@icure/api 6.3.1 → 7.0.0-beta.0

package/icc-x-api/icc-crypto-x-api.js

@@ -1,1731 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.IccCryptoXApi = void 0;
-const AES_1 = require("./crypto/AES");
-const RSA_1 = require("./crypto/RSA");
-const shamir_1 = require("./crypto/shamir");
-const _ = require("lodash");
-const models_1 = require("../icc-api/model/models");
-const binary_utils_1 = require("./utils/binary-utils");
-const utils_1 = require("./utils");
-class IccCryptoXApi {
-    get crypto() {
-        return this._crypto;
-    }
-    get shamir() {
-        return this._shamir;
-    }
-    get RSA() {
-        return this._RSA;
-    }
-    get AES() {
-        return this._AES;
-    }
-    get keyStorage() {
-        return this._keyStorage;
-    }
-    get storage() {
-        return this._storage;
-    }
-    emptyHcpCache(hcpartyId) {
-        delete this.hcPartyKeysRequestsCache[hcpartyId];
-        delete this.dataOwnerCache[hcpartyId];
-    }
-    /**
-     * Gets all delegate encrypted HcParty keys of the delegate with the given `delegateHcPartyId`, and for each key the delegator id
-     * If the keys are not cached, they are retrieved from the backend.
-     *
-     * @param delegateHcPartyId The Health Care Party id
-     * @returns  \{delegatorId: delegateEncryptedHcPartyKey\}
-     */
-    getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId) {
-        return (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
-            (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.forceGetEncryptedAesExchangeKeysForDelegate(delegateHcPartyId)));
-    }
-    forceGetEncryptedAesExchangeKeysForDelegate(delegateHcPartyId) {
-        return Promise.all([
-            this.patientBaseApi.getPatientAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
-            this.hcpartyBaseApi.getAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
-            this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
-        ]).then(([a, b, c]) => (Object.assign(Object.assign(Object.assign({}, a), b), c)));
-    }
-    constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
-    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}, storage, keyStorage) {
-        this.hcPartyKeysCache = {};
-        //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
-        //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
-        this.hcPartyKeysRequestsCache = {};
-        this.cacheLastDeletionTimestamp = undefined;
-        this.dataOwnerCache = {};
-        this.keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.';
-        this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
-        this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
-        this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
-        this.rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.';
-        this.rsaKeyPairs = {};
-        this.hcpartyBaseApi = hcpartyBaseApi;
-        this.patientBaseApi = patientBaseApi;
-        this.deviceBaseApi = deviceBaseApi;
-        this._crypto = crypto;
-        this.generateKeyConcurrencyMap = {};
-        this._AES = new AES_1.AESUtils(crypto);
-        this._RSA = new RSA_1.RSAUtils(crypto);
-        this._shamir = new shamir_1.ShamirClass(crypto);
-        this._storage = storage;
-        this._keyStorage = keyStorage;
-    }
-    loadAllKeysFromLocalStorage(dataOwnerId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const pubKeys = yield this.getDataOwnerHexPublicKeys((yield this.getDataOwner(dataOwnerId)).dataOwner);
-            for (const pk of pubKeys) {
-                const fingerprint = pk.slice(-32);
-                if (!this.rsaKeyPairs[fingerprint]) {
-                    yield this.cacheKeyPair(yield this.loadKeyPairNotImported(dataOwnerId, fingerprint));
-                }
-            }
-        });
-    }
-    getCachedRsaKeyPairForFingerprint(dataOwnerId, pubKeyOrFingerprint) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const fingerprint = pubKeyOrFingerprint.slice(-32);
-            return (_a = this.rsaKeyPairs[fingerprint]) !== null && _a !== void 0 ? _a : (yield this.cacheKeyPair(yield this.loadKeyPairNotImported(dataOwnerId, fingerprint)));
-        });
-    }
-    getPublicKeys() {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield Object.values(this.rsaKeyPairs).reduce((p, rsa) => __awaiter(this, void 0, void 0, function* () {
-                return (yield p).concat([(0, utils_1.jwk2spki)(yield this.RSA.exportKey(rsa.publicKey, 'jwk'))]);
-            }), Promise.resolve([]));
-        });
-    }
-    getPublicKeysAsSpki() {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield Object.values(this.rsaKeyPairs).reduce((p, rsa) => __awaiter(this, void 0, void 0, function* () {
-                return (yield p).concat([(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(rsa.publicKey, 'spki'))]);
-            }), Promise.resolve([]));
-        });
-    }
-    randomUuid() {
-        return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(/[018]/g, (c) => (Number(c) ^ (this._crypto.getRandomValues(new Uint8Array(1))[0] & (15 >> (Number(c) / 4)))).toString(16) //Keep that inlined or you will loose the random
-        );
-    }
-    sha256(data) {
-        return this._crypto.subtle.digest('SHA-256', data);
-    }
-    encryptShamirRSAKey(hcp, notaries, threshold) {
-        return this.loadKeyPairImported(hcp.id).then((keyPair) => this._RSA.exportKey(keyPair.privateKey, 'pkcs8').then((exportedKey) => __awaiter(this, void 0, void 0, function* () {
-            const privateKey = exportedKey;
-            const nLen = notaries.length;
-            const shares = nLen == 1 ? [privateKey] : this._shamir.share((0, binary_utils_1.ua2hex)(privateKey), nLen, threshold || nLen).map((share) => (0, binary_utils_1.hex2ua)(share));
-            const publicKeys = yield this.getPublicKeys();
-            return _.reduce(notaries, (queue, notary, idx) => {
-                return queue.then((hcp) => __awaiter(this, void 0, void 0, function* () {
-                    const { owner: hcParty, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(hcp, notary.id);
-                    const [publicKeyIdentifier, hcPartyKeys] = Object.entries(aesExchangeKeys)[0];
-                    try {
-                        const importedAESHcPartyKey = yield this.decryptHcPartyKey(notary.id, hcParty.id, notary.id, publicKeyIdentifier, hcPartyKeys, publicKeys);
-                        const encryptedShamirPartition = yield this.AES.encrypt(importedAESHcPartyKey.key, shares[idx]);
-                        hcParty.privateKeyShamirPartitions = hcParty.privateKeyShamirPartitions || {};
-                        hcParty.privateKeyShamirPartitions[notary.id] = (0, binary_utils_1.ua2hex)(encryptedShamirPartition);
-                    }
-                    catch (e) {
-                        console.log('Error during encryptedShamirRSAKey', notary.id, e);
-                    }
-                    return hcParty;
-                }));
-            }, Promise.resolve(hcp));
-        })));
-    }
-    /* Reconstructs the hcp's private key from the notaries' shamir shares and stores it in localstorage.
-    The retrieval procedure of the shares is not designed or implemented yet.  Therefore, it currently only
-    works if the private key of the notaries are stored in local storage (e.g. notaries = [hcp parent]).
-     * @param hcp : the hcp whose key we want to reconstruct
-     * @param notaries : holders of the shamir shares
-    **/
-    decryptShamirRSAKey(hcp, notaries) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const publicKeys = yield this.getPublicKeys();
-                const nLen = notaries.length;
-                let decryptedPrivatedKey;
-                if (nLen == 1) {
-                    const notaryHcPartyId = notaries[0].id;
-                    const encryptedAesKeyMap = yield this.getEncryptedAesExchangeKeys(hcp, notaryHcPartyId);
-                    const importedAESHcPartyKey = yield Promise.all(Object.entries(encryptedAesKeyMap).map(([idPubKey, keysMap]) => __awaiter(this, void 0, void 0, function* () { return yield this.decryptHcPartyKey(notaryHcPartyId, hcp.id, notaryHcPartyId, idPubKey, keysMap, publicKeys); })));
-                    const cryptedPrivatedKey = hcp.privateKeyShamirPartitions[notaryHcPartyId];
-                    decryptedPrivatedKey = (0, binary_utils_1.ua2hex)(yield this.AES.decryptSome(importedAESHcPartyKey.map((k) => k.key), (0, binary_utils_1.hex2ua)(cryptedPrivatedKey)));
-                }
-                else {
-                    const decryptedShares = yield _.reduce(notaries, (queue, notary) => {
-                        return queue.then((shares) => __awaiter(this, void 0, void 0, function* () {
-                            try {
-                                // TODO: now, we get the encrypted shares in db and decrypt them. This assumes that the
-                                // the notaries' private keys are in localstorage. We should implement a way for the notaries to
-                                // give hcp the decrypted shares without having to also share their private keys.
-                                const encryptedAesKeyMap = yield this.getEncryptedAesExchangeKeys(hcp, notary.id);
-                                const importedAESHcPartyKey = yield Promise.all(Object.entries(encryptedAesKeyMap).map(([idPubKey, keysMap]) => __awaiter(this, void 0, void 0, function* () { return yield this.decryptHcPartyKey(notary.id, hcp.id, notary.id, idPubKey, keysMap, publicKeys); })));
-                                const encryptedShare = hcp.privateKeyShamirPartitions[notary.id];
-                                const decryptedShamirPartition = (0, binary_utils_1.ua2hex)(yield this.AES.decryptSome(importedAESHcPartyKey.map((k) => k.key), (0, binary_utils_1.hex2ua)(encryptedShare)));
-                                shares.push(decryptedShamirPartition);
-                            }
-                            catch (e) {
-                                console.log('Error during encryptedShamirRSAKey', notary.id, e);
-                            }
-                            return shares;
-                        }));
-                    }, Promise.resolve([]));
-                    decryptedPrivatedKey = this._shamir.combine(decryptedShares);
-                }
-                const importedPrivateKey = yield this._RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(decryptedPrivatedKey), ['decrypt']);
-                const importedPublicKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(hcp.publicKey), ['encrypt']);
-                const exportedKeyPair = yield this._RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk');
-                yield this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${hcp.id}`, exportedKeyPair);
-            }
-            catch (e) {
-                console.log('Cannot decrypt shamir RSA key');
-            }
-        });
-    }
-    /**
-     * Gets the decryptedHcPartyKey for the given `encryptedHcPartyKey`
-     *
-     * If the decrypted key exists in the cache, retrieves it from there.
-     * Otherwise, decrypts it using the RSA key of the delegator or delegate (depending on the value of `encryptedForDelegator`)
-     *
-     * @param loggedHcPartyId The logged DataOwner id or the id of his parent
-     * @param delegatorId The id of Delegator eg, the DataOwner where this AES exchange key is stored
-     * @param delegateHcPartyId The id of the delegate : the data owner for whom this aes exchange key has been created
-     * @param publicKey The public key of the delegator : A unique aes exchange key is created for each public key of the delegator. This is the public key corresponding to the encryptedHcPartyKeys
-     * @param encryptedHcPartyKeys The encryptedHcPartyKeys to be decrypted
-     * @param publicKeys The public keys for which we might have a private key
-     *
-     * @returns - **delegatorId** the input param  `delegatorId`
-     * - **key** the decrypted `encryptedHcPartyKey`
-     */
-    decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, publicKeys) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!publicKeys.length) {
-                const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: no public key`;
-                console.warn(reason);
-                throw new Error(reason);
-            }
-            const cacheKey = `${delegateHcPartyId}|${publicKey.slice(-32)}|${delegatorId}`;
-            const res = this.hcPartyKeysCache[cacheKey];
-            if (res) {
-                return res;
-            }
-            const result = yield publicKeys.reduce((res, pk) => __awaiter(this, void 0, void 0, function* () {
-                var _b, _c, _d;
-                const delegatorAndKeys = yield res;
-                if (delegatorAndKeys) {
-                    return delegatorAndKeys;
-                }
-                const fingerprint = pk.slice(-32);
-                const keyPair = (_b = this.rsaKeyPairs[fingerprint]) !== null && _b !== void 0 ? _b : (yield this.cacheKeyPair(yield this.loadKeyPairNotImported(loggedHcPartyId, fingerprint)));
-                if (!keyPair) {
-                    return;
-                }
-                // Due to past bugs the encryptedHcPartyKeys may contain the full key instead of just the fingerprint.
