@icure/api 5.0.5 → 5.0.6

package/dist/icc-x-api/icc-crypto-x-api.js

@@ -0,0 +1,1510 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IccCryptoXApi = void 0;
+const AES_1 = require("./crypto/AES");
+const RSA_1 = require("./crypto/RSA");
+const shamir_1 = require("./crypto/shamir");
+const _ = require("lodash");
+const models_1 = require("../icc-api/model/models");
+const binary_utils_1 = require("./utils/binary-utils");
+const utils_1 = require("./utils");
+class IccCryptoXApi {
+    constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
+    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}) {
+        this.hcPartyKeysCache = {};
+        //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
+        //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
+        this.hcPartyKeysRequestsCache = {};
+        this.cacheLastDeletionTimestamp = undefined;
+        this.dataOwnerCache = {};
+        this.keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.';
+        this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
+        this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
+        this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
+        this.rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.';
+        this.rsaKeyPairs = {};
+        this.hcpartyBaseApi = hcpartyBaseApi;
+        this.patientBaseApi = patientBaseApi;
+        this.deviceBaseApi = deviceBaseApi;
+        this._crypto = crypto;
+        this.generateKeyConcurrencyMap = {};
+        this._AES = new AES_1.AESUtils(crypto);
+        this._RSA = new RSA_1.RSAUtils(crypto);
+        this._shamir = new shamir_1.ShamirClass(crypto);
+    }
+    get crypto() {
+        return this._crypto;
+    }
+    get shamir() {
+        return this._shamir;
+    }
+    get RSA() {
+        return this._RSA;
+    }
+    get AES() {
+        return this._AES;
+    }
+    emptyHcpCache(hcpartyId) {
+        delete this.hcPartyKeysRequestsCache[hcpartyId];
+        delete this.dataOwnerCache[hcpartyId];
+        delete this.dataOwnerCache[hcpartyId];
+    }
+    /**
+     * Gets all delegate encrypted HcParty keys of the delegate with the given `delegateHcPartyId`, and for each key the delegator id
+     * If the keys are not cached, they are retrieved from the backend.
+     *
+     * @param delegateHcPartyId The Health Care Party id
+     * @returns  \{delegatorId: delegateEncryptedHcPartyKey\}
+     */
+    getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId) {
+        return (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
+            (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.forceGetEncryptedAesExchangeKeysForDelegate(delegateHcPartyId)));
+    }
+    forceGetEncryptedAesExchangeKeysForDelegate(delegateHcPartyId) {
+        return Promise.all([
+            this.patientBaseApi.getPatientAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
+            this.hcpartyBaseApi.getAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
+            this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
+        ]).then(([a, b, c]) => (Object.assign(Object.assign(Object.assign({}, a), b), c)));
+    }
+    randomUuid() {
+        return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(/[018]/g, (c) => (Number(c) ^ (this._crypto.getRandomValues(new Uint8Array(1))[0] & (15 >> (Number(c) / 4)))).toString(16) //Keep that inlined or you will loose the random
+        );
+    }
+    sha256(data) {
+        return this._crypto.subtle.digest('SHA-256', data);
+    }
+    getPublicKeys() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield Object.values(this.rsaKeyPairs).reduce((p, rsa) => __awaiter(this, void 0, void 0, function* () {
+                return (yield p).concat([(0, utils_1.jwk2spki)(yield this.RSA.exportKey(rsa.publicKey, 'jwk'))]);
+            }), Promise.resolve([]));
+        });
+    }
+    encryptShamirRSAKey(hcp, notaries, threshold) {
+        return this.loadKeyPairImported(hcp.id).then((keyPair) => this._RSA.exportKey(keyPair.privateKey, 'pkcs8').then((exportedKey) => __awaiter(this, void 0, void 0, function* () {
+            const privateKey = exportedKey;
+            const nLen = notaries.length;
+            const shares = nLen == 1 ? [privateKey] : this._shamir.share((0, binary_utils_1.ua2hex)(privateKey), nLen, threshold || nLen).map((share) => (0, binary_utils_1.hex2ua)(share));
+            const publicKeys = yield this.getPublicKeys();
+            return _.reduce(notaries, (queue, notary, idx) => {
+                return queue.then((hcp) => __awaiter(this, void 0, void 0, function* () {
+                    const { owner: hcParty, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(hcp, notary.id);
+                    const [publicKeyIdentifier, hcPartyKeys] = Object.entries(aesExchangeKeys)[0];
+                    try {
+                        const importedAESHcPartyKey = yield this.decryptHcPartyKey(notary.id, hcParty.id, notary.id, publicKeyIdentifier, hcPartyKeys, publicKeys);
+                        const encryptedShamirPartition = yield this.AES.encrypt(importedAESHcPartyKey.key, shares[idx]);
+                        hcParty.privateKeyShamirPartitions = hcParty.privateKeyShamirPartitions || {};
+                        hcParty.privateKeyShamirPartitions[notary.id] = (0, binary_utils_1.ua2hex)(encryptedShamirPartition);
+                    }
+                    catch (e) {
+                        console.log('Error during encryptedShamirRSAKey', notary.id, e);
+                    }
+                    return hcParty;
+                }));
+            }, Promise.resolve(hcp));
+        })));
+    }
+    /* Reconstructs the hcp's private key from the notaries' shamir shares and stores it in localstorage.
+    The retrieval procedure of the shares is not designed or implemented yet.  Therefore, it currently only
+    works if the private key of the notaries are stored in local storage (e.g. notaries = [hcp parent]).
+     * @param hcp : the hcp whose key we want to reconstruct
+     * @param notaries : holders of the shamir shares
+    **/
+    decryptShamirRSAKey(hcp, notaries) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const publicKeys = yield this.getPublicKeys();
+                const nLen = notaries.length;
+                let decryptedPrivatedKey;
+                if (nLen == 1) {
+                    const notaryHcPartyId = notaries[0].id;
+                    const encryptedAesKeyMap = yield this.getEncryptedAesExchangeKeys(hcp, notaryHcPartyId);
+                    const importedAESHcPartyKey = yield Promise.all(Object.entries(encryptedAesKeyMap).map(([idPubKey, keysMap]) => __awaiter(this, void 0, void 0, function* () { return yield this.decryptHcPartyKey(notaryHcPartyId, hcp.id, notaryHcPartyId, idPubKey, keysMap, publicKeys); })));
+                    const cryptedPrivatedKey = hcp.privateKeyShamirPartitions[notaryHcPartyId];
+                    decryptedPrivatedKey = (0, binary_utils_1.ua2hex)(yield this.AES.decryptSome(importedAESHcPartyKey.map((k) => k.key), (0, binary_utils_1.hex2ua)(cryptedPrivatedKey)));
+                }
+                else {
+                    const decryptedShares = yield _.reduce(notaries, (queue, notary) => {
+                        return queue.then((shares) => __awaiter(this, void 0, void 0, function* () {
+                            try {
+                                // TODO: now, we get the encrypted shares in db and decrypt them. This assumes that the
+                                // the notaries' private keys are in localstorage. We should implement a way for the notaries to
+                                // give hcp the decrypted shares without having to also share their private keys.
+                                const encryptedAesKeyMap = yield this.getEncryptedAesExchangeKeys(hcp, notary.id);
+                                const importedAESHcPartyKey = yield Promise.all(Object.entries(encryptedAesKeyMap).map(([idPubKey, keysMap]) => __awaiter(this, void 0, void 0, function* () { return yield this.decryptHcPartyKey(notary.id, hcp.id, notary.id, idPubKey, keysMap, publicKeys); })));
+                                const encryptedShare = hcp.privateKeyShamirPartitions[notary.id];
+                                const decryptedShamirPartition = (0, binary_utils_1.ua2hex)(yield this.AES.decryptSome(importedAESHcPartyKey.map((k) => k.key), (0, binary_utils_1.hex2ua)(encryptedShare)));
+                                shares.push(decryptedShamirPartition);
+                            }
+                            catch (e) {
+                                console.log('Error during encryptedShamirRSAKey', notary.id, e);
+                            }
+                            return shares;
+                        }));
+                    }, Promise.resolve([]));
+                    decryptedPrivatedKey = this._shamir.combine(decryptedShares);
+                }
+                const importedPrivateKey = yield this._RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(decryptedPrivatedKey), ['decrypt']);
+                const importedPublicKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(hcp.publicKey), ['encrypt']);
+                const exportedKeyPair = yield this._RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk');
+                this.storeKeyPair(hcp.id, exportedKeyPair);
+            }
+            catch (e) {
+                console.log('Cannot decrypt shamir RSA key');
+            }
+        });
+    }
+    /**
+     * Gets the decryptedHcPartyKey for the given `encryptedHcPartyKey`
+     *
+     * If the decrypted key exists in the cache, retrieves it from there.
