@icure/api 7.1.16 → 8.0.0-RC.2

package/icc-x-api/crypto/ExchangeDataManager.js

@@ -0,0 +1,501 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initialiseExchangeDataManagerForCurrentDataOwner = void 0;
+const utils_1 = require("./utils");
+const utils_2 = require("../utils");
+const lru_temporised_async_cache_1 = require("../utils/lru-temporised-async-cache");
+const EntityWithDelegationTypeName_1 = require("../utils/EntityWithDelegationTypeName");
+const CryptoActorStub_1 = require("../../icc-api/model/CryptoActorStub");
+/**
+ * @internal this function is for internal use only and may be changed without notice.
+ * Initialises and returns the exchange data manager which is most appropriate for the current data owner.
+ */
+function initialiseExchangeDataManagerForCurrentDataOwner(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys, optionalParameters = {}) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const currentOwner = CryptoActorStub_1.CryptoActorStubWithType.fromDataOwner(yield dataOwnerApi.getCurrentDataOwner());
+        if (cryptoStrategies.dataOwnerRequiresAnonymousDelegation(currentOwner)) {
+            const res = new FullyCachedExchangeDataManager(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys);
+            yield res.clearOrRepopulateCache();
+            return res;
+        }
+        else {
+            return new LimitedLruCacheExchangeDataManager(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys, optionalParameters);
+        }
+    });
+}
+exports.initialiseExchangeDataManagerForCurrentDataOwner = initialiseExchangeDataManagerForCurrentDataOwner;
+class AbstractExchangeDataManager {
+    constructor(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys) {
+        this.base = base;
+        this.encryptionKeys = encryptionKeys;
+        this.signatureKeys = signatureKeys;
+        this.accessControlSecret = accessControlSecret;
+        this.cryptoStrategies = cryptoStrategies;
+        this.dataOwnerApi = dataOwnerApi;
+        this.primitives = primitives;
+        this.useParentKeys = useParentKeys;
+    }
+    decryptData(data) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const decryptionKeys = this.encryptionKeys.getDecryptionKeys();
+            const decryptedKey = (yield this.base.tryDecryptExchangeKeys([data], decryptionKeys)).successfulDecryptions[0];
+            if (!decryptedKey)
+                return undefined;
+            const decryptedAccessControlSecret = (yield this.base.tryDecryptAccessControlSecret([data], decryptionKeys)).successfulDecryptions[0];
+            if (!decryptedAccessControlSecret)
+                throw new Error(`Decryption key could be decrypted but access control secret could not for data ${data}`);
+            return {
+                accessControlSecret: decryptedAccessControlSecret,
+                exchangeKey: decryptedKey,
+                verified: yield this.base.verifyExchangeData(data, (fp) => this.signatureKeys.getSignatureVerificationKey(fp)),
+            };
+        });
+    }
+    createNewExchangeData(delegateId, newDataId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const encryptionKeys = {};
+            this.encryptionKeys.getSelfVerifiedKeys().forEach(({ fingerprint, pair }) => {
+                encryptionKeys[fingerprint] = pair.publicKey;
+            });
+            if (delegateId != (yield this.dataOwnerApi.getCurrentDataOwnerId())) {
+                const delegate = yield this.dataOwnerApi.getCryptoActorStub(delegateId);
+                const sha256KeysOfDelegate = (0, utils_1.hexPublicKeysWithSha256Of)(delegate.stub);
+                const sha1KeysOfDelegate = (0, utils_1.hexPublicKeysWithSha1Of)(delegate.stub);
+                let allVerifiedDelegateKeys;
+                if (this.useParentKeys && (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()).includes(delegateId)) {
+                    allVerifiedDelegateKeys = yield this.encryptionKeys.getVerifiedPublicKeysFor(delegate.stub);
+                }
+                else {
+                    allVerifiedDelegateKeys = yield this.cryptoStrategies.verifyDelegatePublicKeys(delegate, [...Array.from(sha256KeysOfDelegate), ...Array.from(sha1KeysOfDelegate)], this.primitives);
+                }
+                if (!allVerifiedDelegateKeys.length)
+                    throw new Error(`Could not create exchange data to ${delegateId} as no public key for the delegate could be verified.`);
+                for (const delegateKey of allVerifiedDelegateKeys) {
+                    if (sha1KeysOfDelegate.has(delegateKey)) {
+                        encryptionKeys[(0, utils_1.fingerprintV1)(delegateKey)] = yield this.primitives.RSA.importKey('spki', (0, utils_2.hex2ua)(delegateKey), ['encrypt'], 'sha-1');
+                    }
+                    else if (sha256KeysOfDelegate.has(delegateKey)) {
+                        encryptionKeys[(0, utils_1.fingerprintV1)(delegateKey)] = yield this.primitives.RSA.importKey('spki', (0, utils_2.hex2ua)(delegateKey), ['encrypt'], 'sha-256');
+                    }
+                    else
+                        throw new Error('Illegal state: verified keys should contain only keys for OAPE-SHA1 or OAPE-SHA256.');