-                let encryptedHcPartyKey = (_c = encryptedHcPartyKeys[fingerprint]) !== null && _c !== void 0 ? _c : encryptedHcPartyKeys[pk];
-                if (!encryptedHcPartyKey) {
-                    const delegate = yield this.getDataOwner(delegateHcPartyId, false); //it is faster to just try to decrypt if not in cache
-                    if (!(delegate === null || delegate === void 0 ? void 0 : delegate.dataOwner) || ((_d = delegate.dataOwner.publicKey) === null || _d === void 0 ? void 0 : _d.endsWith(fingerprint))) {
-                        encryptedHcPartyKey = encryptedHcPartyKeys[''];
-                    }
-                    else {
-                        return;
-                    }
-                }
-                try {
-                    const decryptedAesExchangeKey = yield this._RSA.decrypt(keyPair.privateKey, (0, binary_utils_1.hex2ua)(encryptedHcPartyKey));
-                    const importedAesExchangeKey = yield this._AES.importKey('raw', decryptedAesExchangeKey);
-                    return (this.hcPartyKeysCache[cacheKey] = {
-                        delegatorId: delegatorId,
-                        key: importedAesExchangeKey,
-                        rawKey: (0, binary_utils_1.ua2hex)(new Uint8Array(decryptedAesExchangeKey)),
-                    });
-                }
-                catch (e) {
-                    const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId} for pubKey ${fingerprint}: impossible to decrypt`;
-                    console.log(reason);
-                }
-            }), Promise.resolve(undefined));
-            const availablePublicKeys = publicKeys.filter((pk) => this.rsaKeyPairs[pk.slice(-32)]);
-            if (!result) {
-                //Try to find another key from the transfer keys
-                const hcp = (yield this.getDataOwner(loggedHcPartyId));
-                const candidates = Object.entries((_a = hcp.dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {})
-                    .filter(([fp, _]) => availablePublicKeys.some((pk) => pk.slice(-32) === fp.slice(-32))) // only keep keys that we will be able to decrypt
-                    .flatMap(([pk, keys]) => Object.entries(keys).map(([k, v]) => [pk, k, v]))
-                    .filter(([_, k]) => !publicKeys.some((apk) => apk.slice(-32) === k.slice(-32)));
-                if (candidates.length) {
-                    const newPublicKeys = yield candidates.reduce((p, [decryptionKeyFingerprint, privateKeyFingerprint, encryptedPrivateKey]) => __awaiter(this, void 0, void 0, function* () {
-                        var _e, _f;
-                        const newKeys = yield p;
-                        const aesExchangeKeys = (_e = Object.entries(hcp.dataOwner.aesExchangeKeys).find(([fp, _]) => fp.slice(-32) === privateKeyFingerprint.slice(-32))) === null || _e === void 0 ? void 0 : _e[1][loggedHcPartyId];
-                        if (aesExchangeKeys) {
-                            const encryptedAesExchangeKey = (_f = Object.entries(aesExchangeKeys).find(([fp, _]) => fp.slice(-32) === decryptionKeyFingerprint.slice(-32))) === null || _f === void 0 ? void 0 : _f[1];
-                            if (encryptedAesExchangeKey) {
-                                const keyPair = this.rsaKeyPairs[decryptionKeyFingerprint.slice(-32)];
-                                if (!keyPair) {
-                                    return newKeys;
-                                }
-                                const decryptedAesExchangeKey = yield this._RSA.decrypt(keyPair.privateKey, (0, binary_utils_1.hex2ua)(encryptedAesExchangeKey));
-                                const importedAesExchangeKey = yield this._AES.importKey('raw', decryptedAesExchangeKey);
-                                const decryptedPrivateKey = yield this._AES.decrypt(importedAesExchangeKey, (0, binary_utils_1.hex2ua)(encryptedPrivateKey));
-                                const newPublicKey = Object.keys(hcp.dataOwner.aesExchangeKeys).find((fp) => fp.slice(-32) === privateKeyFingerprint.slice(-32));
-                                yield this.cacheKeyPair({
-                                    publicKey: (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(newPublicKey)),
-                                    privateKey: (0, utils_1.pkcs8ToJwk)(decryptedPrivateKey),
-                                });
-                                return newKeys.concat([newPublicKey]);
-                            }
-                        }
-                        return newKeys;
-                    }), Promise.resolve([]));
-                    if (newPublicKeys.length) {
-                        return yield this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, newPublicKeys);
-                    }
-                }
-                const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: impossible to decrypt. No private key was found or could be used to decrypt the aes exchange keys`;
-                console.log(reason);
-                throw new Error(reason);
-            }
-            return result;
-        });
-    }
-    /**
-     * Cache the RSA private/public key pair for the HcP with the given id `hcPartyKeyOwner`
-     */
-    cacheKeyPair(keyPairInJwk) {
-        return this._RSA.importKeyPair('jwk', keyPairInJwk.privateKey, 'jwk', keyPairInJwk.publicKey).then((importedKeyPair) => {
-            const pk = (0, utils_1.jwk2spki)(keyPairInJwk.publicKey);
-            return (this.rsaKeyPairs[pk.slice(-32)] = importedKeyPair);
-        });
-    }
-    /**
-     * Gets the secret ID (SFKs) that should be used in the prescribed context (confidential or not) from decrypted SPKs of the given `parent`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param parent :the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId :the id of the delegate HcP
-     * @param confidential :weather the key is going to be used for a confidential piece or data or not
-     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
-     */
-    extractPreferredSfk(parent, hcpartyId, confidential) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const secretForeignKeys = yield this.extractSFKsHierarchyFromDelegations(parent, hcpartyId);
-            const keys = secretForeignKeys
-                .filter(({ extractedKeys }) => extractedKeys.length > 0)
-                .filter((x, idx) => (confidential ? x.hcpartyId === hcpartyId : idx === 0))[0];
-            return ((keys &&
-                (confidential
-                    ? keys.extractedKeys.find((k) => !secretForeignKeys.some(({ extractedKeys, hcpartyId: parentHcpId }) => hcpartyId !== parentHcpId && extractedKeys.includes(k)))
-                    : keys.extractedKeys[0])) ||
-                undefined);
-        });
-    }
-    /**
-     * Gets an array of decrypted HcPartyKeys, shared between the delegate with ID `delegateHcPartyId` and the delegators in `delegatorsHcPartyIdsSet`
-     *
-     * 1. Get the keys for the delegateHealthCareParty (cache/backend).
-     * 2. For each key in the delegators, decrypt it with the delegate's private key
-     * 3. Filter out undefined keys and return them
-     *
-     * @param delegatorsHcPartyIdsSet array of delegator HcP IDs that could have delegated something to the HcP with ID `delegateHcPartyId`
-     * @param delegateHcPartyId the HcP for which the HcPs with IDs in `delegatorsHcPartyIdsSet` could have delegated something
-     * @param minCacheDurationInSeconds The minimum cache duration
-     * @returns - **delegatorId** : the id of the delegator HcP that shares the **key** with the `delegateHcPartyId`
-     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `delegateHcPartyId`
-     */
-    decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds = 60) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const aesExchangeKeys = yield this.getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId).then((delegatorIdsWithDelegateEncryptedHcPartyKeys) => __awaiter(this, void 0, void 0, function* () {
-                // [key: delegatorId] = delegateEncryptedHcPartyKey
-                // For each delegatorId, obtain the AES key (decrypted HcParty Key) shared with the delegate, decrypted by the delegate
-                return (yield Promise.all(delegatorsHcPartyIdsSet.map((delegatorId) => __awaiter(this, void 0, void 0, function* () {
-                    const encryptedHcPartyKeysForPubKeyFingerprint = delegatorIdsWithDelegateEncryptedHcPartyKeys[delegatorId];
-                    if (!encryptedHcPartyKeysForPubKeyFingerprint) {
-                        return [];
-                    }
-                    const decryptedKeys = yield Promise.all(Object.entries(encryptedHcPartyKeysForPubKeyFingerprint).map(([delegatorPubKeyFinerprint, encryptedAesExchangeKeys]) => __awaiter(this, void 0, void 0, function* () {
-                        try {
-                            return yield this.decryptHcPartyKey(delegateHcPartyId, delegatorId, delegateHcPartyId, delegatorPubKeyFinerprint, encryptedAesExchangeKeys, Object.keys(this.rsaKeyPairs));
-                        }
-                        catch (e) {
-                            console.log(`failed to decrypt hcPartyKey from ${delegatorId} to ${delegateHcPartyId}`);
-                            return;
-                        }
-                    })));
-                    return decryptedKeys.filter((x) => !!x);
-                })))).reduce((acc, x) => [...acc, ...x], []);
-            }));
-            if (aesExchangeKeys.length > 0) {
-                return aesExchangeKeys;
-            }
-            const nowTimestamp = +new Date();
-            if (!this.cacheLastDeletionTimestamp || (nowTimestamp - this.cacheLastDeletionTimestamp) / 1000 >= minCacheDurationInSeconds) {
-                delete this.hcPartyKeysRequestsCache[delegateHcPartyId];
-                this.cacheLastDeletionTimestamp = nowTimestamp;
-                return this.decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds);
-            }
-            return [];
-        });
-    }
-    /**
-     * Gets an array of decrypted HcPartyKeys from the given `delegations`, that are shared with / can be decrypted by the HcP with the given `healthcarePartyId` (or by its parents when `fallbackOnParent` is true)
-     *
-     * 1. Checks whether the delegations' object has a delegation for the
-     * given healthCarePartyId.
-     * 2. Enumerates all the delegators (delegation.owner) present in
-     * the delegations.
-     * 3. Decrypt's delegators' keys and returns them.
-     *
-     * @param dataOwnerId : the id of the delegate HCP
-     * @param delegations : delegations (can be SPKs, CFKs, EKs) for all delegates
-     * @param fallbackOnParent  default true; use parent's healthCarePartyId in case there's no delegation for the `healthcarePartyId`
-     * @returns  - **delegatorId** : the id of the delegator HcP that shares the **key** with the `healthcarePartyId`
-     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `healthcarePartyId`
-     */
-    getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, fallbackOnParent = true) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const delegationsArray = (_a = delegations[dataOwnerId]) !== null && _a !== void 0 ? _a : [];
-            if (!delegationsArray.length && fallbackOnParent) {
-                const { dataOwner: hcp } = yield this.getDataOwner(dataOwnerId);
-                return hcp.parentId
-                    ? yield this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(hcp.parentId, delegations)
-                    : [];
-            }
-            else {
-                const delegatorIds = new Set();
-                delegationsArray.forEach((del) => delegatorIds.add(del.owner));
-                return this.decryptAndImportAesHcPartyKeysForDelegators(Array.from(delegatorIds), dataOwnerId);
-            }
-        });
-    }
-    /**
-     * Retrieve the owner HealthCareParty key and use it to encrypt
-     * both the delegations (createdObject.id) and the cryptedForeignKeys
-     * (parentObject.id), and returns them in an object.