+     * Otherwise, decrypts it using the RSA key of the delegator or delegate (depending on the value of `encryptedForDelegator`)
+     *
+     * @param loggedHcPartyId The logged DataOwner id or the id of his parent
+     * @param delegatorId The id of Delegator eg, the DataOwner where this AES exchange key is stored
+     * @param delegateHcPartyId The id of the delegate : the data owner for whom this aes exchange key has been created
+     * @param publicKey The public key of the delegator : A unique aes exchange key is created for each public key of the delegator. This is the public key corresponding to the encryptedHcPartyKeys
+     * @param encryptedHcPartyKeys The encryptedHcPartyKeys to be decrypted
+     * @param publicKeys The public keys for which we might have a private key
+     *
+     * @returns - **delegatorId** the input param  `delegatorId`
+     * - **key** the decrypted `encryptedHcPartyKey`
+     */
+    decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, publicKeys) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!publicKeys.length) {
+                const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: no public key`;
+                console.warn(reason);
+                throw new Error(reason);
+            }
+            const cacheKey = `${delegateHcPartyId}|${publicKey.slice(-32)}|${delegatorId}`;
+            const res = this.hcPartyKeysCache[cacheKey];
+            if (res) {
+                return res;
+            }
+            const result = yield publicKeys.reduce((res, pk) => __awaiter(this, void 0, void 0, function* () {
+                var _b;
+                const delegatorAndKeys = yield res;
+                if (delegatorAndKeys) {
+                    return delegatorAndKeys;
+                }
+                const fingerprint = pk.slice(-32);
+                const keyPair = (_b = this.rsaKeyPairs[fingerprint]) !== null && _b !== void 0 ? _b : (yield this.cacheKeyPair(this.loadKeyPairNotImported(loggedHcPartyId, fingerprint)));
+                if (!keyPair) {
+                    return;
+                }
+                const encryptedHcPartyKey = encryptedHcPartyKeys[fingerprint];
+                if (!encryptedHcPartyKey) {
+                    return;
+                }
+                try {
+                    const decryptedAesExchangeKey = yield this._RSA.decrypt(keyPair.privateKey, (0, binary_utils_1.hex2ua)(encryptedHcPartyKey));
+                    const importedAesExchangeKey = yield this._AES.importKey('raw', decryptedAesExchangeKey);
+                    return (this.hcPartyKeysCache[cacheKey] = {
+                        delegatorId: delegatorId,
+                        key: importedAesExchangeKey,
+                        rawKey: (0, binary_utils_1.ua2hex)(new Uint8Array(decryptedAesExchangeKey)),
+                    });
+                }
+                catch (e) {
+                    const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId} for pubKey ${fingerprint}: impossible to decrypt`;
+                    console.log(reason);
+                }
+            }), Promise.resolve());
+            const availablePublicKeys = publicKeys.filter((pk) => this.rsaKeyPairs[pk.slice(-32)]);
+            if (!result) {
+                //Try to find another key from the transfer keys
+                const hcp = (yield this.getDataOwner(loggedHcPartyId));
+                const candidates = Object.entries((_a = hcp.dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {})
+                    .filter(([fp, _]) => availablePublicKeys.some((pk) => pk.slice(-32) === fp.slice(-32))) // only keep keys that we will be able to decrypt
+                    .flatMap(([pk, keys]) => Object.entries(keys).map(([k, v]) => [pk, k, v]))
+                    .filter(([_, k]) => !publicKeys.some((apk) => apk.slice(-32) === k.slice(-32)));
+                if (candidates.length) {
+                    const newPublicKeys = yield candidates.reduce((p, [decryptionKeyFingerprint, privateKeyFingerprint, encryptedPrivateKey]) => __awaiter(this, void 0, void 0, function* () {
+                        var _c, _d;
+                        const newKeys = yield p;
+                        const aesExchangeKeys = (_c = Object.entries(hcp.dataOwner.aesExchangeKeys).find(([fp, _]) => fp.slice(-32) === privateKeyFingerprint.slice(-32))) === null || _c === void 0 ? void 0 : _c[1][loggedHcPartyId];
+                        if (aesExchangeKeys) {
+                            const encryptedAesExchangeKey = (_d = Object.entries(aesExchangeKeys).find(([fp, _]) => fp.slice(-32) === decryptionKeyFingerprint.slice(-32))) === null || _d === void 0 ? void 0 : _d[1];
+                            if (encryptedAesExchangeKey) {
+                                const keyPair = this.rsaKeyPairs[decryptionKeyFingerprint.slice(-32)];
+                                if (!keyPair) {
+                                    return newKeys;
+                                }
+                                const decryptedAesExchangeKey = yield this._RSA.decrypt(keyPair.privateKey, (0, binary_utils_1.hex2ua)(encryptedAesExchangeKey));
+                                const importedAesExchangeKey = yield this._AES.importKey('raw', decryptedAesExchangeKey);
+                                const decryptedPrivateKey = yield this._AES.decrypt(importedAesExchangeKey, (0, binary_utils_1.hex2ua)(encryptedPrivateKey));
+                                const newPublicKey = Object.keys(hcp.dataOwner.aesExchangeKeys).find((fp) => fp.slice(-32) === privateKeyFingerprint.slice(-32));
+                                yield this.cacheKeyPair({
+                                    publicKey: (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(newPublicKey)),
+                                    privateKey: (0, utils_1.pkcs8ToJwk)(decryptedPrivateKey),
+                                });
+                                return newKeys.concat([newPublicKey]);
+                            }
+                        }
+                        return newKeys;
+                    }), Promise.resolve([]));
+                    if (newPublicKeys.length) {
+                        return yield this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, newPublicKeys);
+                    }
+                }
+                const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: impossible to decrypt. No private key was found or could be used to decrypt the aes exchange keys`;
+                console.log(reason);
+                throw new Error(reason);
+            }
+            return result;
+        });
+    }
+    /**
+     * Cache the RSA private/public key pair for the HcP with the given id `hcPartyKeyOwner`
+     */
+    cacheKeyPair(keyPairInJwk) {
+        return this._RSA.importKeyPair('jwk', keyPairInJwk.privateKey, 'jwk', keyPairInJwk.publicKey).then((importedKeyPair) => {
+            const pk = (0, utils_1.jwk2spki)(keyPairInJwk.publicKey);
+            return (this.rsaKeyPairs[pk.slice(-32)] = importedKeyPair);
+        });
+    }
+    /**
+     * Gets the secret ID (SFKs) that should be used in the prescribed context (confidential or not) from decrypted SPKs of the given `parent`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
+     * @param parent :the object of which delegations (SPKs) to decrypt
+     * @param hcpartyId :the id of the delegate HcP
+     * @param confidential :weather the key is going to be used for a confidential piece or data or not
+     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
+     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    extractPreferredSfk(parent, hcpartyId, confidential) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const secretForeignKeys = yield this.extractSFKsHierarchyFromDelegations(parent, hcpartyId);
+            const keys = secretForeignKeys
+                .filter(({ extractedKeys }) => extractedKeys.length > 0)
+                .filter((x, idx) => (confidential ? x.hcpartyId === hcpartyId : idx === 0))[0];
+            return ((keys &&
+                (confidential
+                    ? keys.extractedKeys.find((k) => !secretForeignKeys.some(({ extractedKeys, hcpartyId: parentHcpId }) => hcpartyId !== parentHcpId && extractedKeys.includes(k)))
+                    : keys.extractedKeys[0])) ||
+                undefined);
+        });
+    }
+    /**
+     * Gets an array of decrypted HcPartyKeys, shared between the delegate with ID `delegateHcPartyId` and the delegators in `delegatorsHcPartyIdsSet`
+     *
+     * 1. Get the keys for the delegateHealthCareParty (cache/backend).
+     * 2. For each key in the delegators, decrypt it with the delegate's private key
+     * 3. Filter out undefined keys and return them
+     *
+     * @param delegatorsHcPartyIdsSet array of delegator HcP IDs that could have delegated something to the HcP with ID `delegateHcPartyId`
+     * @param delegateHcPartyId the HcP for which the HcPs with IDs in `delegatorsHcPartyIdsSet` could have delegated something
+     * @param minCacheDurationInSeconds The minimum cache duration
+     * @returns - **delegatorId** : the id of the delegator HcP that shares the **key** with the `delegateHcPartyId`
+     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `delegateHcPartyId`
+     */
+    decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds = 60) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const aesExchangeKeys = yield (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
+                (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId))).then((delegatorIdsWithDelegateEncryptedHcPartyKeys) => __awaiter(this, void 0, void 0, function* () {
+                // [key: delegatorId] = delegateEncryptedHcPartyKey
+                // For each delegatorId, obtain the AES key (decrypted HcParty Key) shared with the delegate, decrypted by the delegate
+                return (yield Promise.all(delegatorsHcPartyIdsSet.map((delegatorId) => __awaiter(this, void 0, void 0, function* () {
+                    const encryptedHcPartyKeysForPubKeyFingerprint = delegatorIdsWithDelegateEncryptedHcPartyKeys[delegatorId];
+                    if (!encryptedHcPartyKeysForPubKeyFingerprint) {
+                        return [];
+                    }
+                    const decryptedKeys = yield Promise.all(Object.entries(encryptedHcPartyKeysForPubKeyFingerprint).map(([delegatorPubKeyFinerprint, encryptedAesExchangeKeys]) => __awaiter(this, void 0, void 0, function* () {
+                        try {
+                            return yield this.decryptHcPartyKey(delegateHcPartyId, delegatorId, delegateHcPartyId, delegatorPubKeyFinerprint, encryptedAesExchangeKeys, Object.keys(this.rsaKeyPairs));
+                        }
+                        catch (e) {
+                            console.log(`failed to decrypt hcPartyKey from ${delegatorId} to ${delegateHcPartyId}`);
+                            return;
+                        }
+                    })));
+                    return decryptedKeys.filter((x) => !!x);
+                })))).reduce((acc, x) => [...acc, ...x], []);
+            }));
+            if (aesExchangeKeys.length > 0) {
+                return aesExchangeKeys;
+            }
+            const nowTimestamp = +new Date();
+            if (!this.cacheLastDeletionTimestamp || (nowTimestamp - this.cacheLastDeletionTimestamp) / 1000 >= minCacheDurationInSeconds) {
+                delete this.hcPartyKeysRequestsCache[delegateHcPartyId];
+                this.cacheLastDeletionTimestamp = nowTimestamp;
+                return this.decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds);
+            }
+            return [];
+        });
+    }
+    /**
+     * Gets an array of decrypted HcPartyKeys from the given `delegations`, that are shared with / can be decrypted by the HcP with the given `healthcarePartyId` (or by its parents when `fallbackOnParent` is true)
+     *
+     * 1. Checks whether the delegations' object has a delegation for the
+     * given healthCarePartyId.
+     * 2. Enumerates all the delegators (delegation.owner) present in
+     * the delegations.
+     * 3. Decrypt's delegators' keys and returns them.
