublicKeysFingerprints.some((fp) => ownerLegacyPublicKey.endsWith(fp))
-        : false
-
-      const availableOwnerPublicKeys = [
-        ownerLegacyPublicKey,
-        ...Object.keys(owner.aesExchangeKeys || {}).filter((x) => x !== ownerLegacyPublicKey),
-      ].filter((k) => !!k && availablePublicKeysFingerprints.some((fp) => k.endsWith(fp))) as string[]
-      const selectedPublicKey = availableOwnerPublicKeys[0]
-
-      if (!selectedPublicKey) {
-        throw new Error(`Invalid owner, no public key, keypairs have not be set for ${ownerId}`)
-      }
-
-      if (
-        ((owner.hcPartyKeys || {})[delegateId] && owner.publicKey && availablePublicKeysFingerprints.includes(owner.publicKey.slice(-32))) ||
-        Object.values(owner.aesExchangeKeys || {}).some(
-          (x) => x[delegateId] && Object.keys(x[delegateId]).some((k) => availablePublicKeysFingerprints.includes(k))
-        )
-      ) {
-        return owner
-      }
-
-      let ownerCombinedAesExchangeKeys = owner.aesExchangeKeys ?? {}
-
-      if (ownerLegacyPublicKey && !(owner.aesExchangeKeys ?? {})[ownerLegacyPublicKey]) {
-        //Transfer keys from old structure (hcparty keys) to new one (aesExchangeKeys)
-        const unknownDataOwnerCounterPartIds = Object.keys(owner.hcPartyKeys ?? {}).filter((x) => x !== ownerId && x !== delegateId)
-        const counterParts = [
-          owner,
-          delegate,
-          ...(await Promise.all(unknownDataOwnerCounterPartIds.map((cpid) => this.getDataOwner(cpid).then((dot) => dot.dataOwner)))),
-        ]
-        ownerCombinedAesExchangeKeys = {
-          [ownerLegacyPublicKey]: Object.entries(owner.hcPartyKeys ?? {}).reduce(
-            (map, [hcpId, keys]) => ({
-              ...map,
-              [hcpId]: { [ownerLegacyPublicKey]: keys[0], [counterParts.find((x) => x.id === hcpId)?.publicKey ?? '']: keys[1] },
-              ...{},
-            }),
-            {}
-          ),
-          ...ownerCombinedAesExchangeKeys,
-        }
-      }
-
-      const delegatePublicKeys = [delegate.publicKey, ...Object.keys(delegate.aesExchangeKeys ?? {}).filter((x) => x !== delegate.publicKey)].filter(
-        (x) => !!x
-      ) as string[]
-      if (!delegatePublicKeys.length) {
-        throw new Error(`Invalid delegate, no public key, keypairs have not be set for ${delegateId}`)
-      }
-      const genProm = this._AES.generateCryptoKey(true).then(async (AESKey) => {
-        const allPubKeys = [...availableOwnerPublicKeys, ...delegatePublicKeys]
-        const encryptedAesKeys = await allPubKeys.reduce(
-          async (map, pubK) => ({
-            ...(await map),
-            [pubK.slice(-32)]: ua2hex(
-              await this._RSA.encrypt(await this._RSA.importKey('jwk', spkiToJwk(hex2ua(pubK)), ['encrypt']), hex2ua(AESKey as string))
-            ),
-          }),
-          Promise.resolve({} as { [pubKey: string]: string })
-        )
-
-        if (delegate.publicKey && ownerLegacyPublicKey && isOwnerLegacyPublicKeyAvailable) {
-          owner.hcPartyKeys![delegateId] = [encryptedAesKeys[ownerLegacyPublicKey.slice(-32)], encryptedAesKeys[delegate.publicKey.slice(-32)]]
-        }
-        owner.aesExchangeKeys = {
-          ...(ownerCombinedAesExchangeKeys ?? {}),
-          [selectedPublicKey]: { ...(owner.aesExchangeKeys?.[selectedPublicKey] ?? {}), [delegateId]: encryptedAesKeys },
-        }
-
-        return new Promise<['hcp', HealthcareParty] | ['patient', Patient] | ['device', Device]>((resolve, reject) => {
-          ownerType === 'hcp'
-            ? (this.dataOwnerCache[owner.id!] = this.hcpartyBaseApi
-                .modifyHealthcareParty(owner as HealthcareParty)
-                .then((x) => ({ type: 'hcp', dataOwner: x } as CachedDataOwner)))
-                .then((x) => resolve(['hcp', x.dataOwner]))
-                .catch((e) => reject(e))
-            : ownerType === 'patient'
-            ? (this.dataOwnerCache[owner.id!] = this.patientBaseApi.modifyPatient(owner as Patient).then((x) => ({ type: 'patient', dataOwner: x })))
-                .then((x) => resolve(['patient', x.dataOwner]))
-                .catch((e) => reject(e))
-            : (this.dataOwnerCache[owner.id!] = this.deviceBaseApi.updateDevice(owner as Device).then((x) => ({ type: 'device', dataOwner: x })))
-                .then((x) => resolve(['device', x.dataOwner]))
-                .catch((e) => reject(e))
-        })
-      })
-
-      this.hcPartyKeysRequestsCache[delegateId] = genProm.then(() => {
-        return this.forceGetEncryptedAesExchangeKeysForDelegate(delegateId)
-      })
-      return genProm.then((res) => {
-        return res[1]
-      })
-    })
-  }
-
-  getDataOwner(ownerId: string, loadIfMissingFromCache: boolean = true) {
-    return (
-      this.dataOwnerCache[ownerId] ??