-     */
-    initObjectDelegations(createdObject, parentObject, ownerId, secretForeignKeyOfParent) {
-        return __awaiter(this, arguments, void 0, function* () {
-            const publicKeys = yield this.getPublicKeys();
-            this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initObjectDelegations', arguments);
-            if (parentObject)
-                this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject.id, 'initObjectDelegations', arguments);
-            const secretId = this.randomUuid();
-            return this.getDataOwner(ownerId).then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
-                var _a, _b;
-                const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, ownerId);
-                const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys);
-                const encryptedDelegation = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId).buffer, importedAESHcPartyKey.rawKey);
-                const encryptedSecretForeignKey = parentObject
-                    ? yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
-                    : undefined;
-                return {
-                    owner: modifiedOwner,
-                    delegations: Object.assign(Object.assign({}, ((_a = createdObject.delegations) !== null && _a !== void 0 ? _a : {})), { [ownerId]: [
-                            {
-                                owner: ownerId,
-                                delegatedTo: ownerId,
-                                key: (0, binary_utils_1.ua2hex)(encryptedDelegation),
-                            },
-                        ] }),
-                    cryptedForeignKeys: (encryptedSecretForeignKey
-                        ? Object.assign(Object.assign({}, ((_b = createdObject.cryptedForeignKeys) !== null && _b !== void 0 ? _b : {})), { [ownerId]: [
-                                {
-                                    owner: ownerId,
-                                    delegatedTo: ownerId,
-                                    key: (0, binary_utils_1.ua2hex)(encryptedSecretForeignKey),
-                                },
-                            ] }) : {}) || {},
-                    secretForeignKeys: secretForeignKeyOfParent ? [secretForeignKeyOfParent] : [],
-                    secretId: secretId,
-                };
-            }));
-        });
-    }
-    decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, loggedHcPartyId, delegatorId, delegateHcPartyId, publicKeys) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const importedAESHcPartyKey = yield Object.entries(aesExchangeKeys).reduce((acc, [publicKeyIdentifier, hcPartyKeys]) => __awaiter(this, void 0, void 0, function* () {
-                const accValue = yield acc;
-                if (accValue) {
-                    return accValue;
-                }
-                try {
-                    return yield this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKeyIdentifier, hcPartyKeys, publicKeys);
-                }
-                catch (e) {
-                    return undefined;
-                }
-            }), Promise.resolve(undefined));
-            if (!importedAESHcPartyKey) {
-                throw new Error(`No hcParty key can be decrypted from ${delegatorId} to ${delegateHcPartyId} using currently available private keys`);
-            }
-            return importedAESHcPartyKey;
-        });
-    }
-    /**
-     * Gets updated instances of SPKs and CKFs for the child object `modifiedObject`.
-     * These updated SPKs and CKFs contain new SPKs/CFKs to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
-     *
-     * 1. if `secretIdOfModifiedObject` is not provided, the method will throw an exception; this `secretIdOfModifiedObject` is used to generate a new delegation (SPK) in step 3;
-     *  the `secretIdOfModifiedObject` is returned, unmodified, as `secretId`
-     * 2. if the owner (delegator) did not perform a delegation to the delegate, then this HcP delegation (creation of a new HcPKey) is performed now
-     * 3. creates a new delegation (Secret Primary Keys) on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
-     * 4. if `parentObject` != null, creates a new CFK on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
-     * 5. this new delegation (from step 3) is added to the list of existing delegations (Secret Primary Keys) on the `modifiedObject` for the delegate given by `delegateId`
-     * 6. if the CFK (from step 4) can be created, this new CFK is added to the list of existing CFKs on the `modifiedObject` for the delegate given by `delegateId`
-     * 7. then some duplicates delegations (SPKs) and CKFs are removed
-     *
-     * @param modifiedObject : the object of which SPKs and CFKs will be cloned, the clones will be modified and then used as returned values ; it's a 'child' of `parentObject`; will NOT be mutated
-     * @param parentObject : will NOT be mutated
-     * @param ownerId : the HcP id of the delegator
-     * @param delegateId : the HcP id of the delegate
-     * @param secretIdOfModifiedObject : the secret id used in the child object to generate its SPK
-     * @returns - **delegations**  existing delegations (SPKs) of the `modifiedObject`, appended with results from step 5
-     * - **cryptedForeignKeys** existing CFKs of the `modifiedObject`, appended with results from steps 6
-     * - **secretId** which is the given input parameter `secretIdOfModifiedObject`
-     */
-    extendedDelegationsAndCryptedForeignKeys(
-    //TODO: suggested name: getExtendedChildObjectSPKandCFKwithDelegationFromDelegatorToDelegate
-    modifiedObject, parentObject, ownerId, delegateId, secretIdOfModifiedObject) {
-        this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments); //modifiedObject should never be null
-        if (parentObject)
-            this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject === null || parentObject === void 0 ? void 0 : parentObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments);
-        this.throwDetailedExceptionForInvalidParameter('secretIdOfModifiedObject', secretIdOfModifiedObject, 'extendedDelegationsAndCryptedForeignKeys', arguments);
-        return this.getDataOwner(ownerId)
-            .then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
-            const publicKeys = yield this.getPublicKeys();
-            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
-            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, delegateId, ownerId, publicKeys);
-            modifiedObject = (modifiedObject === null || modifiedObject === void 0 ? void 0 : modifiedObject.id) === owner.id ? modifiedOwner : modifiedObject;
-            return {
-                previousDecryptedDelegations: yield Promise.all(((modifiedObject.delegations || {})[delegateId] || []).map((d) => (d.key &&
-                    d.owner === ownerId &&
-                    this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                        console.log(`Cannot decrypt delegation from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                        return Promise.resolve();
-                    })) ||
-                    Promise.resolve())),
-                previousDecryptedCryptedForeignKeys: yield Promise.all(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => (d.key &&
-                    d.owner === ownerId &&
-                    this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                        console.log(`Cannot decrypt cryptedForeignKeys from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                        return Promise.resolve();
-                    })) ||
-                    Promise.resolve())),
-                cryptedDelegation: yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretIdOfModifiedObject).buffer, importedAESHcPartyKey.rawKey),
-                cryptedForeignKey: parentObject
-                    ? yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
-                    : undefined,
-            };
-        }))
-            .then(({ previousDecryptedDelegations, previousDecryptedCryptedForeignKeys, cryptedDelegation, cryptedForeignKey }) => {
-            //try to limit the extent of the modifications to the delegations by preserving the redundant delegation already present and removing duplicates
-            //For delegate delegateId, we create:
-            // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for each existing delegation and the new key concatenated
-            // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
-            // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
-            const delegationCryptedDecrypted = _.merge(((modifiedObject.delegations || {})[delegateId] || []).map((d) => ({
-                d,
-            })), (previousDecryptedDelegations || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
-                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                .map(({ d, k }) => ({
-                d,
-                k: k || this.randomUuid(),
-            })) // Use some unique id that ensures the delegation not created by us are going to be held
-                .concat([
-                {
-                    d: {
-                        owner: ownerId,
-                        delegatedTo: delegateId,
-                        key: (0, binary_utils_1.ua2hex)(cryptedDelegation),
-                    },
-                    k: modifiedObject.id + ':' + secretIdOfModifiedObject,
-                },
-            ]);
-            const allDelegations = _.cloneDeep(modifiedObject.delegations || {});
-            //Only keep one version of the decrypted key
-            allDelegations[delegateId] = _.uniqBy(delegationCryptedDecrypted, (x) => x.k).map((x) => x.d);
-            const cryptedForeignKeysCryptedDecrypted = _.merge(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => ({
-                d,
-            })), (previousDecryptedCryptedForeignKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
-                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                .map(({ d, k }) => ({
-                d,
-                k: k || this.randomUuid(),
-            })) // Use some unique id that ensures the delegation not created by us are going to be held
-                .concat(cryptedForeignKey
-                ? [
-                    {
-                        d: {
-                            owner: ownerId,
-                            delegatedTo: delegateId,
-                            key: (0, binary_utils_1.ua2hex)(cryptedForeignKey),
-                        },
-                        k: modifiedObject.id + ':' + (parentObject === null || parentObject === void 0 ? void 0 : parentObject.id),
-                    },
-                ]
-                : []);
-            const allCryptedForeignKeys = _.cloneDeep(modifiedObject.cryptedForeignKeys || {});
-            if (cryptedForeignKeysCryptedDecrypted.length > 0) {
-                allCryptedForeignKeys[delegateId] = _.uniqBy(cryptedForeignKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
-            }
-            return {
-                modifiedObject,
-                delegations: allDelegations,
-                cryptedForeignKeys: allCryptedForeignKeys,
-                secretId: secretIdOfModifiedObject,
-            };
-        });
-    }
-    // What we need is to find aes exchange keys on the owner ! Even just with whom he shared information, we don't care about aes exchange keys
-    _getDelegateIdsOf(owner) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const mapOfAesExchKeysDelegates = Object.entries((_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {}).reduce((map, [, aesExchKeys]) => map.concat(Object.keys(aesExchKeys).filter((delegateId) => !map.includes(delegateId))), []);
-            return owner.hcPartyKeys
-                ? mapOfAesExchKeysDelegates.concat(Object.keys(owner.hcPartyKeys).filter((delegateId) => !mapOfAesExchKeysDelegates.includes(delegateId)))
-                : mapOfAesExchKeysDelegates;
-        });
-    }
-    getEncryptedAesExchangeKeys(owner, delegateId) {
-        var _a, _b, _c;
-        return __awaiter(this, void 0, void 0, function* () {
-            const publicKeys = yield this.getPublicKeys();
-            const mapOfAesExchangeKeys = Object.entries((_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})
-                .filter((e) => e[1][delegateId] && Object.keys(e[1][delegateId]).some((k1) => publicKeys.some((pk) => pk.endsWith(k1))))
-                .reduce((map, e) => {
-                const candidates = Object.entries(e[1][delegateId]); //[fingerprint of delegate pub key, key], [fingerprint of owner pub key, key]
-                const [publicKeyFingerprint, encryptedAesExchangeKey] = candidates[candidates.findIndex(([k, v]) => publicKeys.some((pk) => pk.endsWith(k)))];
-                return Object.assign(Object.assign({}, map), { [e[0]]: { [publicKeyFingerprint]: encryptedAesExchangeKey } });
-            }, {});
-            if (!owner.publicKey || mapOfAesExchangeKeys[owner.publicKey] || !((_b = owner.hcPartyKeys) === null || _b === void 0 ? void 0 : _b[delegateId])) {
-                return mapOfAesExchangeKeys;
-            }
-            const delegate = (yield this.getDataOwner(delegateId)).dataOwner;
-            if (delegate.publicKey && publicKeys.includes(delegate.publicKey)) {
-                return Object.assign(Object.assign({}, mapOfAesExchangeKeys), { [owner.publicKey]: { [(_c = (yield this.getDataOwner(delegateId)).dataOwner.publicKey) === null || _c === void 0 ? void 0 : _c.slice(-32)]: owner.hcPartyKeys[delegateId][1] } });
-            }
-            else if (publicKeys.includes(owner.publicKey)) {
-                return Object.assign(Object.assign({}, mapOfAesExchangeKeys), { [owner.publicKey]: { [owner.publicKey.slice(-32)]: owner.hcPartyKeys[delegateId][0] } });
-            }
-            return mapOfAesExchangeKeys;
-        });
-    }
-    getOrCreateHcPartyKeys(owner, delegateId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const aesExchangeKeys = yield this.getEncryptedAesExchangeKeys(owner, delegateId);
-            if (Object.keys(aesExchangeKeys).length) {
-                return { owner, aesExchangeKeys };
-            }
-            const modifiedOwner = yield this.generateKeyForDelegate(owner.id, delegateId);
-            return { owner: modifiedOwner, aesExchangeKeys: yield this.getEncryptedAesExchangeKeys(modifiedOwner, delegateId) };
-        });
-    }
-    /**
-     * Retrieve the owners HealthCareParty key, decrypt it, and
-     * use it to encrypt & initialize the "encryptionKeys" object
-     * and return it.