+     *
+     * @param dataOwnerId : the id of the delegate HCP
+     * @param delegations : delegations (can be SPKs, CFKs, EKs) for all delegates
+     * @param fallbackOnParent  default true; use parent's healthCarePartyId in case there's no delegation for the `healthcarePartyId`
+     * @returns  - **delegatorId** : the id of the delegator HcP that shares the **key** with the `healthcarePartyId`
+     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `healthcarePartyId`
+     */
+    getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, fallbackOnParent = true) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const delegationsArray = (_a = delegations[dataOwnerId]) !== null && _a !== void 0 ? _a : [];
+            if (!delegationsArray.length && fallbackOnParent) {
+                const { dataOwner: hcp } = yield this.getDataOwner(dataOwnerId);
+                return hcp.parentId
+                    ? yield this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(hcp.parentId, delegations)
+                    : [];
+            }
+            else {
+                const delegatorIds = new Set();
+                delegationsArray.forEach((del) => delegatorIds.add(del.owner));
+                return this.decryptAndImportAesHcPartyKeysForDelegators(Array.from(delegatorIds), dataOwnerId);
+            }
+        });
+    }
+    /**
+     * Retrieve the owner HealthCareParty key and use it to encrypt
+     * both the delegations (createdObject.id) and the cryptedForeignKeys
+     * (parentObject.id), and returns them in an object.
+     */
+    initObjectDelegations(createdObject, parentObject, ownerId, secretForeignKeyOfParent) {
+        return __awaiter(this, arguments, void 0, function* () {
+            const publicKeys = yield this.getPublicKeys();
+            this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initObjectDelegations', arguments);
+            if (parentObject)
+                this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject.id, 'initObjectDelegations', arguments);
+            const secretId = this.randomUuid();
+            return this.getDataOwner(ownerId).then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
+                const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, ownerId);
+                const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys);
+                const encryptedDelegation = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId).buffer, importedAESHcPartyKey.rawKey);
+                const encryptedSecretForeignKey = parentObject &&
+                    this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey);
+                return {
+                    owner: modifiedOwner,
+                    delegations: _.fromPairs([
+                        [
+                            ownerId,
+                            [
+                                {
+                                    owner: ownerId,
+                                    delegatedTo: ownerId,
+                                    key: (0, binary_utils_1.ua2hex)(encryptedDelegation),
+                                },
+                            ],
+                        ],
+                    ]),
+                    cryptedForeignKeys: (encryptedSecretForeignKey &&
+                        _.fromPairs([
+                            [
+                                ownerId,
+                                [
+                                    {
+                                        owner: ownerId,
+                                        delegatedTo: ownerId,
+                                        key: (0, binary_utils_1.ua2hex)(encryptedSecretForeignKey),
+                                    },
+                                ],
+                            ],
+                        ])) ||
+                        {},
+                    secretForeignKeys: (secretForeignKeyOfParent && [secretForeignKeyOfParent]) || [],
+                    secretId: secretId,
+                };
+            }));
+        });
+    }
+    decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, loggedHcPartyId, delegatorId, delegateHcPartyId, publicKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const importedAESHcPartyKey = yield Object.entries(aesExchangeKeys).reduce((acc, [publicKeyIdentifier, hcPartyKeys]) => __awaiter(this, void 0, void 0, function* () {
+                const accValue = yield acc;
+                if (accValue) {
+                    return accValue;
+                }
+                try {
+                    return yield this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKeyIdentifier, hcPartyKeys, publicKeys);
+                }
+                catch (e) {
+                    return undefined;
+                }
+            }), Promise.resolve());
+            if (!importedAESHcPartyKey) {
+                throw new Error(`No hcParty key can be decrypted from ${delegatorId} to ${delegateHcPartyId} using currently available private keys`);
+            }
+            return importedAESHcPartyKey;
+        });
+    }
+    /**
+     * Gets updated instances of SPKs and CKFs for the child object `modifiedObject`.
+     * These updated SPKs and CKFs contain new SPKs/CFKs to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
+     *
+     * 1. if `secretIdOfModifiedObject` is not provided, the method will throw an exception; this `secretIdOfModifiedObject` is used to generate a new delegation (SPK) in step 3;
+     *  the `secretIdOfModifiedObject` is returned, unmodified, as `secretId`
+     * 2. if the owner (delegator) did not perform a delegation to the delegate, then this HcP delegation (creation of a new HcPKey) is performed now
+     * 3. creates a new delegation (Secret Primary Keys) on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
+     * 4. if `parentObject` != null, creates a new CFK on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
+     * 5. this new delegation (from step 3) is added to the list of existing delegations (Secret Primary Keys) on the `modifiedObject` for the delegate given by `delegateId`
+     * 6. if the CFK (from step 4) can be created, this new CFK is added to the list of existing CFKs on the `modifiedObject` for the delegate given by `delegateId`
+     * 7. then some duplicates delegations (SPKs) and CKFs are removed
+     *
+     * @param modifiedObject : the object of which SPKs and CFKs will be cloned, the clones will be modified and then used as returned values ; it's a 'child' of `parentObject`; will NOT be mutated
+     * @param parentObject : will NOT be mutated
+     * @param ownerId : the HcP id of the delegator
+     * @param delegateId : the HcP id of the delegate
+     * @param secretIdOfModifiedObject : the secret id used in the child object to generate its SPK
+     * @returns - **delegations**  existing delegations (SPKs) of the `modifiedObject`, appended with results from step 5
+     * - **cryptedForeignKeys** existing CFKs of the `modifiedObject`, appended with results from steps 6
+     * - **secretId** which is the given input parameter `secretIdOfModifiedObject`
+     */
+    extendedDelegationsAndCryptedForeignKeys(
+    //TODO: suggested name: getExtendedChildObjectSPKandCFKwithDelegationFromDelegatorToDelegate
+    modifiedObject, parentObject, ownerId, delegateId, secretIdOfModifiedObject) {
+        this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments); //modifiedObject should never be null
+        if (parentObject)
+            this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject === null || parentObject === void 0 ? void 0 : parentObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments);
+        this.throwDetailedExceptionForInvalidParameter('secretIdOfModifiedObject', secretIdOfModifiedObject, 'extendedDelegationsAndCryptedForeignKeys', arguments);
+        return this.getDataOwner(ownerId)
+            .then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
+            const publicKeys = yield this.getPublicKeys();
+            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
+            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, delegateId, ownerId, publicKeys);
+            modifiedObject = (modifiedObject === null || modifiedObject === void 0 ? void 0 : modifiedObject.id) === owner.id ? modifiedOwner : modifiedObject;
+            return {
+                previousDecryptedDelegations: yield Promise.all(((modifiedObject.delegations || {})[delegateId] || []).map((d) => (d.key &&
+                    d.owner === ownerId &&
+                    this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                        console.log(`Cannot decrypt delegation from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                        return Promise.resolve();
+                    })) ||
+                    Promise.resolve())),
+                previousDecryptedCryptedForeignKeys: yield Promise.all(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => (d.key &&
+                    d.owner === ownerId &&
+                    this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                        console.log(`Cannot decrypt cryptedForeignKeys from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                        return Promise.resolve();
+                    })) ||
+                    Promise.resolve())),
+                cryptedDelegation: yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretIdOfModifiedObject).buffer, importedAESHcPartyKey.rawKey),
+                cryptedForeignKey: parentObject
+                    ? yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
+                    : undefined,
+            };
+        }))
+            .then(({ previousDecryptedDelegations, previousDecryptedCryptedForeignKeys, cryptedDelegation, cryptedForeignKey }) => {
+            //try to limit the extent of the modifications to the delegations by preserving the redundant delegation already present and removing duplicates
+            //For delegate delegateId, we create:
+            // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for each existing delegation and the new key concatenated
+            // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
+            // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
+            const delegationCryptedDecrypted = _.merge(((modifiedObject.delegations || {})[delegateId] || []).map((d) => ({
+                d,
+            })), (previousDecryptedDelegations || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
+                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
+                .map(({ d, k }) => ({
+                d,
+                k: k || this.randomUuid(),
+            })) // Use some unique id that ensures the delegation not created by us are going to be held
+                .concat([
+                {
+                    d: {
+                        owner: ownerId,
+                        delegatedTo: delegateId,
+                        key: (0, binary_utils_1.ua2hex)(cryptedDelegation),
+                    },
+                    k: modifiedObject.id + ':' + secretIdOfModifiedObject,
+                },
+            ]);
+            const allDelegations = _.cloneDeep(modifiedObject.delegations || {});
+            //Only keep one version of the decrypted key
+            allDelegations[delegateId] = _.uniqBy(delegationCryptedDecrypted, (x) => x.k).map((x) => x.d);
+            const cryptedForeignKeysCryptedDecrypted = _.merge(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => ({
+                d,
+            })), (previousDecryptedCryptedForeignKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
+                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
+                .map(({ d, k }) => ({
+                d,
+                k: k || this.randomUuid(),
+            })) // Use some unique id that ensures the delegation not created by us are going to be held
+                .concat(cryptedForeignKey
+                ? [
+                    {
+                        d: {
+                            owner: ownerId,
+                            delegatedTo: delegateId,
+                            key: (0, binary_utils_1.ua2hex)(cryptedForeignKey),
+                        },
+                        k: modifiedObject.id + ':' + (parentObject === null || parentObject === void 0 ? void 0 : parentObject.id),
+                    },
+                ]
+                : []);
+            const allCryptedForeignKeys = _.cloneDeep(modifiedObject.cryptedForeignKeys || {});
+            if (cryptedForeignKeysCryptedDecrypted.length > 0) {
+                allCryptedForeignKeys[delegateId] = _.uniqBy(cryptedForeignKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
+            }
+            return {
+                modifiedObject,
+                delegations: allDelegations,
+                cryptedForeignKeys: allCryptedForeignKeys,
+                secretId: secretIdOfModifiedObject,
+            };
+        });
+    }
+    getEncryptedAesExchangeKeys(owner, delegateId) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            const publicKeys = yield this.getPublicKeys();
+            const mapOfAesExchangeKeys = Object.entries((_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})
+                .filter((e) => e[1][delegateId] && Object.keys(e[1][delegateId]).some((k1) => publicKeys.some((pk) => pk.endsWith(k1))))
+                .reduce((map, e) => {
+                const candidates = Object.entries(e[1][delegateId]);
+                const [publicKeyFingerprint, encryptedAesExchangeKey] = candidates[candidates.findIndex(([k, v]) => publicKeys.some((pk) => pk.endsWith(k)))];
+                return Object.assign(Object.assign({}, map), { [e[0]]: { [publicKeyFingerprint]: encryptedAesExchangeKey } });
+            }, {});
+            return !owner.publicKey || mapOfAesExchangeKeys[owner.publicKey] || !((_b = owner.hcPartyKeys) === null || _b === void 0 ? void 0 : _b[delegateId]) || (publicKeys.find((p) => p == owner.publicKey) == undefined)
+                ? mapOfAesExchangeKeys
+                : Object.assign(Object.assign({}, mapOfAesExchangeKeys), { [owner.publicKey]: { [owner.publicKey.slice(-32)]: owner.hcPartyKeys[delegateId][0] } });
+        });
+    }
+    getOrCreateHcPartyKeys(owner, delegateId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const aesExchangeKeys = yield this.getEncryptedAesExchangeKeys(owner, delegateId);
+            if (Object.keys(aesExchangeKeys).length) {
+                return { owner, aesExchangeKeys };
+            }
+            const modifiedOwner = yield this.generateKeyForDelegate(owner.id, delegateId);
+            return { owner: modifiedOwner, aesExchangeKeys: yield this.getEncryptedAesExchangeKeys(modifiedOwner, delegateId) };
+        });
+    }
+    /**
+     * Retrieve the owners HealthCareParty key, decrypt it, and
+     * use it to encrypt & initialize the "encryptionKeys" object
+     * and return it.