-      (loadIfMissingFromCache
-        ? (this.dataOwnerCache[ownerId] = this.patientBaseApi
-            .getPatient(ownerId)
-            .then((x) => ({ type: 'patient', dataOwner: x } as CachedDataOwner))
-            .catch(() => this.deviceBaseApi.getDevice(ownerId).then((x) => ({ type: 'device', dataOwner: x } as CachedDataOwner)))
-            .catch(() => this.hcpartyBaseApi.getHealthcareParty(ownerId).then((x) => ({ type: 'hcp', dataOwner: x } as CachedDataOwner)))
-            .catch((e) => {
-              delete this.dataOwnerCache[ownerId]
-              throw e
-            }))
-        : undefined)
-    )
-  }
-
-  // noinspection JSUnusedGlobalSymbols
-  async checkPrivateKeyValidity(dataOwner: HealthcareParty | Patient | Device): Promise<boolean> {
-    const publicKeys = Array.from(new Set([dataOwner.publicKey].concat(Object.keys(dataOwner.aesExchangeKeys ?? {})).filter((x) => !!x))) as string[]
-
-    return await publicKeys.reduce(async (pres, publicKey) => {
-      const res = await pres
-      try {
-        const k = await this._RSA.importKey('jwk', spkiToJwk(hex2ua(publicKey)), ['encrypt'])
-        const cipher = await this._RSA.encrypt(k, utf8_2ua('shibboleth'))
-        const ikp = await this.getCachedRsaKeyPairForFingerprint(dataOwner.id!, publicKey.slice(-32))
-        const plainText = ua2utf8(await this._RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)))
-        return plainText === 'shibboleth' || res
-      } catch (e) {
-        return res
-      }
-    }, Promise.resolve(false))
-  }
-
-  private throwDetailedExceptionForInvalidParameter(argName: string, argValue: any, methodName: string, methodArgs: any) {
-    if (argValue) return
-
-    let details = '\nMethod name: icc-crypto-x-api.' + methodName + '()\nArguments:'
-
-    if (methodArgs) {
-      try {
-        const argsArray = [...methodArgs]
-        _.each(argsArray, (arg, index) => (details += '\n[' + index + ']: ' + JSON.stringify(arg)))
-      } catch (ex) {
-        details += '; a problem occured while logging arguments details: ' + ex
-      }
-    }
-
-    throw '### THIS SHOULD NOT HAPPEN: ' + argName + ' has an invalid value: ' + argValue + details
-  }
-
-  async getEncryptionDecryptionKeys(dataOwnerId: string, document: EncryptedEntity): Promise<Array<string> | undefined> {
-    try {
-      return !document.id
-        ? undefined
-        : _.uniq(
-            (
-              await this.extractKeysFromDelegationsForHcpHierarchy(
-                dataOwnerId,
-                document.id,
-                (document.encryptionKeys && Object.keys(document.encryptionKeys).length && document.encryptionKeys) || document.delegations!
-              )
-            ).extractedKeys
-          )
-    } catch (e) {
-      return undefined
-    }
-  }
-
-  async encryptDecrypt(
-    method: 'encrypt' | 'decrypt',
-    content: Uint8Array | ArrayBuffer,
-    edKey?: string,
-    user?: User,
-    documentObject?: Document
-  ): Promise<Uint8Array | Array<any> | any> {
-    if (!content || !(edKey || (user?.healthcarePartyId && documentObject))) return content
-
-    if (edKey) {
-      const importedEdKey = await this._AES.importKey('raw', hex2ua(edKey.replace(/-/g, '')))
-      try {
-        return await this._AES[method](importedEdKey, content)
-      } catch (e) {
-        return content
-      }
-    }
-
-    const sfks = await this.extractKeysFromDelegationsForHcpHierarchy(user?.healthcarePartyId!, documentObject?.id!, documentObject?.encryptionKeys!)
-    const importedEdKey = await this._AES.importKey('raw', hex2ua(sfks.extractedKeys[0].replace(/-/g, '')))
-    try {
-      return await this._AES[method](importedEdKey, content)
-    } catch (e) {
-      return content
-    }
-  }
-}