-     * @param createdObject
-     * @param ownerId
-     */
-    initEncryptionKeys(createdObject, ownerId) {
-        this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initEncryptionKeys', arguments);
-        const secretId = this.randomUuid();
-        return this.getDataOwner(ownerId).then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
-            const publicKeys = yield this.getPublicKeys();
-            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, ownerId);
-            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys);
-            const encryptedEncryptionKeys = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId), importedAESHcPartyKey.rawKey);
-            return {
-                encryptionKeys: _.fromPairs([
-                    [
-                        ownerId,
-                        [
-                            {
-                                owner: ownerId,
-                                delegatedTo: ownerId,
-                                key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKeys),
-                            },
-                        ],
-                    ],
-                ]),
-                secretId: secretId,
-                modifiedOwner
-            };
-        }));
-    }
-    /**
-     * Gets an updated instance of the EKs of `modifiedObject`.
-     * The updated EKs contain a new EK to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`.
-     * @param modifiedObject : the object of which EKs will be cloned, the clone will be used to append the new EK, and then used as return value; will NOT be mutated
-     * @param ownerId : delegator HcP id
-     * @param delegateId : delegate HcP id
-     * @param secretEncryptionKeyOfObject : secret Id for the EK (Content Encryption Key)
-     * @returns
-     *   - **encryptionKeys** existing EKs of the `modifiedObject`, appended with a new EK item (owner: `ownerId`, delegatedTo: `delegateId`, encrypted key with secretId:
-     *     `secretEncryptionKeyOfObject` )
-     *   - **secretId** which is the given input parameter `secretEncryptionKeyOfObject`
-     */
-    appendEncryptionKeys(
-    //TODO: suggested name: getExtendedEKwithDelegationFromDelegatorToDelegate
-    modifiedObject, ownerId, delegateId, secretEncryptionKeyOfObject) {
-        return __awaiter(this, arguments, void 0, function* () {
-            this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'appendEncryptionKeys', arguments); //modifiedObject should never be null
-            this.throwDetailedExceptionForInvalidParameter('secretEncryptionKeyOfObject', secretEncryptionKeyOfObject, 'appendEncryptionKeys', arguments);
-            const owner = (yield this.getDataOwner(ownerId)).dataOwner;
-            const publicKeys = yield this.getPublicKeys();
-            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
-            modifiedObject = (modifiedObject === null || modifiedObject === void 0 ? void 0 : modifiedObject.id) === owner.id ? modifiedOwner : modifiedObject;
-            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, delegateId, publicKeys);
-            const previousDecryptedEncryptionKeys = yield Promise.all(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => (d.key &&
-                d.owner === ownerId &&
-                this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                    console.log(`Cannot decrypt encryption key from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                    return Promise.resolve();
-                })) ||
-                Promise.resolve()));
-            const encryptedEncryptionKey = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretEncryptionKeyOfObject));
-            //try to limit the extent of the modifications to the delegations by preserving the redundant encryption keys already present and removing duplicates
-            //For delegate delegateId, we create:
-            // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for the existing encryption keys and the new key concatenated
-            // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
-            // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
-            const encryptionKeysCryptedDecrypted = _.merge(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => ({
-                d,
-            })), (previousDecryptedEncryptionKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
-                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                .map(({ d, k }) => ({ d, k: k || this.randomUuid() }))
-                .concat([
-                {
-                    d: {
-                        owner: ownerId,
-                        delegatedTo: delegateId,
-                        key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKey),
-                    },
-                    k: modifiedObject.id + ':' + secretEncryptionKeyOfObject,
-                },
-            ]);
-            const allEncryptionKeys = _.cloneDeep(modifiedObject.encryptionKeys || {});
-            allEncryptionKeys[delegateId] = _.uniqBy(encryptionKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
-            return {
-                modifiedObject: modifiedObject,
-                encryptionKeys: allEncryptionKeys,
-                secretId: secretEncryptionKeyOfObject,
-            };
-        });
-    }
-    /**
-     * Gets an updated `child` object that will have its SPKs, CFKs, KSs updated to include delegations from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
-     * The SFKs of `child` are not updated, so this method assumes this is not the initial delegation on the `child` object
-     * The method also performs some deduplication of all types of delegations.
-     * @param parent : the parent object of `child`; will NOT be mutated
-     * @param child : the object that will be mutated and returned
-     * @param ownerId delegator HcP id
-     * @param delegateId delegate HcP id
-     * @param secretDelegationKey  the secret Id used in the child object to generate the SPK
-     * @param secretEncryptionKey  the secret Id used in the child object to generate the EK (Content Encryption Key)
-     * @returns - an updated `child` object that will contain updated SPKs, CFKs, EKs
-     *  */
-    addDelegationsAndEncryptionKeys(
-    //TODO: suggested name: updateChildGenericDelegationsFromDelegatorToDelegate
-    parent, child, ownerId, delegateId, secretDelegationKey, secretEncryptionKey) {
-        return __awaiter(this, arguments, void 0, function* () {
-            if (parent)
-                this.throwDetailedExceptionForInvalidParameter('parent.id', parent.id, 'addDelegationsAndEncryptionKeys', arguments);
-            this.throwDetailedExceptionForInvalidParameter('child.id', child.id, 'addDelegationsAndEncryptionKeys', arguments);
-            const extendedChildObjectSPKsAndCFKs = secretDelegationKey
-                ? yield this.extendedDelegationsAndCryptedForeignKeys(child, parent, ownerId, delegateId, secretDelegationKey)
-                : { modifiedObject: child, delegations: {}, cryptedForeignKeys: {}, secretId: null };
-            const extendedChildObjectEKs = secretEncryptionKey
-                ? yield this.appendEncryptionKeys(extendedChildObjectSPKsAndCFKs.modifiedObject, ownerId, delegateId, secretEncryptionKey)
-                : { encryptionKeys: {}, modifiedObject: extendedChildObjectSPKsAndCFKs.modifiedObject };
-            const latestObject = extendedChildObjectEKs.modifiedObject;
-            return _.assign(latestObject, {
-                // Conservative version ... We might want to be more aggressive with the deduplication of keys
-                // For each delegate, we are going to concatenate to the src (the new delegations), the object in dest (the current delegations)
-                // for which we do not find an equivalent delegation (same delegator, same delegate)
-                delegations: _.assignWith(child.delegations, extendedChildObjectSPKsAndCFKs.delegations, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
-                cryptedForeignKeys: _.assignWith(child.cryptedForeignKeys, extendedChildObjectSPKsAndCFKs.cryptedForeignKeys, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
-                encryptionKeys: _.assignWith(child.encryptionKeys, extendedChildObjectEKs.encryptionKeys, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
-            });
-        });
-    }
-    /**
-     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param document : the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId : the id of the delegate HcP
-     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
-     */
-    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent; is this ok?
-    extractDelegationsSFKs(
-    //TODO: suggested name: getSecretIDsSPKofHcpAndParentsFromDocument
-    document, hcpartyId) {
-        if (!document || !hcpartyId) {
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId }); //TODO: thow exception instead?
-        }
-        const delegationsForAllDelegates = document.delegations;
-        if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
-            console.log(`There is no delegation in document (${document.id})`);
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, delegationsForAllDelegates);
-    }
-    /**
-     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param document : the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId : the id of the delegate HcP
-     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
-     */
-    extractSFKsHierarchyFromDelegations(document, hcpartyId) {
-        if (!document || !hcpartyId) {
-            return Promise.resolve([]);
-        }
-        const delegationsForAllDelegates = document.delegations;
-        if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
-            console.log(`There is no delegation in document (${document.id})`);
-            return Promise.resolve([]);
-        }
-        return this.extractKeysHierarchyFromDelegationLikes(hcpartyId, document.id, delegationsForAllDelegates);
-    }
-    // noinspection JSUnusedGlobalSymbols
-    extractCryptedFKs(
-    //TODO: suggested name: getSecretIDsCFKofHcpAndParentsFromDocument
-    document, hcpartyId) {
-        if (!document || !document.cryptedForeignKeys) {
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        const cfksForAllDelegates = document.cryptedForeignKeys;
-        if (!cfksForAllDelegates || !Object.keys(cfksForAllDelegates).length) {
-            console.log(`There is no cryptedForeignKeys in document (${document.id})`);
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, cfksForAllDelegates);
-    }
-    extractEncryptionsSKs(
-    //TODO: suggested name: getSecretIDsEKofHcpAndParentsFromDocument
-    document, hcpartyId) {
-        if (!document.encryptionKeys) {
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        const eckeysForAllDelegates = document.encryptionKeys;
-        if (!eckeysForAllDelegates || !Object.keys(eckeysForAllDelegates).length) {
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, eckeysForAllDelegates);
-    }
-    extractDelegationsSFKsAndEncryptionSKs(ety, ownerId) {
-        const delegationsSfksOwnerPromise = this.extractDelegationsSFKs(ety, ownerId).then((xks) => xks.extractedKeys); //Will climb up hierarchy
-        const encryptionKeysOwnerPromise = this.extractEncryptionsSKs(ety, ownerId).then((xks) => xks.extractedKeys); //Will climb up hierarchy
-        return Promise.all([delegationsSfksOwnerPromise, encryptionKeysOwnerPromise]);
-    }
-    /**
-     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
-     * 1. Get HealthCareParty from it's Id.
-     * 2. Decrypt the keys of the given HCP.
-     * 3. Decrypt the parent's key if it has parent.
-     * 4. Return the decrypted key corresponding to the Health Care Party.
-     * @param hcpartyId : the id of the delegate HcP (including its parents) for which to decrypt `extractedKeys`
-     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
-     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
-     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both HCP with given `hcpartyId` and its parents; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HCP id of the top parent in the hierarchy  (even if that parent has no delegations)
-     */
-    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent
-    extractKeysHierarchyFromDelegationLikes(
-    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
-    hcpartyId, objectId, delegations) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const { dataOwner: hcp } = yield this.getDataOwner(hcpartyId);
-            const extractedKeys = [];
-            if ((_a = delegations[hcpartyId]) === null || _a === void 0 ? void 0 : _a.length) {
-                const decryptedAndImportedAesHcPartyKeys = yield this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(hcpartyId, delegations, false);
-                const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce((map, k) => { var _a; return (Object.assign(Object.assign({}, map), { [k.delegatorId]: ((_a = map[k.delegatorId]) !== null && _a !== void 0 ? _a : []).concat([k]) })); }, {});
-                extractedKeys.push(...(yield this.decryptKeyInDelegationLikes(delegations[hcpartyId], collatedAesKeysFromDelegatorToHcpartyId, objectId)));
-            }
-            return hcp.parentId
-                ? [
-                    ...(yield this.extractKeysHierarchyFromDelegationLikes(hcp.parentId, objectId, delegations)),
-                    { extractedKeys: extractedKeys, hcpartyId: hcpartyId },
-                ]
-                : [{ extractedKeys: extractedKeys, hcpartyId: hcpartyId }];
-        });
-    }
-    /**
-     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
-     * 1. Get Data Owner (HCP, Patient or Device) from it's Id.