+     * @param createdObject
+     * @param ownerId
+     */
+    initEncryptionKeys(createdObject, ownerId) {
+        this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initEncryptionKeys', arguments);
+        const secretId = this.randomUuid();
+        return this.getDataOwner(ownerId).then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
+            const publicKeys = yield this.getPublicKeys();
+            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, ownerId);
+            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys);
+            const encryptedEncryptionKeys = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId), importedAESHcPartyKey.rawKey);
+            return {
+                encryptionKeys: _.fromPairs([
+                    [
+                        ownerId,
+                        [
+                            {
+                                owner: ownerId,
+                                delegatedTo: ownerId,
+                                key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKeys),
+                            },
+                        ],
+                    ],
+                ]),
+                secretId: secretId,
+            };
+        }));
+    }
+    /**
+     * Gets an updated instance of the EKs of `modifiedObject`.
+     * The updated EKs contain a new EK to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`.
+     * @param modifiedObject : the object of which EKs will be cloned, the clone will be used to append the new EK, and then used as return value; will NOT be mutated
+     * @param ownerId : delegator HcP id
+     * @param delegateId : delegate HcP id
+     * @param secretEncryptionKeyOfObject : secret Id for the EK (Content Encryption Key)
+     * @returns - **encryptionKeys** existing EKs of the `modifiedObject`, appended with a new EK item (owner: `ownerId`, delegatedTo: `delegateId`, encrypted key with secretId: `secretEncryptionKeyOfObject` )
+     * - **secretId** which is the given input parameter `secretEncryptionKeyOfObject`
+     */
+    appendEncryptionKeys(
+    //TODO: suggested name: getExtendedEKwithDelegationFromDelegatorToDelegate
+    modifiedObject, ownerId, delegateId, secretEncryptionKeyOfObject) {
+        return __awaiter(this, arguments, void 0, function* () {
+            this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'appendEncryptionKeys', arguments); //modifiedObject should never be null
+            this.throwDetailedExceptionForInvalidParameter('secretEncryptionKeyOfObject', secretEncryptionKeyOfObject, 'appendEncryptionKeys', arguments);
+            return this.getDataOwner(ownerId)
+                .then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
+                const publicKeys = yield this.getPublicKeys();
+                const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
+                const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, delegateId, publicKeys);
+                return {
+                    previousDecryptedEncryptionKeys: yield Promise.all(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => (d.key &&
+                        d.owner === ownerId &&
+                        this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
+                            console.log(`Cannot decrypt encryption key from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
+                            return Promise.resolve();
+                        })) ||
+                        Promise.resolve())),
+                    encryptedEncryptionKey: yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretEncryptionKeyOfObject)),
+                };
+            }))
+                .then(({ previousDecryptedEncryptionKeys, encryptedEncryptionKey }) => {
+                //try to limit the extent of the modifications to the delegations by preserving the redundant encryption keys already present and removing duplicates
+                //For delegate delegateId, we create:
+                // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for the existing encryption keys and the new key concatenated
+                // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
+                // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
+                const encryptionKeysCryptedDecrypted = _.merge(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => ({
+                    d,
+                })), (previousDecryptedEncryptionKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
+                    .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
+                    .map(({ d, k }) => ({ d, k: k || this.randomUuid() }))
+                    .concat([
+                    {
+                        d: {
+                            owner: ownerId,
+                            delegatedTo: delegateId,
+                            key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKey),
+                        },
+                        k: modifiedObject.id + ':' + secretEncryptionKeyOfObject,
+                    },
+                ]);
+                const allEncryptionKeys = _.cloneDeep(modifiedObject.encryptionKeys);
+                allEncryptionKeys[delegateId] = _.uniqBy(encryptionKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
+                return {
+                    encryptionKeys: allEncryptionKeys,
+                    secretId: secretEncryptionKeyOfObject,
+                };
+            });
+        });
+    }
+    /**
+     * Gets an updated `child` object that will have its SPKs, CFKs, KSs updated to include delegations from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
+     * The SFKs of `child` are not updated, so this method assumes this is not the initial delegation on the `child` object
+     * The method also performs some deduplication of all types of delegations.
+     * @param parent : the parent object of `child`; will NOT be mutated
+     * @param child : the object that will be mutated and returned
+     * @param ownerId delegator HcP id
+     * @param delegateId delegate HcP id
+     * @param secretDelegationKey  the secret Id used in the child object to generate the SPK
+     * @param secretEncryptionKey  the secret Id used in the child object to generate the EK (Content Encryption Key)
+     * @returns - an updated `child` object that will contain updated SPKs, CFKs, EKs
+     *  */
+    addDelegationsAndEncryptionKeys(
+    //TODO: suggested name: updateChildGenericDelegationsFromDelegatorToDelegate
+    parent, child, ownerId, delegateId, secretDelegationKey, secretEncryptionKey) {
+        if (parent)
+            this.throwDetailedExceptionForInvalidParameter('parent.id', parent.id, 'addDelegationsAndEncryptionKeys', arguments);
+        this.throwDetailedExceptionForInvalidParameter('child.id', child.id, 'addDelegationsAndEncryptionKeys', arguments);
+        return (secretDelegationKey
+            ? this.extendedDelegationsAndCryptedForeignKeys(child, parent, ownerId, delegateId, secretDelegationKey)
+            : Promise.resolve({ delegations: {}, cryptedForeignKeys: {} }))
+            .then((extendedChildObjectSPKsAndCFKs) => secretEncryptionKey
+            ? this.appendEncryptionKeys(child, ownerId, delegateId, secretEncryptionKey).then(
+            //TODO: extendedDelegationsAndCryptedForeignKeys and appendEncryptionKeys can be done in parallel
+            (extendedChildObjectEKs) => ({
+                extendedSPKsAndCFKs: extendedChildObjectSPKsAndCFKs,
+                extendedEKs: extendedChildObjectEKs,
+            }))
+            : Promise.resolve({
+                extendedSPKsAndCFKs: extendedChildObjectSPKsAndCFKs,
+                extendedEKs: { encryptionKeys: {} },
+            }))
+            .then(({ extendedSPKsAndCFKs: extendedChildObjectSPKsAndCFKs, extendedEKs: extendedChildObjectEKs }) => {
+            return _.assign(child, {
+                // Conservative version ... We might want to be more aggressive with the deduplication of keys
+                // For each delegate, we are going to concatenate to the src (the new delegations), the object in dest (the current delegations)
+                // for which we do not find an equivalent delegation (same delegator, same delegate)
+                delegations: _.assignWith(child.delegations, extendedChildObjectSPKsAndCFKs.delegations, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
+                cryptedForeignKeys: _.assignWith(child.cryptedForeignKeys, extendedChildObjectSPKsAndCFKs.cryptedForeignKeys, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
+                encryptionKeys: _.assignWith(child.encryptionKeys, extendedChildObjectEKs.encryptionKeys, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
+            });
+        });
+    }
+    /**
+     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
+     * @param document : the object of which delegations (SPKs) to decrypt
+     * @param hcpartyId : the id of the delegate HcP
+     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
+     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent; is this ok?
+    extractDelegationsSFKs(
+    //TODO: suggested name: getSecretIDsSPKofHcpAndParentsFromDocument
+    document, hcpartyId) {
+        if (!document || !hcpartyId) {
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId }); //TODO: thow exception instead?