+                }
+            }
+            const signatureKey = yield this.signatureKeys.getOrCreateSignatureKeyPair();
+            const newData = yield this.base.createExchangeData(delegateId, { [signatureKey.fingerprint]: signatureKey.keyPair.privateKey }, encryptionKeys, newDataId ? { id: newDataId } : {});
+            return {
+                exchangeData: newData.exchangeData,
+                accessControlSecret: newData.accessControlSecret,
+                exchangeKey: newData.exchangeKey,
+            };
+        });
+    }
+    giveAccessBackTo(otherDataOwner, newDataOwnerPublicKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const self = yield this.dataOwnerApi.getCurrentDataOwnerId();
+            const newKeyFp = (0, utils_1.fingerprintV1)(newDataOwnerPublicKey);
+            const other = yield this.dataOwnerApi.getCryptoActorStub(otherDataOwner);
+            const newKeyHashVersion = (0, utils_1.getShaVersionForKey)(other.stub, newDataOwnerPublicKey);
+            if (!newKeyHashVersion)
+                throw new Error(`Public key not found for data owner ${otherDataOwner}`);
+            const importedNewKey = yield this.primitives.RSA.importKey('spki', (0, utils_2.hex2ua)(newDataOwnerPublicKey), ['encrypt'], newKeyHashVersion);
+            const signatureKey = yield this.signatureKeys.getOrCreateSignatureKeyPair();
+            const decryptionKeys = this.encryptionKeys.getDecryptionKeys();
+            const allExchangeDataToUpdate = self == otherDataOwner
+                ? yield this.base.getExchangeDataByDelegatorDelegatePair(self, self)
+                : [
+                    ...(yield this.base.getExchangeDataByDelegatorDelegatePair(self, otherDataOwner)),
+                    ...(yield this.base.getExchangeDataByDelegatorDelegatePair(otherDataOwner, self)),
+                ];
+            for (const dataToUpdate of allExchangeDataToUpdate) {
+                if (!Object.keys(dataToUpdate.exchangeKey).find((fp) => fp == newKeyFp)) {
+                    const updated = yield this.base.tryUpdateExchangeData(dataToUpdate, decryptionKeys, { [newKeyFp]: importedNewKey }, { [signatureKey.fingerprint]: signatureKey.keyPair.privateKey }, (verificationFp) => this.signatureKeys.getSignatureVerificationKey(verificationFp));
+                    if (!updated) {
+                        console.warn(`Failed to give access back to exchanged data ${JSON.stringify(dataToUpdate)}`);
+                    }
+                }
+            }
+        });
+    }
+    clearOrRepopulateCache() {
+        throw new Error('Implemented by concrete class');
+    }
+    getOrCreateEncryptionDataTo(delegateId, entityType, entitySecretForeignKeys) {
+        throw new Error('Implemented by concrete class');
+    }
+    getCachedDecryptionDataKeyByAccessControlHash(hashes, entityType, entitySecretForeignKeys) {
+        throw new Error('Implemented by concrete class');
+    }
+    getDecryptionDataKeyById(id, entityType, entitySecretForeignKeys, retrieveIfNotCached) {
+        throw new Error('Implemented by concrete class');
+    }
+    getAccessControlKeysValue(entityType) {
+        throw new Error('Implemented by concrete class');
+    }
+    getAllDelegationKeys(entityType) {
+        throw new Error('Implemented by concrete class');
+    }
+}
+class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
+    constructor() {
+        super(...arguments);
+        this.caches = Promise.resolve({ dataById: {}, hashToId: new Map(), delegateToVerifiedEncryptionDataId: {}, entityTypeToAccessControlKeysValue: {} });
+    }
+    clearOrRepopulateCache() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.caches = this.doRepopulateCache();
+            yield this.caches;
+        });
+    }
+    getCachedDecryptionDataKeyByAccessControlHash(hashes, entityType, entitySecretForeignKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            function retrieveByHashesFromCaches(caches) {
+                return hashes.reduce((res, hash) => {
+                    const id = caches.hashToId.get(hash);
+                    if (id) {
+                        const cached = caches.dataById[id];
+                        if (cached === null || cached === void 0 ? void 0 : cached.decrypted) {
+                            res[hash] = {
+                                exchangeData: cached.exchangeData,
+                                exchangeKey: cached.decrypted.exchangeKey,
+                                accessControlSecret: cached.decrypted.accessControlSecret,
+                            };
+                        }
+                    }
+                    return res;
+                }, {});
+            }
+            const retrievedFromHashesCache = retrieveByHashesFromCaches(yield this.caches);
+            if (Object.keys(retrievedFromHashesCache).length) {
+                return retrievedFromHashesCache;
+            }
+            else {
+                this.caches = this.caches.then((caches) => __awaiter(this, void 0, void 0, function* () {
+                    for (const currData of Object.values(caches.dataById)) {