-     * 2. Decrypt the keys of the given data owner.
-     * 3. Decrypt the parent's key if it has parent.
-     * 4. Return the decrypted key corresponding to the Health Care Party.
-     * @param dataOwnerId : the id of the delegate data owner (including its parents) for which to decrypt `extractedKeys`
-     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
-     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
-     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both data owner with given `dataOwnerId` and its parents; can contain duplicates
-     * - **dataOwnerId** the given `dataOwnerId` OR, if a parent exist, the data owner id of the top parent in the hierarchy  (even if that parent has no delegations)
-     */
-    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned dataOwnerId will be the one of the parent
-    extractKeysFromDelegationsForHcpHierarchy(
-    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
-    dataOwnerId, objectId, delegations) {
-        return this.getDataOwner(dataOwnerId)
-            .then(({ dataOwner: hcp }) => (delegations[dataOwnerId] && delegations[dataOwnerId].length
-            ? this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, false).then((decryptedAndImportedAesHcPartyKeys) => {
-                const collatedAesKeysFromDelegatorToHcpartyId = {};
-                decryptedAndImportedAesHcPartyKeys.forEach((k) => {
-                    var _a;
-                    ;
-                    ((_a = collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId]) !== null && _a !== void 0 ? _a : (collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] = [])).push(k);
-                });
-                return this.decryptKeyInDelegationLikes(delegations[dataOwnerId], collatedAesKeysFromDelegatorToHcpartyId, objectId);
-            })
-            : Promise.resolve([]))
-            .then((extractedKeys) => __awaiter(this, void 0, void 0, function* () {
-            if (extractedKeys.length == 0) {
-                return yield this._extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(hcp, delegations, objectId);
-            }
-            return extractedKeys;
-        }))
-            .then((extractedKeys) => __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const parentExtractedKeys = hcp.parentId
-                ? yield this.extractKeysFromDelegationsForHcpHierarchy(hcp.parentId, objectId, delegations)
-                : { extractedKeys: [], hcpartyId: undefined };
-            return { extractedKeys: extractedKeys.concat(parentExtractedKeys.extractedKeys), hcpartyId: (_a = parentExtractedKeys.hcpartyId) !== null && _a !== void 0 ? _a : dataOwnerId };
-        })))
-            .catch((e) => {
-            console.error(`DataOwner with id ${dataOwnerId} cannot be resolved`);
-            throw e;
-        });
-    }
-    /**
-     * This method covers the use case when a DataOwner found back access to its data, and needs to use the delegations of its delegates instead
-     * of its own ones
-     *
-     * @param dataOwner The current data owner from whom we want to decrypt the aesExchangeKeys
-     * @param delegations The object delegations to decrypt
-     * @param objectId The object to decrypt id
-     * @private
-     */
-    _extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(dataOwner, delegations, objectId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            // Find other keys through aesExchangeKeys
-            const dataOwnerPubKeys = yield this.getPublicKeys();
-            const keysToDecrypt = (0, utils_1.fold)(Object.entries(dataOwner.aesExchangeKeys), {}, (acc, [pub, aesForPub]) => {
-                if (dataOwnerPubKeys.find((pubKey) => pubKey.slice(-32) == pub.slice(-32)) == undefined) {
-                    // We get AES Keys only from delegates of keys we don't currently have
-                    // Otherwise, decrypted AES Keys would have previously worked
-                    Object.entries(aesForPub).forEach(([delegateId, aesKeys]) => {
-                        if (delegateId != dataOwner.id) {
-                            const aesAcc = {};
-                            Object.entries(aesKeys)
-                                .filter(([encrPubKey]) => dataOwnerPubKeys.some((pubKey) => pubKey.slice(-32) == encrPubKey))
-                                .forEach(([pubKeyFingerprint, aesEncr]) => {
-                                aesAcc[pubKeyFingerprint] = aesEncr;
-                            });
-                            if (acc[delegateId] == undefined) {
-                                acc[delegateId] = {};
-                            }
-                            acc[delegateId][pub] = aesAcc;
-                        }
-                    });
-                }
-                return acc;
-            });
-            const decryptedAndImportedAesHcPartyKeys = yield (0, utils_1.foldAsync)(Object.entries(keysToDecrypt), [], (delKeysAcc, [delegateId, keysForDelegate]) => __awaiter(this, void 0, void 0, function* () {
-                try {
-                    delKeysAcc.push(yield this.decryptAnyAesExchangeKeyForOwner(keysForDelegate, dataOwner.id, dataOwner.id, delegateId, dataOwnerPubKeys));
-                }
-                catch (e) {
-                    console.log(`Could not decrypt aesExchangeKeys for delegate ${delegateId}`);
-                }
-                return delKeysAcc;
-            }));
-            const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce((map, k) => { var _a; return (Object.assign(Object.assign({}, map), { [k.delegatorId]: ((_a = map[k.delegatorId]) !== null && _a !== void 0 ? _a : []).concat([k]) })); }, {});
-            const delegateIdsWithNewExtractedAesKeys = Object.keys(keysToDecrypt);
-            const delegationsToDecrypt = (0, utils_1.fold)(Object.entries(delegations), [], (acc, [delegateId, del]) => {
-                if (delegateIdsWithNewExtractedAesKeys.find((id) => id == delegateId) != undefined) {
-                    acc.push(...delegations[delegateId]);
-                }
-                return acc;
-            });
-            return this.decryptKeyInDelegationLikes(delegationsToDecrypt, collatedAesKeysFromDelegatorToHcpartyId, objectId);
-        });
-    }
-    /**
-     * Gets an array of generic secret IDs decrypted from a list of generic delegations (SPKs, CFKs, EKs) `delegationsArray`
-     * If a particular generic delegation thows an exception when decrypted, the return value for it's secret ID will be 'false' and a message is logged to console
-     * For each one of the delegations in the `delegationsArray`, it tries to decrypt with the decryptedHcPartyKey of the owner of that delegation;
-     *
-     * @param delegationsArray : generic delegations array
-     * @param aesKeys : **key** HcP ids of delegators/owners in the `delegationsArray`, each with its own decryptedHcPartyKey
-     * @param masterId : is the object id to which the generic delegation belongs to
-     * - used only to check whether the object.id matches the one stored in the decrypted generic delegation item
-     * - even if there's no match, the secret ID is kept as a valid result (and a message logged to console)
-     * @returns array of generic secret IDs (secretIdSPK, parentId, secretIdEK)
-     */
-    decryptKeyInDelegationLikes(
-    //TODO: suggested name: getSecretIdsFromGenericDelegations
-    delegationsArray, aesKeysForDataOwnerId, masterId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const decryptPromises = delegationsArray.map((genericDelegationItem) => __awaiter(this, void 0, void 0, function* () {
-                const aesKeys = aesKeysForDataOwnerId[genericDelegationItem.owner];
-                if (aesKeys === null || aesKeys === void 0 ? void 0 : aesKeys.length) {
-                    return aesKeys.reduce((acc, aesKey) => __awaiter(this, void 0, void 0, function* () {
-                        const accValue = yield acc;
-                        if (accValue) {
-                            return accValue;
-                        }
-                        try {
-                            const decryptedGenericDelegationKey = yield this._AES.decrypt(aesKey.key, (0, binary_utils_1.hex2ua)(genericDelegationItem.key), aesKey.rawKey);
-                            const results = (0, binary_utils_1.ua2string)(decryptedGenericDelegationKey).split(':');
-                            const objectId = results[0]; //must be the ID of the object, for checksum
-                            const genericSecretId = results[1];
-                            const details = 'object ID: ' + masterId + '; generic delegation from ' + genericDelegationItem.owner + ' to ' + genericDelegationItem.delegatedTo;
-                            if (!objectId)
-                                console.warn('Object id is empty; ' + details);
-                            if (!genericSecretId)
-                                console.warn('Secret id is empty; ' + details);
-                            if (objectId !== masterId) {
-                                /*console.log(
-                                  "Cryptographic mistake: object ID is not equal to the expected concatenated id within decrypted generic delegation. This may happen when patients have been merged; " +
-                                    details
-                                )*/
-                            }
-                            return genericSecretId;
-                        }
-                        catch (err) {
-                            console.log(`Could not decrypt generic delegation in object with ID: ${masterId} from ${genericDelegationItem.owner} to ${genericDelegationItem.delegatedTo}: ${err}`);
-                            return undefined;
-                        }
-                    }), Promise.resolve(undefined));
-                }
-                else {
-                    console.log(`Could not find aes key for object with ID: ${masterId}`);
-                }
-            }));
-            return Promise.all(decryptPromises).then((genericSecretId) => genericSecretId.filter((id) => !!id));
-        });
-    }
-    getPublicKeyFromPrivateKey(privateKey, dataOwner) {
-        var _a;
-        if (!privateKey.n || !privateKey.e) {
-            throw new Error('No public key can be deduced from incomplete private key');
-        }
-        const publicKeyFromPrivateKey = (0, utils_1.jwk2spki)(privateKey);
-        const publicKeys = [dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x);
-        if (!publicKeys.length) {
-            throw new Error('No public key has been defined for hcp');
-        }
-        const publicKey = publicKeys.find((it) => it === publicKeyFromPrivateKey);
-        if (!publicKey) {
-            throw new Error('No public key can be found for this private key');
-        }
-        return publicKey;
-    }
-    loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, privateKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
-            const privateKeyInJwk = (0, utils_1.pkcs8ToJwk)(privateKey);
-            const publicKey = this.getPublicKeyFromPrivateKey(privateKeyInJwk, dataOwner);
-            const keyPair = yield this._RSA.importKeyPair('jwk', privateKeyInJwk, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
-            this.rsaKeyPairs[publicKey.slice(-32)] = keyPair;
-            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-            return yield this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
-        });
-    }
-    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privateKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
-            if ((!privateKey.n || !privateKey.e) && dataOwner.publicKey) {
-                //Fallback on default publicKey
-                console.warn('An incomplete key has been completed using the default public key of the data owner');
-                const publicKeyInJwk = (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(dataOwner.publicKey));
-                privateKey.n = publicKeyInJwk.n;
-                privateKey.e = publicKeyInJwk.e;
-            }
-            const publicKey = this.getPublicKeyFromPrivateKey(privateKey, dataOwner);
-            const keyPair = yield this._RSA.importKeyPair('jwk', privateKey, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
-            this.rsaKeyPairs[publicKey.slice(-32)] = keyPair;
-            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-            return yield this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
-        });
-    }
-    // noinspection JSUnusedGlobalSymbols
-    loadKeyPairsInBrowserLocalStorage(healthcarePartyId, file) {
-        const fr = new FileReader();
-        return new Promise((resolve, reject) => {
-            fr.onerror = reject;
-            fr.onabort = reject;
-            fr.onload = (e) => {
-                //TODO remove any
-                const privateKey = e.target.result;
-                this.loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, (0, binary_utils_1.hex2ua)(privateKey))
-                    .then(() => resolve())
-                    .catch(reject);
-            };
-            fr.readAsText(file);
-        });
-    }
-    // noinspection JSUnusedGlobalSymbols
-    saveKeychainInBrowserLocalStorage(id, keychain) {
-        this._storage.setItem(this.keychainLocalStoreIdPrefix + id, (0, binary_utils_1.b2a)(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), '')));
-    }
-    saveKeychainInBrowserLocalStorageAsBase64(id, keyChainB64) {
-        this._storage.setItem(this.keychainLocalStoreIdPrefix + id, keyChainB64);
-    }
-    // noinspection JSUnusedGlobalSymbols
-    saveKeychainValidityDateInBrowserLocalStorage(id, date) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!id)
-                return;
-            if (!date) {
-                yield this._storage.removeItem(this.keychainValidityDateLocalStoreIdPrefix + id);
-            }
-            else {
-                yield this._storage.setItem(this.keychainValidityDateLocalStoreIdPrefix + id, date);
-            }
-        });
-    }
-    /**
-     * Populate the HCP.options dict with an encrypted eHealth certificate and unencryped expiry date.