+        }
+        const delegationsForAllDelegates = document.delegations;
+        if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
+            console.log(`There is no delegation in document (${document.id})`);
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, delegationsForAllDelegates);
+    }
+    /**
+     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
+     * @param document : the object of which delegations (SPKs) to decrypt
+     * @param hcpartyId : the id of the delegate HcP
+     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
+     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    extractSFKsHierarchyFromDelegations(document, hcpartyId) {
+        if (!document || !hcpartyId) {
+            return Promise.resolve([]);
+        }
+        const delegationsForAllDelegates = document.delegations;
+        if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
+            console.log(`There is no delegation in document (${document.id})`);
+            return Promise.resolve([]);
+        }
+        return this.extractKeysHierarchyFromDelegationLikes(hcpartyId, document.id, delegationsForAllDelegates);
+    }
+    // noinspection JSUnusedGlobalSymbols
+    extractCryptedFKs(
+    //TODO: suggested name: getSecretIDsCFKofHcpAndParentsFromDocument
+    document, hcpartyId) {
+        if (!document || !document.cryptedForeignKeys) {
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        const cfksForAllDelegates = document.cryptedForeignKeys;
+        if (!cfksForAllDelegates || !Object.keys(cfksForAllDelegates).length) {
+            console.log(`There is no cryptedForeignKeys in document (${document.id})`);
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, cfksForAllDelegates);
+    }
+    extractEncryptionsSKs(
+    //TODO: suggested name: getSecretIDsEKofHcpAndParentsFromDocument
+    document, hcpartyId) {
+        if (!document.encryptionKeys) {
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        const eckeysForAllDelegates = document.encryptionKeys;
+        if (!eckeysForAllDelegates || !Object.keys(eckeysForAllDelegates).length) {
+            //console.log(`There is no encryption key in document (${document.id})`)
+            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+        }
+        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, eckeysForAllDelegates);
+    }
+    extractDelegationsSFKsAndEncryptionSKs(ety, ownerId) {
+        const delegationsSfksOwnerPromise = this.extractDelegationsSFKs(ety, ownerId).then((xks) => xks.extractedKeys); //Will climb up hierarchy
+        const encryptionKeysOwnerPromise = this.extractEncryptionsSKs(ety, ownerId).then((xks) => xks.extractedKeys); //Will climb up hierarchy
+        return Promise.all([delegationsSfksOwnerPromise, encryptionKeysOwnerPromise]);
+    }
+    /**
+     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
+     * 1. Get HealthCareParty from it's Id.
+     * 2. Decrypt the keys of the given HCP.
+     * 3. Decrypt the parent's key if it has parent.
+     * 4. Return the decrypted key corresponding to the Health Care Party.
+     * @param hcpartyId : the id of the delegate HcP (including its parents) for which to decrypt `extractedKeys`
+     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
+     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
+     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both HCP with given `hcpartyId` and its parents; can contain duplicates
+     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HCP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent
+    extractKeysHierarchyFromDelegationLikes(
+    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
+    hcpartyId, objectId, delegations) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const { dataOwner: hcp } = yield this.getDataOwner(hcpartyId);
+            const extractedKeys = [];
+            if ((_a = delegations[hcpartyId]) === null || _a === void 0 ? void 0 : _a.length) {
+                const decryptedAndImportedAesHcPartyKeys = yield this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(hcpartyId, delegations, false);
+                const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce((map, k) => (Object.assign(Object.assign({}, map), { [k.delegatorId]: k })), {});
+                extractedKeys.push(...(yield this.decryptKeyInDelegationLikes(delegations[hcpartyId], collatedAesKeysFromDelegatorToHcpartyId, objectId)));
+            }
+            return hcp.parentId
+                ? [
+                    ...(yield this.extractKeysHierarchyFromDelegationLikes(hcp.parentId, objectId, delegations)),
+                    { extractedKeys: extractedKeys, hcpartyId: hcpartyId },
+                ]
+                : [{ extractedKeys: extractedKeys, hcpartyId: hcpartyId }];
+        });
+    }
+    /**
+     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
+     * 1. Get Data Owner (HCP, Patient or Device) from it's Id.
+     * 2. Decrypt the keys of the given data owner.
+     * 3. Decrypt the parent's key if it has parent.
+     * 4. Return the decrypted key corresponding to the Health Care Party.
+     * @param dataOwnerId : the id of the delegate data owner (including its parents) for which to decrypt `extractedKeys`
+     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
+     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
+     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both data owner with given `dataOwnerId` and its parents; can contain duplicates
+     * - **dataOwnerId** the given `dataOwnerId` OR, if a parent exist, the data owner id of the top parent in the hierarchy  (even if that parent has no delegations)
+     */
+    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned dataOwnerId will be the one of the parent
+    extractKeysFromDelegationsForHcpHierarchy(
+    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
+    dataOwnerId, objectId, delegations) {
+        return this.getDataOwner(dataOwnerId).then(({ dataOwner: hcp }) => (delegations[dataOwnerId] && delegations[dataOwnerId].length
+            ? this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, false).then((decryptedAndImportedAesHcPartyKeys) => {
+                const collatedAesKeysFromDelegatorToHcpartyId = {};
+                decryptedAndImportedAesHcPartyKeys.forEach((k) => {
+                    var _a;
+                    ;
+                    ((_a = collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId]) !== null && _a !== void 0 ? _a : (collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] = [])).push(k);
+                });
+                return this.decryptKeyInDelegationLikes(delegations[dataOwnerId], collatedAesKeysFromDelegatorToHcpartyId, objectId);
+            })
+            : Promise.resolve([])).then((extractedKeys) => hcp.parentId
+            ? this.extractKeysFromDelegationsForHcpHierarchy(hcp.parentId, objectId, delegations).then((parentResponse) => _.assign(parentResponse, {
+                extractedKeys: parentResponse.extractedKeys.concat(extractedKeys),
+            }))
+            : { extractedKeys: extractedKeys, hcpartyId: dataOwnerId }));
+    }
+    /**
+     * Gets an array of generic secret IDs decrypted from a list of generic delegations (SPKs, CFKs, EKs) `delegationsArray`
+     * If a particular generic delegation thows an exception when decrypted, the return value for it's secret ID will be 'false' and a message is logged to console
+     * For each one of the delegations in the `delegationsArray`, it tries to decrypt with the decryptedHcPartyKey of the owner of that delegation;
+     *
+     * @param delegationsArray : generic delegations array
+     * @param aesKeys : **key** HcP ids of delegators/owners in the `delegationsArray`, each with its own decryptedHcPartyKey
+     * @param masterId : is the object id to which the generic delegation belongs to
+     * - used only to check whether the object.id matches the one stored in the decrypted generic delegation item
+     * - even if there's no match, the secret ID is kept as a valid result (and a message logged to console)
+     * @returns array of generic secret IDs (secretIdSPK, parentId, secretIdEK)
+     */
+    decryptKeyInDelegationLikes(
+    //TODO: suggested name: getSecretIdsFromGenericDelegations
+    delegationsArray, aesKeysForDataOwnerId, masterId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const decryptPromises = delegationsArray.map((genericDelegationItem) => __awaiter(this, void 0, void 0, function* () {
+                const aesKeys = aesKeysForDataOwnerId[genericDelegationItem.owner];
+                if (aesKeys === null || aesKeys === void 0 ? void 0 : aesKeys.length) {
+                    return aesKeys.reduce((acc, aesKey) => __awaiter(this, void 0, void 0, function* () {
+                        const accValue = yield acc;
+                        if (accValue) {
+                            return accValue;
+                        }
+                        try {
+                            const decryptedGenericDelegationKey = yield this._AES.decrypt(aesKey.key, (0, binary_utils_1.hex2ua)(genericDelegationItem.key), aesKey.rawKey);
+                            const results = (0, binary_utils_1.ua2string)(decryptedGenericDelegationKey).split(':');
+                            const objectId = results[0]; //must be the ID of the object, for checksum
+                            const genericSecretId = results[1];
+                            const details = 'object ID: ' + masterId + '; generic delegation from ' + genericDelegationItem.owner + ' to ' + genericDelegationItem.delegatedTo;
+                            if (!objectId)
+                                console.warn('Object id is empty; ' + details);
+                            if (!genericSecretId)
+                                console.warn('Secret id is empty; ' + details);
+                            if (objectId !== masterId) {
+                                /*console.log(
+                                  "Cryptographic mistake: object ID is not equal to the expected concatenated id within decrypted generic delegation. This may happen when patients have been merged; " +
+                                    details
+                                )*/
+                            }
+                            return genericSecretId;
+                        }
+                        catch (err) {
+                            console.log(`Could not decrypt generic delegation in object with ID: ${masterId} from ${genericDelegationItem.owner} to ${genericDelegationItem.delegatedTo}: ${err}`);
+                            console.log(`AES key is: ${aesKey.rawKey}. Encrypted data is ${genericDelegationItem.key}.`);
+                            return undefined;
+                        }
+                    }), Promise.resolve());
+                }
+                else {
+                    console.log(`Could not find aes key for object with ID: ${masterId}`);
+                }
+            }));
+            return Promise.all(decryptPromises).then((genericSecretId) => genericSecretId.filter((id) => !!id));
+        });
+    }
+    getPublicKeyFromPrivateKey(privateKey, dataOwner) {
+        var _a;
+        if (!privateKey.n || !privateKey.e) {
+            throw new Error('No public key can be deduced from incomplete private key');
+        }
+        const publicKeyFromPrivateKey = (0, utils_1.jwk2spki)(privateKey);
+        const publicKeys = [dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x);
+        if (!publicKeys.length) {
+            throw new Error('No public key has been defined for hcp');
+        }
+        const publicKey = publicKeys.find((it) => it === publicKeyFromPrivateKey);
+        if (!publicKey) {
+            throw new Error('No public key can be found for this private key');
+        }
+        return publicKey;
+    }
+    loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, privateKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
+            const privateKeyInJwk = (0, utils_1.pkcs8ToJwk)(privateKey);
+            const publicKey = this.getPublicKeyFromPrivateKey(privateKeyInJwk, dataOwner);
+            const keyPair = yield this._RSA.importKeyPair('jwk', privateKeyInJwk, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
+            this.rsaKeyPairs[publicKey.slice(-32)] = keyPair;
+            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
+            return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
+        });
+    }
+    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privateKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
+            if ((!privateKey.n || !privateKey.e) && dataOwner.publicKey) {
+                //Fallback on default publicKey
+                console.warn('An incomplete key has been completed using the default public key of the data owner');
+                const publicKeyInJwk = (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(dataOwner.publicKey));
+                privateKey.n = publicKeyInJwk.n;
+                privateKey.e = publicKeyInJwk.e;
+            }
+            const publicKey = this.getPublicKeyFromPrivateKey(privateKey, dataOwner);
+            const keyPair = yield this._RSA.importKeyPair('jwk', privateKey, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
+            this.rsaKeyPairs[healthcarePartyId] = keyPair;
+            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
+            return this.storeKeyPair(`${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
+        });
+    }
+    // noinspection JSUnusedGlobalSymbols
+    loadKeyPairsInBrowserLocalStorage(healthcarePartyId, file) {
+        const fr = new FileReader();
+        return new Promise((resolve, reject) => {
+            fr.onerror = reject;
+            fr.onabort = reject;
+            fr.onload = (e) => {
+                //TODO remove any
+                const privateKey = e.target.result;
+                this.loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, (0, binary_utils_1.hex2ua)(privateKey))
+                    .then(() => resolve())
+                    .catch(reject);
+            };
+            fr.readAsText(file);
+        });
+    }
+    // noinspection JSUnusedGlobalSymbols
+    saveKeychainInBrowserLocalStorage(id, keychain) {
+        localStorage.setItem(this.keychainLocalStoreIdPrefix + id, (0, binary_utils_1.b2a)(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), '')));
+    }
+    saveKeychainInBrowserLocalStorageAsBase64(id, keyChainB64) {
+        localStorage.setItem(this.keychainLocalStoreIdPrefix + id, keyChainB64);
+    }
+    // noinspection JSUnusedGlobalSymbols
+    saveKeychainValidityDateInBrowserLocalStorage(id, date) {
+        if (!id)
+            return;
+        if (!date) {
+            localStorage.removeItem(this.keychainValidityDateLocalStoreIdPrefix + id);
+        }
+        else {
+            localStorage.setItem(this.keychainValidityDateLocalStoreIdPrefix + id, date);
+        }
+    }
+    /**
+     * Populate the HCP.options dict with an encrypted eHealth certificate and unencryped expiry date.