+                        if (currData.decrypted) {
+                            const currDataHashes = yield this.accessControlSecret.secureDelegationKeysFor(currData.decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
+                            currDataHashes.forEach((hash) => caches.hashToId.set(hash, currData.exchangeData.id));
+                        }
+                    }
+                    return caches;
+                }));
+                return retrieveByHashesFromCaches(yield this.caches);
+            }
+        });
+    }
+    getOrCreateEncryptionDataTo(delegateId, entityType, entitySecretForeignKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const caches = yield this.caches;
+            const dataId = caches.delegateToVerifiedEncryptionDataId[delegateId];
+            const cached = dataId ? caches.dataById[dataId] : undefined;
+            if (cached && (cached === null || cached === void 0 ? void 0 : cached.decrypted)) {
+                return {
+                    exchangeData: cached.exchangeData,
+                    accessControlSecret: cached.decrypted.accessControlSecret,
+                    exchangeKey: cached.decrypted.exchangeKey,
+                };
+            }
+            const created = yield this.createNewExchangeData(delegateId);
+            this.cacheData(created.exchangeData, { accessControlSecret: created.accessControlSecret, exchangeKey: created.exchangeKey, verified: true }, entityType, entitySecretForeignKeys);
+            return created;
+        });
+    }
+    getDecryptionDataKeyById(id, entityType, entitySecretForeignKeys, retrieveIfNotCached) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            const caches = yield this.caches;
+            const cachedData = caches.dataById[id];
+            if (cachedData) {
+                return {
+                    exchangeData: cachedData.exchangeData,
+                    exchangeKey: (_a = cachedData.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey,
+                    accessControlSecret: (_b = cachedData.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret,
+                };
+            }
+            else if (retrieveIfNotCached) {
+                const data = yield this.base.getExchangeDataById(id);
+                if (!data)
+                    throw new Error(`Could not find exchange data with id ${id}`);
+                const decrypted = yield this.decryptData(data);
+                this.cacheData(data, decrypted, entityType, entitySecretForeignKeys);
+                return { exchangeData: data, exchangeKey: decrypted === null || decrypted === void 0 ? void 0 : decrypted.exchangeKey, accessControlSecret: decrypted === null || decrypted === void 0 ? void 0 : decrypted.accessControlSecret };
+            }
+            else
+                return undefined;
+        });
+    }
+    cacheData(exchangeData, decrypted, entityType, entitySecretForeignKeys) {
+        this.caches = this.caches.then((caches) => __awaiter(this, void 0, void 0, function* () {
+            caches.dataById[exchangeData.id] = { exchangeData, decrypted };
+            if (decrypted) {
+                // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact
+                // `secureDelegationKeysFor` is currently ignoring the sfks
+                if (entityType && entitySecretForeignKeys) {
+                    const hashes = yield this.accessControlSecret.secureDelegationKeysFor(decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
+                    hashes.forEach((hash) => {
+                        caches.hashToId.set(hash, exchangeData.id);
+                    });
+                }
+                if (decrypted.verified) {
+                    caches.delegateToVerifiedEncryptionDataId[exchangeData.delegate] = exchangeData.id;
+                }
+            }
+            return caches;
+        }));
+    }
+    doRepopulateCache() {
+        return __awaiter(this, void 0, void 0, function* () {
+            const allData = yield this.base.getAllExchangeDataForCurrentDataOwnerIfAllowed();
+            if (!allData)
+                throw new Error('Impossible to use fully cached exchange data manager for current data owner.');
+            const dataById = {};
+            const hashToId = new Map();
+            const delegateToVerifiedEncryptionDataId = {};
+            for (const currData of allData) {
+                const currDecrypted = yield this.decryptData(currData);
+                dataById[currData.id] = { exchangeData: currData, decrypted: currDecrypted };
+                if (currDecrypted === null || currDecrypted === void 0 ? void 0 : currDecrypted.verified) {
+                    delegateToVerifiedEncryptionDataId[currData.delegate] = currData.id;
+                }
+            }
+            const entityTypeToAccessControlKeysValue = {};
+            return { dataById, hashToId, delegateToVerifiedEncryptionDataId, entityTypeToAccessControlKeysValue };
+        });
+    }
+    getAccessControlKeysValue(entityType) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const caches = yield this.caches;
+            const cached = caches.entityTypeToAccessControlKeysValue[entityType];