-     * Any potentially unencrypted certificates will be pruned from the HCP.
-     * @param hcpId Id of the hcp to modify
-     * @returns modified HCP
-     */
-    saveKeyChainInHCPFromLocalStorage(hcpId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
-                let aesKey = null;
-                try {
-                    aesKey = _.find(yield this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id], hcp.id), (delegator) => delegator.delegatorId === hcp.id).key;
-                }
-                catch (e) {
-                    console.error('Error while importing the AES key.');
-                }
-                if (!aesKey) {
-                    console.error('No encryption key!');
-                }
-                const opts = hcp.options || {};
-                const crt = yield this.getKeychainInBrowserLocalStorageAsBase64(hcp.id);
-                if (!!aesKey && !!crt) {
-                    let crtEncrypted = null;
-                    try {
-                        crtEncrypted = yield this.AES.encrypt(aesKey, new Uint8Array((0, binary_utils_1.string2ua)(atob(crt))));
-                    }
-                    catch (e) {
-                        console.error('Error while encrypting the certificate', e);
-                    }
-                    // add the encrypted certificate to the options
-                    _.set(opts, this.hcpPreferenceKeyEhealthCert, (0, binary_utils_1.ua2string)(new Uint8Array(crtEncrypted)));
-                }
-                const crtValidityDate = this.getKeychainValidityDateInBrowserLocalStorage(hcp.id);
-                if (!!crtValidityDate) {
-                    _.set(opts, this.hcpPreferenceKeyEhealthCertDate, crtValidityDate);
-                }
-                hcp.options = opts;
-                return hcp;
-            }));
-        });
-    }
-    importKeychainInBrowserFromHCP(hcpId) {
-        return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
-            let crtCryp = null;
-            if (!!hcp.options && !!hcp.options[this.hcpPreferenceKeyEhealthCert]) {
-                crtCryp = (0, binary_utils_1.string2ua)(hcp.options[this.hcpPreferenceKeyEhealthCert]);
-            }
-            const crtValidityDate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCertDate);
-            // store the validity date
-            if (!!crtValidityDate) {
-                this.saveKeychainValidityDateInBrowserLocalStorage(hcp.id, crtValidityDate);
-            }
-            let crt = null;
-            let decryptionKey = null;
-            try {
-                decryptionKey = _.find(yield this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id], hcp.id), (delegator) => delegator.delegatorId === hcp.id).key;
-            }
-            catch (e) {
-                console.error('Error while importing the AES key.');
-            }
-            if (!decryptionKey) {
-                throw new Error('No encryption key! eHealth certificate cannot be decrypted.');
-            }
-            if (!!crtCryp && decryptionKey) {
-                try {
-                    crt = yield this.AES.decrypt(decryptionKey, crtCryp);
-                }
-                catch (e) {
-                    console.error(e);
-                }
-            }
-            if (!crt) {
-                throw new Error(`Error while saving certificate in browser local storage! Hcp ${hcp.id} has no certificate.`);
-            }
-            else {
-                this.saveKeychainInBrowserLocalStorageAsBase64(hcp.id, btoa(String.fromCharCode.apply(null, Array.from(new Uint8Array(crt)))));
-            }
-            return;
-        }));
-    }
-    /**
-     * Synchronizes the eHealth certificate from the database into the LocalStorage, returning information on the presence
-     * of certificate data in either place.
-     *
-     * @param hcpId The healthcare party id
-     * @returns A Promise for an object that represents the existence of a certificate in local storage and in the DB,
-     * through the two boolean properties "local" and "remote".
-     */
-    syncEhealthCertificateFromDatabase(hcpId) {
-        return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => {
-            const remoteCertificate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCert);
-            const localCertificate = this.getKeychainInBrowserLocalStorageAsBase64(hcp.id);
-            if (remoteCertificate) {
-                return this.importKeychainInBrowserFromHCP(hcp.id)
-                    .then(() => ({ local: true, remote: true }))
-                    .catch(() => ({ local: !!localCertificate, remote: true }));
-            }
-            else {
-                return { local: !!localCertificate, remote: !!remoteCertificate };
-            }
-        });
-    }
-    getKeychainInBrowserLocalStorageAsBase64(id) {
-        return this._storage.getItem(this.keychainLocalStoreIdPrefix + id);
-    }
-    getKeychainValidityDateInBrowserLocalStorage(id) {
-        return this._storage.getItem(this.keychainValidityDateLocalStoreIdPrefix + id);
-    }
-    // noinspection JSUnusedGlobalSymbols
-    loadKeychainFromBrowserLocalStorage(id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const lsItem = yield this._storage.getItem(this.keychainLocalStoreIdPrefix + id);
-            return lsItem !== undefined ? (0, binary_utils_1.b64_2uas)(lsItem) : null;
-        });
-    }
-    /**
-     * loads the RSA key pair (hcparty) in JWK from local storage, not imported
-     *
-     * @param id  doc id - hcpartyId
-     * @param publicKeyFingerPrint the 32 last characters of public key this private key is associated with
-     * @returns {Object} it is in JWK - not imported
-     */
-    loadKeyPairNotImported(id, publicKeyFingerPrint) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            //TODO decryption
-            const item = publicKeyFingerPrint
-                ? (_a = (yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id + '.' + publicKeyFingerPrint.slice(-32)))) !== null && _a !== void 0 ? _a : (yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id))
-                : yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
-            if (!item) {
-                console.warn(`No key can be found in local storage for id ${id} and publicKeyFingerPrint ${publicKeyFingerPrint}`);
-            }
-            return item;
-        });
-    }
-    /**
-     * Loads and imports the RSA key pair (hcparty) from local storage
-     *
-     * @param id  doc id - hcPartyId
-     * @returns {Promise} -> {CryptoKey} - imported RSA
-     */
-    loadKeyPairImported(id) {
-        return new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
-            try {
-                const jwkKeyPair = yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
-                if (jwkKeyPair !== undefined) {
-                    if (jwkKeyPair.publicKey && jwkKeyPair.privateKey) {
-                        this._RSA.importKeyPair('jwk', jwkKeyPair.privateKey, 'jwk', jwkKeyPair.publicKey).then(resolve, (err) => {
-                            console.error('Error in RSA.importKeyPair: ' + err);
-                            reject(err);
-                        });
-                    }
-                    else {
-                        const message = 'Error in RSA.importKeyPair: Invalid key';
-                        console.error(message);
-                        reject(Error(message));
-                    }
-                }
-                else {
-                    const message = 'Error in RSA.importKeyPair: Missing key';
-                    console.error(message);
-                    reject(Error(message));
-                }
-            }
-            catch (err) {
-                reject(err);
-            }
-        }));
-    }
-    /**
-     * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
-     * AES key using the new user public key.
-     *
-     * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
-     * @param ownerId Id of the data owner to which we would like to give access back
-     * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
-     *
-     * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
-     */
-    giveAccessBackTo(delegateUser, ownerId, ownerNewPublicKey) {
-        var _a, _b, _c, _d;
-        return __awaiter(this, void 0, void 0, function* () {
-            const delegateId = (_b = (_a = delegateUser.healthcarePartyId) !== null && _a !== void 0 ? _a : delegateUser.patientId) !== null && _b !== void 0 ? _b : delegateUser.deviceId;
-            if (!delegateId) {
-                throw new Error(`DelegateUser ${delegateUser.id} must be a data Owner`);
-            }
-            const delegatePublicKeys = yield this.getPublicKeys();
-            const newPubKeyCryptoKey = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(ownerNewPublicKey)), ['encrypt']);
-            const dataOwnerToUpdate = yield this.getDataOwner(ownerId);
-            const newAesExchangeKeys = yield (0, utils_1.foldAsync)(Object.entries((_c = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => __awaiter(this, void 0, void 0, function* () {
-                var _e;
-                const existingKeys = (_e = pubAcc[pubKey]) !== null && _e !== void 0 ? _e : {};
-                pubAcc[pubKey] = yield (0, utils_1.foldAsync)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => __awaiter(this, void 0, void 0, function* () {
-                    if (delId == delegateId && pubKey != ownerNewPublicKey) {
-                        // Add the AES Key encrypted with the new public key in the aesExchangeKeys
-                        try {
-                            // First, we decrypt it using the delegate RSA Public Key
-                            const encrAesKeyInfo = yield this.decryptHcPartyKey(delegateId, dataOwnerToUpdate.dataOwner.id, delegateId, pubKey, delKeys, delegatePublicKeys).then((delegatorAndKeys) => __awaiter(this, void 0, void 0, function* () {
-                                // Then, we encrypt it using the owner new RSA Public Key (provided in argument)
-                                return yield this.encryptAesKeyOnlyForProvidedKeys(delegatorAndKeys === null || delegatorAndKeys === void 0 ? void 0 : delegatorAndKeys.rawKey, dataOwnerToUpdate, [newPubKeyCryptoKey])
-                                    .then((encrAes) => Object.values(encrAes)[0])
-                                    .then((encrAesInfo) => {
-                                    return { pubKeyUsedToEncryptAes: Object.keys(encrAesInfo)[0], encryptedAes: Object.values(encrAesInfo)[0] };
-                                });
-                            }));
-                            delKeys[encrAesKeyInfo.pubKeyUsedToEncryptAes] = encrAesKeyInfo.encryptedAes;
-                        }
-                        catch (e) {
-                            console.log(`${delegateId} could not re-encrypt AES Key of ${dataOwnerToUpdate.dataOwner.id}`);
-                        }
-                        finally {
-                            delAcc[delId] = delKeys;
-                        }
-                    }
-                    else {
-                        // Otherwise, we don't transform the aesExchangeKeys for this delegate
-                        delAcc[delId] = delKeys;
-                    }
-                    return delAcc;
-                }));
-                return pubAcc;
-            }));
-            // After adding the potential new aesExchangeKeys, we save the updated data owner
-            return this._saveDataOwner({
-                type: dataOwnerToUpdate.type,
-                dataOwner: Object.assign(Object.assign({}, dataOwnerToUpdate.dataOwner), { aesExchangeKeys: newAesExchangeKeys }),
-            });
-        });
-    }
-    addNewKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, generateTransferKey = true, sendMaintenanceTasks = true) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.addNewKeyPairForOwner(maintenanceTasksApi, user, yield this.getDataOwner(ownerId), generateTransferKey, sendMaintenanceTasks);
-        });
-    }
-    addNewKeyPairForOwner(maintenanceTasksApi, user, cdo, generateTransferKey = true, sendMaintenanceTasks = true) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const generatedKeypair = yield this.RSA.generateKeyPair();