+     * Any potentially unencrypted certificates will be pruned from the HCP.
+     * @param hcpId Id of the hcp to modify
+     * @returns modified HCP
+     */
+    saveKeyChainInHCPFromLocalStorage(hcpId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
+                let aesKey = null;
+                try {
+                    aesKey = _.find(yield this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id], hcp.id), (delegator) => delegator.delegatorId === hcp.id).key;
+                }
+                catch (e) {
+                    console.error('Error while importing the AES key.');
+                }
+                if (!aesKey) {
+                    console.error('No encryption key!');
+                }
+                const opts = hcp.options || {};
+                const crt = this.getKeychainInBrowserLocalStorageAsBase64(hcp.id);
+                if (!!aesKey && !!crt) {
+                    let crtEncrypted = null;
+                    try {
+                        crtEncrypted = yield this.AES.encrypt(aesKey, new Uint8Array((0, binary_utils_1.string2ua)(atob(crt))));
+                    }
+                    catch (e) {
+                        console.error('Error while encrypting the certificate', e);
+                    }
+                    // add the encrypted certificate to the options
+                    _.set(opts, this.hcpPreferenceKeyEhealthCert, (0, binary_utils_1.ua2string)(new Uint8Array(crtEncrypted)));
+                }
+                const crtValidityDate = this.getKeychainValidityDateInBrowserLocalStorage(hcp.id);
+                if (!!crtValidityDate) {
+                    _.set(opts, this.hcpPreferenceKeyEhealthCertDate, crtValidityDate);
+                }
+                hcp.options = opts;
+                return hcp;
+            }));
+        });
+    }
+    importKeychainInBrowserFromHCP(hcpId) {
+        return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
+            let crtCryp = null;
+            if (!!hcp.options && !!hcp.options[this.hcpPreferenceKeyEhealthCert]) {
+                crtCryp = (0, binary_utils_1.string2ua)(hcp.options[this.hcpPreferenceKeyEhealthCert]);
+            }
+            const crtValidityDate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCertDate);
+            // store the validity date
+            if (!!crtValidityDate) {
+                this.saveKeychainValidityDateInBrowserLocalStorage(hcp.id, crtValidityDate);
+            }
+            let crt = null;
+            let decryptionKey = null;
+            try {
+                decryptionKey = _.find(yield this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id], hcp.id), (delegator) => delegator.delegatorId === hcp.id).key;
+            }
+            catch (e) {
+                console.error('Error while importing the AES key.');
+            }
+            if (!decryptionKey) {
+                throw new Error('No encryption key! eHealth certificate cannot be decrypted.');
+            }
+            if (!!crtCryp && decryptionKey) {
+                try {
+                    crt = yield this.AES.decrypt(decryptionKey, crtCryp);
+                }
+                catch (e) {
+                    console.error(e);
+                }
+            }
+            if (!crt) {
+                throw new Error(`Error while saving certificate in browser local storage! Hcp ${hcp.id} has no certificate.`);
+            }
+            else {
+                this.saveKeychainInBrowserLocalStorageAsBase64(hcp.id, btoa(String.fromCharCode.apply(null, Array.from(new Uint8Array(crt)))));
+            }
+            return;
+        }));
+    }
+    /**
+     * Synchronizes the eHealth certificate from the database into the LocalStorage, returning information on the presence
+     * of certificate data in either place.
+     *
+     * @param hcpId The healthcare party id
+     * @returns A Promise for an object that represents the existence of a certificate in local storage and in the DB,
+     * through the two boolean properties "local" and "remote".
+     */
+    syncEhealthCertificateFromDatabase(hcpId) {
+        return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => {
+            const remoteCertificate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCert);
+            const localCertificate = this.getKeychainInBrowserLocalStorageAsBase64(hcp.id);
+            if (remoteCertificate) {
+                return this.importKeychainInBrowserFromHCP(hcp.id)
+                    .then(() => ({ local: true, remote: true }))
+                    .catch(() => ({ local: !!localCertificate, remote: true }));
+            }
+            else {
+                return { local: !!localCertificate, remote: !!remoteCertificate };
+            }
+        });
+    }
+    getKeychainInBrowserLocalStorageAsBase64(id) {
+        return localStorage.getItem(this.keychainLocalStoreIdPrefix + id);
+    }
+    getKeychainValidityDateInBrowserLocalStorage(id) {
+        return localStorage.getItem(this.keychainValidityDateLocalStoreIdPrefix + id);
+    }
+    // noinspection JSUnusedGlobalSymbols
+    loadKeychainFromBrowserLocalStorage(id) {
+        const lsItem = localStorage.getItem('org.taktik.icure.ehealth.keychain.' + id);
+        return lsItem !== null ? (0, binary_utils_1.b64_2uas)(lsItem) : null;
+    }
+    /**
+     *
+     * @param id
+     * @param keyPair should be JWK
+     */
+    storeKeyPair(id, keyPair) {
+        if (typeof Storage === 'undefined') {
+            console.log('Your browser does not support HTML5 Browser Local Storage !');
+            throw 'Your browser does not support HTML5 Browser Local Storage !';
+        }
+        //TODO encryption
+        localStorage.setItem(this.rsaLocalStoreIdPrefix + id, JSON.stringify(keyPair));
+    }
+    /**
+     * loads the RSA key pair (hcparty) in JWK from local storage, not imported
+     *
+     * @param id  doc id - hcpartyId
+     * @param publicKeyFingerPrint the 32 last characters of public key this private key is associated with
+     * @returns {Object} it is in JWK - not imported
+     */
+    loadKeyPairNotImported(id, publicKeyFingerPrint) {
+        var _a;
+        if (typeof Storage === 'undefined') {
+            console.log('Your browser does not support HTML5 Browser Local Storage !');
+            throw 'Your browser does not support HTML5 Browser Local Storage !';
+        }
+        //TODO decryption
+        const item = (_a = (publicKeyFingerPrint && localStorage.getItem(this.rsaLocalStoreIdPrefix + id + '.' + publicKeyFingerPrint))) !== null && _a !== void 0 ? _a : localStorage.getItem(this.rsaLocalStoreIdPrefix + id);
+        if (!item) {
+            console.warn(`No key can be found in local storage for id ${id} and publicKeyFingerPrint ${publicKeyFingerPrint}`);
+        }
+        return JSON.parse(item);
+    }
+    /**
+     * Loads and imports the RSA key pair (hcparty) from local storage
+     *
+     * @param id  doc id - hcPartyId
+     * @returns {Promise} -> {CryptoKey} - imported RSA
+     */
+    loadKeyPairImported(id) {
+        return new Promise((resolve, reject) => {
+            try {
+                const jwkKey = localStorage.getItem(this.rsaLocalStoreIdPrefix + id);
+                if (jwkKey) {
+                    const jwkKeyPair = JSON.parse(jwkKey);
+                    if (jwkKeyPair.publicKey && jwkKeyPair.privateKey) {
+                        this._RSA.importKeyPair('jwk', jwkKeyPair.privateKey, 'jwk', jwkKeyPair.publicKey).then(resolve, (err) => {
+                            console.log('Error in RSA.importKeyPair: ' + err);
+                            reject(err);
+                        });
+                    }
+                    else {
+                        const message = 'Error in RSA.importKeyPair: Invalid key';
+                        console.log(message);
+                        reject(Error(message));
+                    }
+                }
+                else {
+                    const message = 'Error in RSA.importKeyPair: Missing key';
+                    console.log(message);
+                    reject(Error(message));
+                }
+            }
+            catch (err) {
+                reject(err);
+            }
+        });
+    }
+    addNewKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, generateTransferKey = true) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.addNewKeyPairForOwner(maintenanceTasksApi, user, yield this.getDataOwner(ownerId), generateTransferKey);
+        });
+    }
+    addNewKeyPairForOwner(maintenanceTasksApi, user, cdo, generateTransferKey = true) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { publicKey, privateKey } = yield this.RSA.generateKeyPair();
+            const publicKeyHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(publicKey, 'spki'));
+            const gen = (yield this._AES.generateCryptoKey(true));
+            yield this.cacheKeyPair({ publicKey: yield this.RSA.exportKey(publicKey, 'jwk'), privateKey: yield this.RSA.exportKey(privateKey, 'jwk') });
+            const { type: ownerType, dataOwner: ownerToUpdate } = yield this.createOrUpdateAesExchangeKeysFor(cdo, gen, {
+                pubKey: publicKey,
+                privKey: privateKey,
+            }).then((dataOwnerWithUpdatedAesKeys) => generateTransferKey
+                ? this.createOrUpdateTransferKeysFor(dataOwnerWithUpdatedAesKeys, gen, { pubKey: publicKey, privKey: privateKey })
+                : dataOwnerWithUpdatedAesKeys);
+            const modifiedDataOwnerAndType = ownerType === 'hcp'
+                ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.hcpartyBaseApi
+                    .modifyHealthcareParty(ownerToUpdate)
+                    .then((x) => ({ type: 'hcp', dataOwner: x })))