+            if (cached)
+                return cached;
+            const accessControlSecrets = Object.values(caches.dataById).flatMap((x) => (x.decrypted ? [x.decrypted.accessControlSecret] : []));
+            const fullData = yield this.accessControlSecret.getEncodedAccessControlKeys(accessControlSecrets, entityType);
+            caches.entityTypeToAccessControlKeysValue[entityType] = fullData;
+            return fullData;
+        });
+    }
+    getAllDelegationKeys(entityType) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const caches = yield this.caches;
+            const accessControlSecrets = Object.values(caches.dataById).flatMap((x) => (x.decrypted ? [x.decrypted.accessControlSecret] : []));
+            const res = [];
+            for (const accessControlSecret of accessControlSecrets) {
+                // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact
+                res.push(yield this.accessControlSecret.secureDelegationKeyFor(accessControlSecret, entityType, undefined));
+            }
+            return res;
+        });
+    }
+}
+class LimitedLruCacheExchangeDataManager extends AbstractExchangeDataManager {
+    constructor(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys, optionalParameters) {
+        var _a;
+        super(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys);
+        this.hashToId = new Map();
+        this.delegateToVerifiedEncryptionDataId = new Map();
+        this.idToDataCache = new lru_temporised_async_cache_1.LruTemporisedAsyncCache((_a = optionalParameters.lruCacheSize) !== null && _a !== void 0 ? _a : 2000, () => -1);
+    }
+    clearOrRepopulateCache() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.idToDataCache.clear(false);
+            this.hashToId.clear();
+            this.delegateToVerifiedEncryptionDataId.clear();
+        });
+    }
+    getCachedDecryptionDataKeyByAccessControlHash(hashes, entityType, entitySecretForeignKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const res = {};
+            for (const hash of hashes) {
+                const dataId = this.hashToId.get(hash);
+                if (dataId) {
+                    const retrieved = yield this.idToDataCache.get(dataId, () => {
+                        throw new Error(`Data with id ${dataId} should have been already cached.`);
+                    });
+                    if (retrieved.decrypted) {
+                        res[hash] = {
+                            exchangeData: retrieved.exchangeData,
+                            exchangeKey: retrieved.decrypted.exchangeKey,
+                            accessControlSecret: retrieved.decrypted.accessControlSecret,
+                        };
+                    }
+                }
+            }
+            return res;
+        });
+    }
+    secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(accessControlSecret, entityType, entitySecretForeignKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const noSfkDelegationKeys = yield Promise.all([...EntityWithDelegationTypeName_1.entityWithDelegationTypeNames].map((t) => this.accessControlSecret.secureDelegationKeyFor(accessControlSecret, t, undefined)));
+            if (entityType && (entitySecretForeignKeys === null || entitySecretForeignKeys === void 0 ? void 0 : entitySecretForeignKeys.length)) {
+                // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact
+                // `secureDelegationKeysFor` is currently ignoring the sfks
+                return [
+                    ...noSfkDelegationKeys,
+                    ...(yield this.accessControlSecret.secureDelegationKeysFor(accessControlSecret, entityType, entitySecretForeignKeys)),
+                ];
+            }
+            else {
+                return noSfkDelegationKeys;
+            }
+        });
+    }
+    getDecryptionDataKeyById(id, entityType, entitySecretForeignKeys, retrieveIfNotCached) {
+        var _a, _b;
+        return __awaiter(this, void 0, void 0, function* () {
+            const cached = yield this.idToDataCache.getIfCachedJob(id);
+            if (cached) {
+                const updated = yield this.idToDataCache.get(id, (prevData) => __awaiter(this, void 0, void 0, function* () {
+                    const toUpdate = prevData !== null && prevData !== void 0 ? prevData : cached.item;
+                    if (toUpdate.decrypted) {
+                        // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users, and it has some performance impact
+                        // `secureDelegationKeysFor` is currently ignoring the sfks
+                        if (entityType && entitySecretForeignKeys) {
+                            const hashes = yield this.accessControlSecret.secureDelegationKeysFor(toUpdate.decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
+                            hashes.forEach((hash) => {
+                                this.hashToId.set(hash, toUpdate.exchangeData.id);
+                            });
+                            toUpdate.hashes.push(...hashes);
+                        }
+                    }