-            return this.addKeyPairForOwner(maintenanceTasksApi, user, cdo, generatedKeypair, generateTransferKey, sendMaintenanceTasks);
-        });
-    }
-    addRawKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, keypair, generateTransferKey = true, sendMaintenanceTasks = true) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.addRawKeyPairForOwner(maintenanceTasksApi, user, yield this.getDataOwner(ownerId), keypair, generateTransferKey, sendMaintenanceTasks);
-        });
-    }
-    addRawKeyPairForOwner(maintenanceTasksApi, user, cdo, keypair, generateTransferKey = true, sendMaintenanceTasks = true) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const importedPrivateKey = yield this._RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(keypair.privateKey), ['decrypt']);
-            const importedPublicKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(keypair.publicKey), ['encrypt']);
-            return this.addKeyPairForOwner(maintenanceTasksApi, user, cdo, { publicKey: importedPublicKey, privateKey: importedPrivateKey }, generateTransferKey, sendMaintenanceTasks);
-        });
-    }
-    addKeyPairForOwner(maintenanceTasksApi, user, cdo, keypair, generateTransferKey = true, sendMaintenanceTasks = true) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const publicKeyHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keypair.publicKey, 'spki'));
-            const gen = (yield this._AES.generateCryptoKey(true));
-            yield this.cacheKeyPair({
-                publicKey: yield this.RSA.exportKey(keypair.publicKey, 'jwk'),
-                privateKey: yield this.RSA.exportKey(keypair.privateKey, 'jwk'),
-            });
-            const { type: ownerType, dataOwner: ownerToUpdate } = yield this.createOrUpdateAesExchangeKeysFor(cdo, gen, {
-                pubKey: keypair.publicKey,
-                privKey: keypair.privateKey,
-            }).then((dataOwnerWithUpdatedAesKeys) => __awaiter(this, void 0, void 0, function* () {
-                return generateTransferKey
-                    ? yield this.createOrUpdateTransferKeysFor(dataOwnerWithUpdatedAesKeys, gen, { pubKey: keypair.publicKey, privKey: keypair.privateKey })
-                    : dataOwnerWithUpdatedAesKeys;
-            }));
-            const modifiedDataOwnerAndType = yield this._saveDataOwner({ type: ownerType, dataOwner: ownerToUpdate });
-            const sentMaintenanceTasks = sendMaintenanceTasks
-                ? yield this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, keypair.publicKey)
-                : [];
-            return {
-                dataOwner: sentMaintenanceTasks.length
-                    ? yield this.retrieveDataOwnerInfoAfterPotentialUpdate(modifiedDataOwnerAndType.dataOwner)
-                    : modifiedDataOwnerAndType.dataOwner,
-                publicKey: publicKeyHex,
-                privateKey: (0, binary_utils_1.ua2hex)((yield this.RSA.exportKey(keypair.privateKey, 'pkcs8'))),
-            };
-        });
-    }
-    _saveDataOwner(dataOwner) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const ownerType = dataOwner.type;
-            const ownerToUpdate = dataOwner.dataOwner;
-            return ownerType === 'hcp'
-                ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.hcpartyBaseApi
-                    .modifyHealthcareParty(ownerToUpdate)
-                    .then((x) => ({ type: 'hcp', dataOwner: x })))
-                : ownerType === 'patient'
-                    ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.patientBaseApi
-                        .modifyPatient(ownerToUpdate)
-                        .then((x) => ({ type: 'patient', dataOwner: x })))
-                    : yield (this.dataOwnerCache[ownerToUpdate.id] = this.deviceBaseApi
-                        .updateDevice(ownerToUpdate)
-                        .then((x) => ({ type: 'device', dataOwner: x })));
-        });
-    }
-    createOrUpdateAesExchangeKeysFor(cdo, decryptedAesExchangeKey, keyToEncrypt) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const publicKeyHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keyToEncrypt.pubKey, 'spki'));
-            const existingAesExchangeKeys = (_a = cdo.dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {};
-            existingAesExchangeKeys[publicKeyHex] = yield this.encryptAesKeyFor(decryptedAesExchangeKey, cdo.dataOwner, keyToEncrypt.pubKey);
-            return { type: cdo.type, dataOwner: Object.assign(Object.assign({}, cdo.dataOwner), { aesExchangeKeys: existingAesExchangeKeys }) };
-        });
-    }
-    createOrUpdateTransferKeysFor(dataOwner, decryptedAesExchangeKey, keyToEncrypt) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const pubKeyToEncryptHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keyToEncrypt.pubKey, 'spki'));
-            const encryptedKey = (0, binary_utils_1.ua2hex)(yield this._AES.encrypt(yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(decryptedAesExchangeKey)), (yield this.RSA.exportKey(keyToEncrypt.privKey, 'pkcs8')), decryptedAesExchangeKey));
-            const dataOwnerExistingPubKeys = Array.from(yield this.getDataOwnerHexPublicKeys(dataOwner.dataOwner));
-            const transferKeys = (0, utils_1.fold)(dataOwnerExistingPubKeys, (_a = dataOwner.dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {}, (pubAcc, pubKeyHex) => {
-                var _a;
-                if (pubKeyHex !== pubKeyToEncryptHex) {
-                    const existingKeys = (_a = pubAcc[pubKeyHex]) !== null && _a !== void 0 ? _a : {};
-                    existingKeys[pubKeyToEncryptHex] = encryptedKey;
-                    pubAcc[pubKeyHex] = existingKeys;
-                }
-                return pubAcc;
-            });
-            return { type: dataOwner.type, dataOwner: Object.assign(Object.assign({}, dataOwner.dataOwner), { transferKeys: transferKeys }) };
-        });
-    }
-    encryptAesKeyFor(aesKey, dataOwner, doNewPublicKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const dataOwnerAllPubKeys = [doNewPublicKey].concat(yield this.getDataOwnerPublicKeys(dataOwner));
-            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerAllPubKeys);
-        });
-    }
-    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerPubKeys) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const encryptedAesForDataOwner = yield (0, utils_1.foldAsync)(dataOwnerPubKeys, {}, (encrAes, pubKey) => __awaiter(this, void 0, void 0, function* () {
-                encrAes[(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(pubKey, (0, binary_utils_1.hex2ua)(aesKey)));
-                return encrAes;
-            }));
-            return { [dataOwner.id]: encryptedAesForDataOwner };
-        });
-    }
-    retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {
-        this.emptyHcpCache(dataOwnerToUpdate.id);
-        return this.getDataOwner(dataOwnerToUpdate.id).then(({ type, dataOwner }) => {
-            var _a, _b, _c, _d;
-            return {
-                type: type,
-                dataOwner: Object.assign(Object.assign({}, dataOwner), { transferKeys: dataOwnerToUpdate.transferKeys, hcPartyKeys: (0, utils_1.fold)(Object.entries((_a = dataOwnerToUpdate.hcPartyKeys) !== null && _a !== void 0 ? _a : {}), (_b = dataOwner.hcPartyKeys) !== null && _b !== void 0 ? _b : {}, (acc, [delegateId, hcKeys]) => {
-                        acc[delegateId] = hcKeys;
-                        return acc;
-                    }), aesExchangeKeys: (0, utils_1.fold)(Object.entries((_c = dataOwnerToUpdate.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => {
-                        var _a;
-                        const existingKeys = (_a = pubAcc[pubKey]) !== null && _a !== void 0 ? _a : {};
-                        pubAcc[pubKey] = (0, utils_1.fold)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => {
-                            delAcc[delId] = delKeys;
-                            return delAcc;
-                        });
-                        return pubAcc;
-                    }) }),
-            };
-        });
-    }
-    sendMaintenanceTasks(maintenanceTaskApi, user, dataOwner, newPublicKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const hexNewPubKey = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(newPublicKey, 'spki'));
-            const nonAccessiblePubKeys = Array.from(this.getDataOwnerHexPublicKeys(dataOwner).values())
-                .filter((existingPubKey) => existingPubKey != hexNewPubKey)
-                .filter((existingPubKey) => __awaiter(this, void 0, void 0, function* () { return (yield this.getPublicKeysAsSpki()).find((pubKey) => pubKey == existingPubKey) == undefined; }));
-            if (nonAccessiblePubKeys.length) {
-                const tasksForDelegates = Object.entries(yield this.getEncryptedAesExchangeKeysForDelegate(dataOwner.id))
-                    .filter(([delegatorId]) => delegatorId != dataOwner.id)
-                    .flatMap(([delegatorId, delegatorKeys]) => {
-                    return Object.entries(delegatorKeys).flatMap(([, aesExchangeKeys]) => {
-                        return Object.keys(aesExchangeKeys).map((delegatePubKey) => {
-                            return { delegateId: delegatorId, maintenanceTask: this.createMaintenanceTask(dataOwner, delegatePubKey) };
-                        });
-                    });
-                });
-                const tasksForDelegator = (yield this._getDelegateIdsOf(dataOwner))
-                    .filter((delegateId) => delegateId != dataOwner.id)
-                    .map((delegateId) => {
-                    return { delegateId: delegateId, maintenanceTask: this.createMaintenanceTask(dataOwner, hexNewPubKey) };
-                });
-                return yield tasksForDelegates.concat(tasksForDelegator).reduce((existingTasks, task) => __awaiter(this, void 0, void 0, function* () {
-                    const taskToCreate = yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.newInstance(user, task.maintenanceTask, [task.delegateId]));
-                    const createdTask = taskToCreate ? yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.createMaintenanceTaskWithUser(user, taskToCreate)) : undefined;
-                    return createdTask ? (yield existingTasks).concat(createdTask) : yield existingTasks;
-                }), Promise.resolve([]));
-            }
-            else {
-                return [];
-            }
-        });
-    }
-    createMaintenanceTask(concernedDataOwner, concernedPubKey) {
-        return new models_1.MaintenanceTask({
-            id: this.randomUuid(),
-            taskType: 'KEY_PAIR_UPDATE',
-            status: models_1.MaintenanceTask.StatusEnum.Pending,
-            properties: [
-                new models_1.PropertyStub({
-                    id: 'dataOwnerConcernedId',
-                    type: new models_1.PropertyTypeStub({ type: models_1.PropertyTypeStub.TypeEnum.STRING }),
-                    typedValue: new models_1.TypedValueObject({
-                        type: models_1.TypedValueObject.TypeEnum.STRING,
-                        stringValue: concernedDataOwner.id,
-                    }),
-                }),
-                new models_1.PropertyStub({
-                    id: 'dataOwnerConcernedPubKey',
-                    type: new models_1.PropertyTypeStub({ type: models_1.PropertyTypeStub.TypeEnum.STRING }),
-                    typedValue: new models_1.TypedValueObject({
-                        type: models_1.TypedValueObject.TypeEnum.STRING,
-                        stringValue: concernedPubKey,
-                    }),
-                }),
-            ],
-        });
-    }
-    getDataOwnerHexPublicKeys(dataOwner) {
-        return new Set((dataOwner.publicKey ? [dataOwner.publicKey] : [])
-            .concat(dataOwner.aesExchangeKeys ? Object.keys(dataOwner.aesExchangeKeys) : [])
-            .filter((pubKey) => !!pubKey));
-    }
-    getDataOwnerPublicKeys(dataOwner) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield Promise.all(Array.from(this.getDataOwnerHexPublicKeys(dataOwner)).map((pubKey) => __awaiter(this, void 0, void 0, function* () { return yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(pubKey)), ['encrypt']); })));