+                : ownerType === 'patient'
+                    ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.patientBaseApi
+                        .modifyPatient(ownerToUpdate)
+                        .then((x) => ({ type: 'patient', dataOwner: x })))
+                    : yield (this.dataOwnerCache[ownerToUpdate.id] = this.deviceBaseApi
+                        .updateDevice(ownerToUpdate)
+                        .then((x) => ({ type: 'device', dataOwner: x })));
+            const sentMaintenanceTasks = yield this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, publicKey);
+            return {
+                dataOwner: sentMaintenanceTasks.length
+                    ? yield this.retrieveDataOwnerInfoAfterPotentialUpdate(modifiedDataOwnerAndType.dataOwner)
+                    : modifiedDataOwnerAndType.dataOwner,
+                publicKey: publicKeyHex,
+                privateKey: (0, binary_utils_1.ua2hex)((yield this.RSA.exportKey(privateKey, 'pkcs8'))),
+            };
+        });
+    }
+    createOrUpdateAesExchangeKeysFor(cdo, decryptedAesExchangeKey, keyToEncrypt) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const publicKeyHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keyToEncrypt.pubKey, 'spki'));
+            const existingAesExchangeKeys = (_a = cdo.dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {};
+            existingAesExchangeKeys[publicKeyHex] = yield this.encryptAesKeyFor(decryptedAesExchangeKey, cdo.dataOwner, keyToEncrypt.pubKey);
+            return { type: cdo.type, dataOwner: Object.assign(Object.assign({}, cdo.dataOwner), { aesExchangeKeys: existingAesExchangeKeys }) };
+        });
+    }
+    createOrUpdateTransferKeysFor(dataOwner, decryptedAesExchangeKey, keyToEncrypt) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const pubKeyToEncryptHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keyToEncrypt.pubKey, 'spki'));
+            const encryptedKey = (0, binary_utils_1.ua2hex)(yield this._AES.encrypt(yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(decryptedAesExchangeKey)), (yield this.RSA.exportKey(keyToEncrypt.privKey, 'pkcs8')), decryptedAesExchangeKey));
+            const dataOwnerExistingPubKeys = Array.from(yield this.getDataOwnerHexPublicKeys(dataOwner.dataOwner));
+            const transferKeys = (0, utils_1.fold)(dataOwnerExistingPubKeys, (_a = dataOwner.dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {}, (pubAcc, pubKeyHex) => {
+                var _a;
+                if (pubKeyHex !== pubKeyToEncryptHex) {
+                    const existingKeys = (_a = pubAcc[pubKeyHex]) !== null && _a !== void 0 ? _a : {};
+                    existingKeys[pubKeyToEncryptHex] = encryptedKey;
+                    pubAcc[pubKeyHex] = existingKeys;
+                }
+                return pubAcc;
+            });
+            return { type: dataOwner.type, dataOwner: Object.assign(Object.assign({}, dataOwner.dataOwner), { transferKeys: transferKeys }) };
+        });
+    }
+    encryptAesKeyFor(aesKey, dataOwner, doNewPublicKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dataOwnerAllPubKeys = [doNewPublicKey].concat(yield this.getDataOwnerPublicKeys(dataOwner));
+            const encrAes = {};
+            for (const pubKey of dataOwnerAllPubKeys) {
+                encrAes[(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(pubKey, (0, binary_utils_1.hex2ua)(aesKey)));
+            }
+            return { [dataOwner.id]: encrAes };
+        });
+    }
+    retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {
+        return this.getDataOwner(dataOwnerToUpdate.id).then(({ type, dataOwner }) => {
+            var _a, _b, _c, _d;
+            return {
+                type: type,
+                dataOwner: Object.assign(Object.assign({}, dataOwner), { transferKeys: dataOwnerToUpdate.transferKeys, hcPartyKeys: (0, utils_1.fold)(Object.entries((_a = dataOwnerToUpdate.hcPartyKeys) !== null && _a !== void 0 ? _a : {}), (_b = dataOwner.hcPartyKeys) !== null && _b !== void 0 ? _b : {}, (acc, [delegateId, hcKeys]) => {
+                        acc[delegateId] = hcKeys;
+                        return acc;
+                    }), aesExchangeKeys: (0, utils_1.fold)(Object.entries((_c = dataOwnerToUpdate.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => {
+                        var _a;
+                        const existingKeys = (_a = pubAcc[pubKey]) !== null && _a !== void 0 ? _a : {};
+                        pubAcc[pubKey] = (0, utils_1.fold)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => {
+                            delAcc[delId] = delKeys;
+                            return delAcc;
+                        });
+                        return pubAcc;
+                    }) }),
+            };
+        });
+    }
+    sendMaintenanceTasks(maintenanceTaskApi, user, dataOwner, newPublicKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const hexNewPubKey = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(newPublicKey, 'spki'));
+            const nonAccessiblePubKeys = Array.from(this.getDataOwnerHexPublicKeys(dataOwner).values())
+                .filter((existingPubKey) => existingPubKey != hexNewPubKey)
+                .filter((existingPubKey) => !Object.values(this.rsaKeyPairs).find(({ publicKey, privateKey }) => __awaiter(this, void 0, void 0, function* () { return (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(publicKey, 'spki')) == existingPubKey; })));
+            if (nonAccessiblePubKeys.length) {
+                const tasksForDelegates = Object.entries(yield this.getEncryptedAesExchangeKeysForDelegate(dataOwner.id))
+                    .filter(([delegatorId]) => delegatorId != dataOwner.id)
+                    .flatMap(([delegatorId, delegatorKeys]) => {
+                    return Object.entries(delegatorKeys).flatMap(([, aesExchangeKeys]) => {
+                        return Object.keys(aesExchangeKeys).map((delegatePubKey) => {
+                            return { delegateId: delegatorId, maintenanceTask: this.createMaintenanceTask(dataOwner, delegatePubKey) };
+                        });
+                    });
+                });
+                const tasksForDelegator = Object.entries(yield this.getEncryptedAesExchangeKeys(dataOwner, dataOwner.id)).flatMap(([doPubKey, delegateKeys]) => {
+                    return Object.keys(delegateKeys)
+                        .filter((delegateId) => delegateId != dataOwner.id)
+                        .map((delegateId) => {
+                        return { delegateId: delegateId, maintenanceTask: this.createMaintenanceTask(dataOwner, doPubKey) };
+                    });
+                });
+                return Promise.all(tasksForDelegates
+                    .concat(tasksForDelegator)
+                    .map(({ delegateId, maintenanceTask }) => __awaiter(this, void 0, void 0, function* () {
+                    const taskToCreate = yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.newInstance(user, maintenanceTask, [delegateId]));
+                    return taskToCreate ? maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.createMaintenanceTaskWithUser(user, taskToCreate) : undefined;
+                }))
+                    .filter((createdTask) => createdTask != undefined));
+            }
+            else {
+                return [];
+            }
+        });
+    }
+    createMaintenanceTask(concernedDataOwner, concernedPubKey) {
+        return new models_1.MaintenanceTask({
+            id: this.randomUuid(),
+            taskType: 'updateAesExchangeKey',
+            status: models_1.MaintenanceTask.StatusEnum.Pending,
+            properties: [
+                new models_1.PropertyStub({
+                    id: 'dataOwnerConcernedId',
+                    type: new models_1.PropertyTypeStub({ type: models_1.PropertyTypeStub.TypeEnum.STRING }),
+                    typedValue: new models_1.TypedValueObject({
+                        type: models_1.TypedValueObject.TypeEnum.STRING,
+                        stringValue: concernedDataOwner.id,
+                    }),
+                }),
+                new models_1.PropertyStub({
+                    id: 'dataOwnerConcernedPubKey',
+                    type: new models_1.PropertyTypeStub({ type: models_1.PropertyTypeStub.TypeEnum.STRING }),
+                    typedValue: new models_1.TypedValueObject({
+                        type: models_1.TypedValueObject.TypeEnum.STRING,
+                        stringValue: concernedPubKey,
+                    }),
+                }),
+            ],
+        });
+    }
+    getDataOwnerHexPublicKeys(dataOwner) {
+        return new Set((dataOwner.publicKey ? [dataOwner.publicKey] : [])
+            .concat(dataOwner.aesExchangeKeys ? Object.keys(dataOwner.aesExchangeKeys) : [])
+            .filter((pubKey) => !!pubKey));
+    }
+    getDataOwnerPublicKeys(dataOwner) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield Promise.all(Array.from(this.getDataOwnerHexPublicKeys(dataOwner)).map((pubKey) => __awaiter(this, void 0, void 0, function* () { return yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(pubKey)), ['encrypt']); })));
+        });
+    }
+    generateKeyForDelegate(ownerId, delegateId) {
+        //Preload hcp and patient because we need them and they are going to be invalidated from the caches
+        return (0, utils_1.notConcurrent)(this.generateKeyConcurrencyMap, ownerId, () => __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e;
+            const [{ type: ownerType, dataOwner: owner }, { dataOwner: delegate }] = yield Promise.all([
+                this.getDataOwner(ownerId),
+                this.getDataOwner(delegateId),
+            ]);
+            const ownerLegacyPublicKey = owner.publicKey;