+                    return { item: toUpdate, onEviction: (b) => this.doOnEvictionJob(b, toUpdate) };
+                }), () => true);
+                return {
+                    exchangeData: updated.exchangeData,
+                    exchangeKey: (_a = updated.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey,
+                    accessControlSecret: (_b = updated.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret,
+                };
+            }
+            else if (retrieveIfNotCached) {
+                return yield this.idToDataCache
+                    .get(id, () => __awaiter(this, void 0, void 0, function* () {
+                    return this.cacheJob(() => __awaiter(this, void 0, void 0, function* () {
+                        const data = yield this.base.getExchangeDataById(id);
+                        if (!data)
+                            throw new Error(`Could not find exchange data with id ${id}`);
+                        const decrypted = yield this.decryptData(data);
+                        if (decrypted) {
+                            const hashes = yield this.secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
+                            return { exchangeData: data, hashes, decrypted, verified: decrypted.verified };
+                        }
+                        else {
+                            return { exchangeData: data, hashes: [], verified: false };
+                        }
+                    }));
+                }))
+                    .then((x) => { var _a, _b; return ({ exchangeData: x.exchangeData, exchangeKey: (_a = x.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey, accessControlSecret: (_b = x.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret }); });
+            }
+            else
+                return undefined;
+        });
+    }
+    getOrCreateEncryptionDataTo(delegateId, entityType, entitySecretForeignKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            let existingId = this.delegateToVerifiedEncryptionDataId.get(delegateId);
+            if (!existingId) {
+                yield this.populateCacheToDelegate(delegateId, entityType, entitySecretForeignKeys);
+                existingId = this.delegateToVerifiedEncryptionDataId.get(delegateId);
+            }
+            if (existingId) {
+                const cached = yield this.idToDataCache.getIfCachedJob(existingId);
+                if (!cached)
+                    throw new Error(`Illegal state: data with id ${existingId} should have been in cache`);
+                if (cached.item.decrypted) {
+                    return {
+                        exchangeData: cached.item.exchangeData,
+                        exchangeKey: cached.item.decrypted.exchangeKey,
+                        accessControlSecret: cached.item.decrypted.accessControlSecret,
+                    };
+                }
+                else
+                    throw new Error(`Illegal state: cached verified data should be decrypted.`);
+            }
+            else {
+                const newDataId = this.primitives.randomUuid();
+                this.delegateToVerifiedEncryptionDataId.set(delegateId, newDataId);
+                const createdAndCachedData = yield this.idToDataCache.get(newDataId, () => this.cacheJob(() => __awaiter(this, void 0, void 0, function* () {
+                    const created = yield this.createNewExchangeData(delegateId, newDataId);
+                    const hashes = yield this.secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(created.accessControlSecret, entityType, entitySecretForeignKeys);
+                    return {
+                        exchangeData: created.exchangeData,
+                        decrypted: {
+                            accessControlSecret: created.accessControlSecret,
+                            exchangeKey: created.exchangeKey,
+                            verified: true,
+                        },
+                        hashes,
+                    };
+                })));
+                if (!createdAndCachedData)
+                    throw new Error('Data should have been successfully created');
+                return {
+                    exchangeData: createdAndCachedData.exchangeData,
+                    exchangeKey: createdAndCachedData.decrypted.exchangeKey,
+                    accessControlSecret: createdAndCachedData.decrypted.accessControlSecret,
+                };
+            }
+        });
+    }
+    // Loads and adds to the cache all exchange data from the current data owner to the given delegate. Allows to check if there is already data from
+    // the current data owner to the delegate which is good for encryption.
+    populateCacheToDelegate(delegateId, entityType, entitySecretForeignKeys) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const dataToDelegate = yield this.base.getExchangeDataByDelegatorDelegatePair(yield this.dataOwnerApi.getCurrentDataOwnerId(), delegateId);
+            yield Promise.all(dataToDelegate.map((data) => __awaiter(this, void 0, void 0, function* () {
+                yield this.idToDataCache.get(data.id, () => this.cacheJob(() => __awaiter(this, void 0, void 0, function* () {