-        });
-    }
-    generateKeyForDelegate(ownerId, delegateId) {
-        //Preload hcp and patient because we need them and they are going to be invalidated from the caches
-        return (0, utils_1.notConcurrent)(this.generateKeyConcurrencyMap, ownerId, () => __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e;
-            const [{ type: ownerType, dataOwner: owner }, { dataOwner: delegate }] = yield Promise.all([
-                this.getDataOwner(ownerId),
-                this.getDataOwner(delegateId),
-            ]);
-            const availablePublicKeysFingerprints = Object.keys(this.rsaKeyPairs);
-            const ownerLegacyPublicKey = owner.publicKey;
-            const isOwnerLegacyPublicKeyAvailable = ownerLegacyPublicKey
-                ? availablePublicKeysFingerprints.some((fp) => ownerLegacyPublicKey.endsWith(fp))
-                : false;
-            const availableOwnerPublicKeys = [
-                ownerLegacyPublicKey,
-                ...Object.keys(owner.aesExchangeKeys || {}).filter((x) => x !== ownerLegacyPublicKey),
-            ].filter((k) => !!k && availablePublicKeysFingerprints.some((fp) => k.endsWith(fp)));
-            const selectedPublicKey = availableOwnerPublicKeys[0];
-            if (!selectedPublicKey) {
-                throw new Error(`Invalid owner, no public key, keypairs have not be set for ${ownerId}`);
-            }
-            if (((owner.hcPartyKeys || {})[delegateId] && owner.publicKey && availablePublicKeysFingerprints.includes(owner.publicKey.slice(-32))) ||
-                Object.values(owner.aesExchangeKeys || {}).some((x) => x[delegateId] && Object.keys(x[delegateId]).some((k) => availablePublicKeysFingerprints.includes(k)))) {
-                return owner;
-            }
-            let ownerCombinedAesExchangeKeys = (_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {};
-            if (ownerLegacyPublicKey && !((_b = owner.aesExchangeKeys) !== null && _b !== void 0 ? _b : {})[ownerLegacyPublicKey]) {
-                //Transfer keys from old structure (hcparty keys) to new one (aesExchangeKeys)
-                const unknownDataOwnerCounterPartIds = Object.keys((_c = owner.hcPartyKeys) !== null && _c !== void 0 ? _c : {}).filter((x) => x !== ownerId && x !== delegateId);
-                const counterParts = [
-                    owner,
-                    delegate,
-                    ...(yield Promise.all(unknownDataOwnerCounterPartIds.map((cpid) => this.getDataOwner(cpid).then((dot) => dot.dataOwner)))),
-                ];
-                ownerCombinedAesExchangeKeys = Object.assign({ [ownerLegacyPublicKey]: Object.entries((_d = owner.hcPartyKeys) !== null && _d !== void 0 ? _d : {}).reduce((map, [hcpId, keys]) => {
-                        var _a, _b;
-                        return (Object.assign(Object.assign(Object.assign({}, map), { [hcpId]: { [ownerLegacyPublicKey.slice(-32)]: keys[0], [(_b = (_a = counterParts.find((x) => x.id === hcpId)) === null || _a === void 0 ? void 0 : _a.publicKey) !== null && _b !== void 0 ? _b : '']: keys[1] } }), {}));
-                    }, {}) }, ownerCombinedAesExchangeKeys);
-            }
-            const delegatePublicKeys = [delegate.publicKey, ...Object.keys((_e = delegate.aesExchangeKeys) !== null && _e !== void 0 ? _e : {}).filter((x) => x !== delegate.publicKey)].filter((x) => !!x);
-            if (!delegatePublicKeys.length) {
-                throw new Error(`Invalid delegate, no public key, keypairs have not be set for ${delegateId}`);
-            }
-            const genProm = this._AES.generateCryptoKey(true).then((AESKey) => __awaiter(this, void 0, void 0, function* () {
-                var _f, _g;
-                const allPubKeys = [...availableOwnerPublicKeys, ...delegatePublicKeys];
-                const encryptedAesKeys = yield allPubKeys.reduce((map, pubK) => __awaiter(this, void 0, void 0, function* () {
-                    return (Object.assign(Object.assign({}, (yield map)), { [pubK.slice(-32)]: (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(pubK)), ['encrypt']), (0, binary_utils_1.hex2ua)(AESKey))) }));
-                }), Promise.resolve({}));
-                if (delegate.publicKey && ownerLegacyPublicKey && isOwnerLegacyPublicKeyAvailable) {
-                    owner.hcPartyKeys[delegateId] = [encryptedAesKeys[ownerLegacyPublicKey.slice(-32)], encryptedAesKeys[delegate.publicKey.slice(-32)]];
-                }
-                owner.aesExchangeKeys = this.fixAesExchangeKeyEntriesToFingerprints(Object.assign(Object.assign({}, (ownerCombinedAesExchangeKeys !== null && ownerCombinedAesExchangeKeys !== void 0 ? ownerCombinedAesExchangeKeys : {})), { [selectedPublicKey]: Object.assign(Object.assign({}, ((_g = (_f = owner.aesExchangeKeys) === null || _f === void 0 ? void 0 : _f[selectedPublicKey]) !== null && _g !== void 0 ? _g : {})), { [delegateId]: encryptedAesKeys }) }));
-                return new Promise((resolve, reject) => {
-                    ownerType === 'hcp'
-                        ? (this.dataOwnerCache[owner.id] = this.hcpartyBaseApi
-                            .modifyHealthcareParty(owner)
-                            .then((x) => ({ type: 'hcp', dataOwner: x })))
-                            .then((x) => resolve(['hcp', x.dataOwner]))
-                            .catch((e) => reject(e))
-                        : ownerType === 'patient'
-                            ? (this.dataOwnerCache[owner.id] = this.patientBaseApi.modifyPatient(owner).then((x) => ({ type: 'patient', dataOwner: x })))
-                                .then((x) => resolve(['patient', x.dataOwner]))
-                                .catch((e) => reject(e))
-                            : (this.dataOwnerCache[owner.id] = this.deviceBaseApi.updateDevice(owner).then((x) => ({ type: 'device', dataOwner: x })))
-                                .then((x) => resolve(['device', x.dataOwner]))
-                                .catch((e) => reject(e));
-                });
-            }));
-            this.hcPartyKeysRequestsCache[delegateId] = genProm.then(() => {
-                return this.forceGetEncryptedAesExchangeKeysForDelegate(delegateId);
-            });
-            return genProm.then((res) => {
-                return res[1];
-            });
-        }));
-    }
-    getDataOwner(ownerId, loadIfMissingFromCache = true) {
-        var _a;
-        return ((_a = this.dataOwnerCache[ownerId]) !== null && _a !== void 0 ? _a : (loadIfMissingFromCache
-            ? (this.dataOwnerCache[ownerId] = this.patientBaseApi
-                .getPatient(ownerId)
-                .then((x) => ({ type: 'patient', dataOwner: x }))
-                .catch(() => this.deviceBaseApi.getDevice(ownerId).then((x) => ({ type: 'device', dataOwner: x })))
-                .catch(() => this.hcpartyBaseApi.getHealthcareParty(ownerId).then((x) => ({ type: 'hcp', dataOwner: x })))
-                .catch((e) => {
-                delete this.dataOwnerCache[ownerId];
-                throw e;
-            }))
-            : undefined));
-    }
-    // noinspection JSUnusedGlobalSymbols
-    checkPrivateKeyValidity(dataOwner) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const publicKeys = Array.from(new Set([dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x)));
-            return yield publicKeys.reduce((pres, publicKey) => __awaiter(this, void 0, void 0, function* () {
-                const res = yield pres;
-                try {
-                    const k = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)), ['encrypt']);
-                    const cipher = yield this._RSA.encrypt(k, (0, binary_utils_1.utf8_2ua)('shibboleth'));
-                    const ikp = yield this.getCachedRsaKeyPairForFingerprint(dataOwner.id, publicKey.slice(-32));
-                    const plainText = (0, binary_utils_1.ua2utf8)(yield this._RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)));
-                    return plainText === 'shibboleth' || res;
-                }
-                catch (e) {
-                    return res;
-                }
-            }), Promise.resolve(false));
-        });
-    }
-    throwDetailedExceptionForInvalidParameter(argName, argValue, methodName, methodArgs) {
-        if (argValue)
-            return;
-        let details = '\nMethod name: icc-crypto-x-api.' + methodName + '()\nArguments:';
-        if (methodArgs) {
-            try {
-                const argsArray = [...methodArgs];
-                _.each(argsArray, (arg, index) => (details += '\n[' + index + ']: ' + JSON.stringify(arg)));
-            }
-            catch (ex) {
-                details += '; a problem occured while logging arguments details: ' + ex;
-            }
-        }
-        throw '### THIS SHOULD NOT HAPPEN: ' + argName + ' has an invalid value: ' + argValue + details;
-    }
-    getEncryptionDecryptionKeys(dataOwnerId, document) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                return !document.id
-                    ? undefined
-                    : _.uniq((yield this.extractKeysFromDelegationsForHcpHierarchy(dataOwnerId, document.id, (document.encryptionKeys && Object.keys(document.encryptionKeys).length && document.encryptionKeys) || document.delegations)).extractedKeys);
-            }
-            catch (e) {
-                return undefined;
-            }
-        });
-    }
-    dataOwnerCanDecryptPatient(dataOwnerId, p) {
-        var _a, _b;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (p.encryptionKeys && ((_a = p.encryptionKeys[dataOwnerId]) === null || _a === void 0 ? void 0 : _a.length))
-                return true;
-            const dataOwner = yield this.getDataOwner(dataOwnerId);
-            if (dataOwner.type === 'hcp' && p.encryptionKeys && ((_b = p.encryptionKeys[dataOwner.dataOwner.parentId]) === null || _b === void 0 ? void 0 : _b.length))
-                return true;
-            return false;
-        });
-    }
-    encryptDecrypt(method, content, edKey, user, documentObject) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!content || !(edKey || ((user === null || user === void 0 ? void 0 : user.healthcarePartyId) && documentObject)))
-                return content;
-            if (edKey) {
-                const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(edKey.replace(/-/g, '')));
-                try {
-                    return yield this._AES[method](importedEdKey, content);
-                }
-                catch (e) {
-                    return content;
-                }
-            }
-            const sfks = yield this.extractKeysFromDelegationsForHcpHierarchy(user === null || user === void 0 ? void 0 : user.healthcarePartyId, documentObject === null || documentObject === void 0 ? void 0 : documentObject.id, documentObject === null || documentObject === void 0 ? void 0 : documentObject.encryptionKeys);
-            const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(sfks.extractedKeys[0].replace(/-/g, '')));
-            try {
-                return yield this._AES[method](importedEdKey, content);
-            }
-            catch (e) {
-                return content;
-            }
-        });
-    }
-    /**
-     * Store keypair in storage
-     *
-     * @param id
-     * @param keyPair should be JWK
-     *
-     * @deprecated use storage.setItem instead
-     */
-    storeKeyPair(id, keyPair) {
-        this._storage.setItem(this.rsaLocalStoreIdPrefix + id, JSON.stringify(keyPair));
-    }
-    fixAesExchangeKeyEntriesToFingerprints(aesExchangeKeys) {
-        return Object.fromEntries(Object.entries(aesExchangeKeys).map(([delegatorPubKey, allDelegates]) => [
-            delegatorPubKey,
-            Object.fromEntries(Object.entries(allDelegates).map(([delegateId, keyEntries]) => [
-                delegateId,
-                Object.fromEntries(Object.entries(keyEntries).map(([publicKey, encryptedValue]) => [
-                    publicKey.slice(-32),
-                    encryptedValue
-                ]))
-            ]))
-        ]));
-    }
-}
-exports.IccCryptoXApi = IccCryptoXApi;
-//# sourceMappingURL=icc-crypto-x-api.js.map