+            const availablePublicKeysFingerprints = Object.keys(this.rsaKeyPairs);
+            const availableOwnerPublicKeys = [
+                ownerLegacyPublicKey,
+                ...Object.keys(owner.aesExchangeKeys || {}).filter((x) => x !== ownerLegacyPublicKey),
+            ].filter((k) => !!k && availablePublicKeysFingerprints.some((fp) => k.endsWith(fp)));
+            const selectedPublicKey = availableOwnerPublicKeys[0];
+            if (!selectedPublicKey) {
+                throw new Error(`Invalid owner, no public key, keypairs have not be set for ${ownerId}`);
+            }
+            if ((owner.hcPartyKeys || {})[delegateId] ||
+                Object.values(owner.aesExchangeKeys || {}).some((x) => x[delegateId] && Object.keys(x[delegateId]).some((k) => availablePublicKeysFingerprints.includes(k)))) {
+                return owner;
+            }
+            let ownerCombinedAesExchangeKeys = (_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {};
+            if (ownerLegacyPublicKey && !((_b = owner.aesExchangeKeys) !== null && _b !== void 0 ? _b : {})[ownerLegacyPublicKey]) {
+                //Transfer keys from old structure (hcparty keys) to new one (aesExchangeKeys)
+                const unknownDataOwnerCounterPartIds = Object.keys((_c = owner.hcPartyKeys) !== null && _c !== void 0 ? _c : {}).filter((x) => x !== ownerId && x !== delegateId);
+                const counterParts = [
+                    owner,
+                    delegate,
+                    ...(yield Promise.all(unknownDataOwnerCounterPartIds.map((cpid) => this.getDataOwner(cpid).then((dot) => dot.dataOwner)))),
+                ];
+                ownerCombinedAesExchangeKeys = Object.assign({ [ownerLegacyPublicKey]: Object.entries((_d = owner.hcPartyKeys) !== null && _d !== void 0 ? _d : {}).reduce((map, [hcpId, keys]) => {
+                        var _a, _b;
+                        return (Object.assign(Object.assign(Object.assign({}, map), { [hcpId]: { [ownerLegacyPublicKey]: keys[0], [(_b = (_a = counterParts.find((x) => x.id === hcpId)) === null || _a === void 0 ? void 0 : _a.publicKey) !== null && _b !== void 0 ? _b : '']: keys[1] } }), {}));
+                    }, {}) }, ownerCombinedAesExchangeKeys);
+            }
+            const delegatePublicKeys = [delegate.publicKey, ...Object.keys((_e = delegate.aesExchangeKeys) !== null && _e !== void 0 ? _e : {}).filter((x) => x !== delegate.publicKey)].filter((x) => !!x);
+            if (!delegatePublicKeys.length) {
+                throw new Error(`Invalid delegate, no public key, keypairs have not be set for ${delegateId}`);
+            }
+            const genProm = this._AES.generateCryptoKey(true).then((AESKey) => __awaiter(this, void 0, void 0, function* () {
+                var _f, _g;
+                const allPubKeys = [...availableOwnerPublicKeys, ...delegatePublicKeys];
+                const encryptedAesKeys = yield allPubKeys.reduce((map, pubK) => __awaiter(this, void 0, void 0, function* () {
+                    return (Object.assign(Object.assign({}, (yield map)), { [pubK.slice(-32)]: (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(pubK)), ['encrypt']), (0, binary_utils_1.hex2ua)(AESKey))) }));
+                }), Promise.resolve({}));
+                if (delegate.publicKey && ownerLegacyPublicKey) {
+                    owner.hcPartyKeys[delegateId] = [encryptedAesKeys[ownerLegacyPublicKey.slice(-32)], encryptedAesKeys[delegate.publicKey.slice(-32)]];
+                }
+                owner.aesExchangeKeys = Object.assign(Object.assign({}, (ownerCombinedAesExchangeKeys !== null && ownerCombinedAesExchangeKeys !== void 0 ? ownerCombinedAesExchangeKeys : {})), { [selectedPublicKey]: Object.assign(Object.assign({}, ((_g = (_f = owner.aesExchangeKeys) === null || _f === void 0 ? void 0 : _f[selectedPublicKey]) !== null && _g !== void 0 ? _g : {})), { [delegateId]: encryptedAesKeys }) });
+                return new Promise((resolve, reject) => {
+                    ownerType === 'hcp'
+                        ? (this.dataOwnerCache[owner.id] = this.hcpartyBaseApi
+                            .modifyHealthcareParty(owner)
+                            .then((x) => ({ type: 'hcp', dataOwner: x })))
+                            .then((x) => resolve(['hcp', x.dataOwner]))
+                            .catch((e) => reject(e))
+                        : ownerType === 'patient'
+                            ? (this.dataOwnerCache[owner.id] = this.patientBaseApi.modifyPatient(owner).then((x) => ({ type: 'patient', dataOwner: x })))
+                                .then((x) => resolve(['patient', x.dataOwner]))
+                                .catch((e) => reject(e))
+                            : (this.dataOwnerCache[owner.id] = this.deviceBaseApi.updateDevice(owner).then((x) => ({ type: 'device', dataOwner: x })))
+                                .then((x) => resolve(['device', x.dataOwner]))
+                                .catch((e) => reject(e));
+                });
+            }));
+            this.hcPartyKeysRequestsCache[delegateId] = genProm.then(() => {
+                return this.forceGetEncryptedAesExchangeKeysForDelegate(delegateId);
+            });
+            return genProm.then((res) => {
+                return res[1];
+            });
+        }));
+    }
+    getDataOwner(ownerId) {
+        var _a;
+        return ((_a = this.dataOwnerCache[ownerId]) !== null && _a !== void 0 ? _a : (this.dataOwnerCache[ownerId] = this.patientBaseApi
+            .getPatient(ownerId)
+            .then((x) => ({ type: 'patient', dataOwner: x }))
+            .catch(() => this.deviceBaseApi.getDevice(ownerId).then((x) => ({ type: 'device', dataOwner: x })))
+            .catch(() => this.hcpartyBaseApi.getHealthcareParty(ownerId).then((x) => ({ type: 'hcp', dataOwner: x })))
+            .catch((e) => {
+            delete this.dataOwnerCache[ownerId];
+            throw e;
+        })));
+    }
+    // noinspection JSUnusedGlobalSymbols
+    checkPrivateKeyValidity(dataOwner) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const publicKeys = Array.from(new Set([dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x)));
+            return yield publicKeys.reduce((pres, publicKey) => __awaiter(this, void 0, void 0, function* () {
+                const res = yield pres;
+                if (res) {
+                    return true;
+                }
+                try {
+                    const k = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)), ['encrypt']);
+                    const cipher = yield this._RSA.encrypt(k, (0, binary_utils_1.utf8_2ua)('shibboleth'));
+                    const kp = this.loadKeyPairNotImported(dataOwner.id, publicKey.slice(-32));
+                    const plainText = yield this._RSA
+                        .importKeyPair('jwk', kp.privateKey, 'jwk', kp.publicKey)
+                        .then((ikp) => this._RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)))
+                        .then((x) => (0, binary_utils_1.ua2utf8)(x));
+                    return plainText === 'shibboleth';
+                }
+                catch (e) {
+                    return false;
+                }
+            }), Promise.resolve(false));
+        });
+    }
+    throwDetailedExceptionForInvalidParameter(argName, argValue, methodName, methodArgs) {
+        if (argValue)
+            return;
+        let details = '\nMethod name: icc-crypto-x-api.' + methodName + '()\nArguments:';
+        if (methodArgs) {
+            try {
+                const argsArray = [...methodArgs];
+                _.each(argsArray, (arg, index) => (details += '\n[' + index + ']: ' + JSON.stringify(arg)));
+            }
+            catch (ex) {
+                details += '; a problem occured while logging arguments details: ' + ex;
+            }
+        }
+        throw '### THIS SHOULD NOT HAPPEN: ' + argName + ' has an invalid value: ' + argValue + details;
+    }
+    getEncryptionDecryptionKeys(dataOwnerId, document) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return !document.id
+                    ? undefined
+                    : _.uniq((yield this.extractKeysFromDelegationsForHcpHierarchy(dataOwnerId, document.id, (document.encryptionKeys && Object.keys(document.encryptionKeys).length && document.encryptionKeys) || document.delegations)).extractedKeys);
+            }
+            catch (e) {
+                return undefined;
+            }
+        });
+    }
+    encryptDecrypt(method, content, edKey, user, documentObject) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!content || !(edKey || ((user === null || user === void 0 ? void 0 : user.healthcarePartyId) && documentObject)))
+                return content;
+            if (edKey) {
+                const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(edKey.replace(/-/g, '')));
+                try {
+                    return yield this._AES[method](importedEdKey, content);
+                }
+                catch (e) {
+                    return content;
+                }
+            }
+            const sfks = yield this.extractKeysFromDelegationsForHcpHierarchy(user === null || user === void 0 ? void 0 : user.healthcarePartyId, documentObject === null || documentObject === void 0 ? void 0 : documentObject.id, documentObject === null || documentObject === void 0 ? void 0 : documentObject.encryptionKeys);
+            const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(sfks.extractedKeys[0].replace(/-/g, '')));
+            try {
+                return yield this._AES[method](importedEdKey, content);
+            }
+            catch (e) {
+                return content;
+            }
+        });
+    }
+}
+exports.IccCryptoXApi = IccCryptoXApi;
+//# sourceMappingURL=icc-crypto-x-api.js.map