+                    const decrypted = yield this.decryptData(data);
+                    if (decrypted) {
+                        const hashes = yield this.secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
+                        return { exchangeData: data, hashes, decrypted };
+                    }
+                    else {
+                        return { exchangeData: data, hashes: [] };
+                    }
+                })));
+            })));
+        });
+    }
+    cacheJob(retrieveDecryptedDataInfo) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const info = yield retrieveDecryptedDataInfo();
+            info.hashes.forEach((hash) => this.hashToId.set(hash, info === null || info === void 0 ? void 0 : info.exchangeData.id));
+            if ((_a = info.decrypted) === null || _a === void 0 ? void 0 : _a.verified)
+                this.delegateToVerifiedEncryptionDataId.set(info.exchangeData.delegate, info.exchangeData.id);
+            const item = {
+                exchangeData: info.exchangeData,
+                hashes: info.hashes,
+                decrypted: info.decrypted,
+            };
+            return {
+                item,
+                onEviction: (b) => this.doOnEvictionJob(b, item),
+            };
+        });
+    }
+    doOnEvictionJob(isReplacement, item) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!isReplacement) {
+                item.hashes.forEach((hash) => this.hashToId.delete(hash));
+                if (this.delegateToVerifiedEncryptionDataId.get(item.exchangeData.delegate) === item.exchangeData.id) {
+                    this.delegateToVerifiedEncryptionDataId.delete(item.exchangeData.delegate);
+                }
+            }
+        });
+    }
+    getAccessControlKeysValue(entityType) {
+        return Promise.resolve(undefined);
+    }
+    getAllDelegationKeys(entityType) {
+        return Promise.resolve(undefined);
+    }
+}
+//# sourceMappingURL=ExchangeDataManager.js.map

package/icc-x-api/crypto/ExchangeDataManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExchangeDataManager.js","sourceRoot":"","sources":["../../../icc-x-api/crypto/ExchangeDataManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAOA,mCAAgH;AAEhH,oCAAyC;AACzC,oFAA6E;AAC7E,wFAAmH;AACnH,yEAA6E;AAO7E;;;GAGG;AACH,SAAsB,gDAAgD,CACpE,IAA6B,EAC7B,cAAyC,EACzC,aAAuC,EACvC,mBAA6C,EAC7C,gBAAkC,EAClC,YAA8B,EAC9B,UAA4B,EAC5B,aAAsB,EACtB,qBAA4D,EAAE;;QAE9D,MAAM,YAAY,GAAG,yCAAuB,CAAC,aAAa,CAAC,MAAM,YAAY,CAAC,mBAAmB,EAAE,CAAC,CAAA;QACpG,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,YAAY,CAAC,EAAE;YACvE,MAAM,GAAG,GAAG,IAAI,8BAA8B,CAC5C,IAAI,EACJ,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,aAAa,CACd,CAAA;YACD,MAAM,GAAG,CAAC,sBAAsB,EAAE,CAAA;YAClC,OAAO,GAAG,CAAA;SACX;aAAM;YACL,OAAO,IAAI,kCAAkC,CAC3C,IAAI,EACJ,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,aAAa,EACb,kBAAkB,CACnB,CAAA;SACF;IACH,CAAC;CAAA;AAtCD,4GAsCC;AAkGD,MAAe,2BAA2B;IACxC,YACW,IAA6B,EACnB,cAAyC,EACzC,aAAuC,EACvC,mBAA6C,EAC7C,gBAAkC,EAClC,YAA8B,EAC9B,UAA4B,EAC9B,aAAsB;QAP9B,SAAI,GAAJ,IAAI,CAAyB;QACnB,mBAAc,GAAd,cAAc,CAA2B;QACzC,kBAAa,GAAb,aAAa,CAA0B;QACvC,wBAAmB,GAAnB,mBAAmB,CAA0B;QAC7C,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,eAAU,GAAV,UAAU,CAAkB;QAC9B,kBAAa,GAAb,aAAa,CAAS;IACtC,CAAC;IAEY,WAAW,CAAC,IAAkB;;YAQ5C,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAA;YAC9D,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;YAC9G,IAAI,CAAC,YAAY;gBAAE,OAAO,SAAS,CAAA;YACnC,MAAM,4BAA4B,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;YACrI,IAAI,CAAC,4BAA4B;gBAAE,MAAM,IAAI,KAAK,CAAC,kFAAkF,IAAI,EAAE,CAAC,CAAA;YAC5I,OAAO;gBACL,mBAAmB,EAAE,4BAA4B;gBACjD,WAAW,EAAE,YAAY;gBACzB,QAAQ,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;aAC/G,CAAA;QACH,CAAC;KAAA;IAEe,qBAAqB,CACnC,UAAkB,EAClB,SAAkB;;YAElB,MAAM,cAAc,GAAgC,EAAE,CAAA;YACtD,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE;gBAC1E,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,SAAS,CAAA;YAC9C,CAAC,CAAC,CAAA;YACF,IAAI,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC,EAAE;gBACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAA;gBACvE,MAAM,oBAAoB,GAAG,IAAA,iCAAyB,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACrE,MAAM,kBAAkB,GAAG,IAAA,+BAAuB,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;gBACjE,IAAI,uBAAiC,CAAA;gBACrC,IAAI,IAAI,CAAC,aAAa,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,+BAA+B,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;oBAC1G,uBAAuB,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;iBAC5F;qBAAM;oBACL,uBAAuB,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,wBAAwB,CAC5E,QAAQ,EACR,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EACxE,IAAI,CAAC,UAAU,CAChB,CAAA;iBACF;gBACD,IAAI,CAAC,uBAAuB,CAAC,MAAM;oBACjC,MAAM,IAAI,KAAK,CAAC,qCAAqC,UAAU,uDAAuD,CAAC,CAAA;gBACzH,KAAK,MAAM,WAAW,IAAI,uBAAuB,EAAE;oBACjD,IAAI,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;wBACvC,cAAc,CAAC,IAAA,qBAAa,EAAC,WAAW,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,WAAW,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAA;qBACpI;yBAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE;wBAChD,cAAc,CAAC,IAAA,qBAAa,EAAC,WAAW,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,WAAW,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAA;qBACtI;;wBAAM,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAA;iBAC9G;aACF;YACD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,2BAA2B,EAAE,CAAA;YAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAChD,UAAU,EACV,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAC/D,cAAc,EACd,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CACnC,CAAA;YACD,OAAO;gBACL,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAA;QACH,CAAC;KAAA;IAEK,gBAAgB,CAAC,cAAsB,EAAE,qBAA6B;;YAC1E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAA;YAC5D,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,qBAAqB,CAAC,CAAA;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAA;YACxE,MAAM,iBAAiB,GAAG,IAAA,2BAAmB,EAAC,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;YAChF,IAAI,CAAC,iBAAiB;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,cAAc,EAAE,CAAC,CAAA;YAChG,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,cAAM,EAAC,qBAAqB,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACjI,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,2BAA2B,EAAE,CAAA;YAC3E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAA;YAC9D,MAAM,uBAAuB,GAC3B,IAAI,IAAI,cAAc;gBACpB,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,IAAI,EAAE,IAAI,CAAC;gBACpE,CAAC,CAAC;oBACE,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;oBACjF,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;iBAClF,CAAA;YACP,KAAK,MAAM,YAAY,IAAI,uBAAuB,EAAE;gBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE;oBACvE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,CACnD,YAAY,EACZ,cAAc,EACd,EAAE,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,EAC9B,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,EAC/D,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,2BAA2B,CAAC,cAAc,CAAC,CACnF,CAAA;oBACD,IAAI,CAAC,OAAO,EAAE;wBACZ,OAAO,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;qBAC7F;iBACF;aACF;QACH,CAAC;KAAA;IAED,sBAAsB;QACpB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IAED,2BAA2B,CACzB,UAAkB,EAClB,UAAoD,EACpD,uBAA6C;QAE7C,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IAED,6CAA6C,CAC3C,MAAgB,EAChB,UAAwC,EACxC,uBAAiC;QAEjC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IAED,wBAAwB,CACtB,EAAU,EACV,UAAoD,EACpD,uBAA6C,EAC7C,mBAA4B;QAE5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IAED,yBAAyB,CAAC,UAAwC;QAChE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;IAED,oBAAoB,CAAC,UAAwC;QAC3D,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAClD,CAAC;CACF;AAED,MAAM,8BAA+B,SAAQ,2BAA2B;IAAxE;;QACU,WAAM,GAKT,OAAO,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,kCAAkC,EAAE,EAAE,EAAE,kCAAkC,EAAE,EAAE,EAAE,CAAC,CAAA;IAyK7I,CAAC;IAvKO,sBAAsB;;YAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAA;YACtC,MAAM,IAAI,CAAC,MAAM,CAAA;QACnB,CAAC;KAAA;IAEK,6CAA6C,CACjD,MAAgB,EAChB,UAAwC,EACxC,uBAAiC;;YAEjC,SAAS,0BAA0B,CAAC,MAInC;gBACC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;oBACjC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBACpC,IAAI,EAAE,EAAE;wBACN,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;wBAClC,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,EAAE;4BACrB,GAAG,CAAC,IAAI,CAAC,GAAG;gCACV,YAAY,EAAE,MAAM,CAAC,YAAY;gCACjC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;gCACzC,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,mBAAmB;6BAC1D,CAAA;yBACF;qBACF;oBACD,OAAO,GAAG,CAAA;gBACZ,CAAC,EAAE,EAA6G,CAAC,CAAA;YACnH,CAAC;YAED,MAAM,wBAAwB,GAAG,0BAA0B,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;YAC9E,IAAI,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,MAAM,EAAE;gBAChD,OAAO,wBAAwB,CAAA;aAChC;iBAAM;gBACL,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAO,MAAM,EAAE,EAAE;oBAC9C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;wBACrD,IAAI,QAAQ,CAAC,SAAS,EAAE;4BACtB,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAC3E,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EACtC,UAAU,EACV,uBAAuB,CACxB,CAAA;4BACD,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAG,CAAC,CAAC,CAAA;yBACvF;qBACF;oBACD,OAAO,MAAM,CAAA;gBACf,CAAC,CAAA,CAAC,CAAA;gBACF,OAAO,0BAA0B,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAA;aACrD;QACH,CAAC;KAAA;IAEK,2BAA2B,CAC/B,UAAkB,EAClB,UAAoD,EACpD,uBAA6C;;YAE7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,CAAC,kCAAkC,CAAC,UAAU,CAAC,CAAA;YACpE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YAC3D,IAAI,MAAM,KAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAA,EAAE;gBAC/B,OAAO;oBACL,YAAY,EAAE,MAAM,CAAC,YAAY;oBACjC,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,mBAAmB;oBACzD,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;iBAC1C,CAAA;aACF;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;YAC5D,IAAI,CAAC,SAAS,CACZ,OAAO,CAAC,YAAY,EACpB,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,EACtG,UAAU,EACV,uBAAuB,CACxB,CAAA;YACD,OAAO,OAAO,CAAA;QAChB,CAAC;KAAA;IAEK,wBAAwB,CAC5B,EAAU,EACV,UAAoD,EACpD,uBAA6C,EAC7C,mBAA4B;;;YAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAA;YAChC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;YACtC,IAAI,UAAU,EAAE;gBACd,OAAO;oBACL,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,WAAW,EAAE,MAAA,UAAU,CAAC,SAAS,0CAAE,WAAW;oBAC9C,mBAAmB,EAAE,MAAA,UAAU,CAAC,SAAS,0CAAE,mBAAmB;iBAC/D,CAAA;aACF;iBAAM,IAAI,mBAAmB,EAAE;gBAC9B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAA;gBACpD,IAAI,CAAC,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAA;gBACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAA;gBACpE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,aAAT,SAAS,uBAAT,SAAS,CAAE,mBAAmB,EAAE,CAAA;aACxH;;gBAAM,OAAO,SAAS,CAAA;;KACxB;IAEO,SAAS,CACf,YAA0B,EAC1B,SAAiG,EACjG,UAAyC,EACzC,uBAAkC;QAElC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAO,MAAM,EAAE,EAAE;YAC9C,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAG,CAAC,GAAG,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;YAC/D,IAAI,SAAS,EAAE;gBACb,sIAAsI;gBACtI,2DAA2D;gBAC3D,IAAI,UAAU,IAAI,uBAAuB,EAAE;oBACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,SAAS,CAAC,mBAAmB,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAA;oBACzI,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;wBACtB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,EAAG,CAAC,CAAA;oBAC7C,CAAC,CAAC,CAAA;iBACH;gBACD,IAAI,SAAS,CAAC,QAAQ,EAAE;oBACtB,MAAM,CAAC,kCAAkC,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,EAAG,CAAA;iBACpF;aACF;YACD,OAAO,MAAM,CAAA;QACf,CAAC,CAAA,CAAC,CAAA;IACJ,CAAC;IAEa,iBAAiB;;YAM7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,8CAA8C,EAAE,CAAA;YAChF,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;YAC7G,MAAM,QAAQ,GAAyC,EAAE,CAAA;YACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;YAC1C,MAAM,kCAAkC,GAAmC,EAAE,CAAA;YAC7E,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE;gBAC9B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;gBACtD,QAAQ,CAAC,QAAQ,CAAC,EAAG,CAAC,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,CAAA;gBAC7E,IAAI,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,EAAE;oBAC3B,kCAAkC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,EAAG,CAAA;iBACrE;aACF;YACD,MAAM,kCAAkC,GAA8D,EAAE,CAAA;YACxG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,CAAA;QACvG,CAAC;KAAA;IAEK,yBAAyB,CAAC,UAAwC;;YACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAA;YAChC,MAAM,MAAM,GAAG,MAAM,CAAC,kCAAkC,CAAC,UAAU,CAAC,CAAA;YACpE,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAA;YACzB,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YAClI,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,2BAA2B,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAA;YAC7G,MAAM,CAAC,kCAAkC,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAA;YAChE,OAAO,QAAQ,CAAA;QACjB,CAAC;KAAA;IAEK,oBAAoB,CAAC,UAAwC;;YACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAA;YAChC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YAClI,MAAM,GAAG,GAAa,EAAE,CAAA;YACxB,KAAK,MAAM,mBAAmB,IAAI,oBAAoB,EAAE;gBACtD,sIAAsI;gBACtI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,mBAAmB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;aAC5G;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;CACF;AAED,MAAM,kCAAmC,SAAQ,2BAA2B;IAK1E,YACE,IAA6B,EAC7B,cAAyC,EACzC,aAAuC,EACvC,mBAA6C,EAC7C,gBAAkC,EAClC,YAA8B,EAC9B,UAA4B,EAC5B,aAAsB,EACtB,kBAEC;;QAED,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,CAAA;QAhB3G,aAAQ,GAAwB,IAAI,GAAG,EAAE,CAAA;QACzC,uCAAkC,GAAwB,IAAI,GAAG,EAAE,CAAA;QAgBlF,IAAI,CAAC,aAAa,GAAG,IAAI,oDAAuB,CAAC,MAAA,kBAAkB,CAAC,YAAY,mCAAI,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACrG,CAAC;IAEK,sBAAsB;;YAC1B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;YACrB,IAAI,CAAC,kCAAkC,CAAC,KAAK,EAAE,CAAA;QACjD,CAAC;KAAA;IAEK,6CAA6C,CACjD,MAAgB,EAChB,UAAwC,EACxC,uBAAiC;;YAEjC,MAAM,GAAG,GAAyG,EAAE,CAAA;YACpH,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE;gBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACtC,IAAI,MAAM,EAAE;oBACV,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE;wBAC1D,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,mCAAmC,CAAC,CAAA;oBAC5E,CAAC,CAAC,CAAA;oBACF,IAAI,SAAS,CAAC,SAAS,EAAE;wBACvB,GAAG,CAAC,IAAI,CAAC,GAAG;4BACV,YAAY,EAAE,SAAS,CAAC,YAAY;4BACpC,WAAW,EAAE,SAAS,CAAC,SAAS,CAAC,WAAW;4BAC5C,mBAAmB,EAAE,SAAS,CAAC,SAAS,CAAC,mBAAmB;yBAC7D,CAAA;qBACF;iBACF;aACF;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEa,iEAAiE,CAC7E,mBAA2B,EAC3B,UAAoD,EACpD,uBAA6C;;YAE7C,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC3C,CAAC,GAAG,4DAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,CAAC,mBAAmB,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAClI,CAAA;YACD,IAAI,UAAU,KAAI,uBAAuB,aAAvB,uBAAuB,uBAAvB,uBAAuB,CAAE,MAAM,CAAA,EAAE;gBACjD,sIAAsI;gBACtI,2DAA2D;gBAC3D,OAAO;oBACL,GAAG,mBAAmB;oBACtB,GAAG,CAAC,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CAAC,mBAAmB,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;iBACtH,CAAA;aACF;iBAAM;gBACL,OAAO,mBAAmB,CAAA;aAC3B;QACH,CAAC;KAAA;IAEK,wBAAwB,CAC5B,EAAU,EACV,UAAoD,EACpD,uBAA6C,EAC7C,mBAA4B;;;YAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;YAC1D,IAAI,MAAM,EAAE;gBACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAC1C,EAAE,EACF,CAAO,QAAQ,EAAE,EAAE;oBACjB,MAAM,QAAQ,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,MAAM,CAAC,IAAI,CAAA;oBACxC,IAAI,QAAQ,CAAC,SAAS,EAAE;wBACtB,uIAAuI;wBACvI,2DAA2D;wBAC3D,IAAI,UAAU,IAAI,uBAAuB,EAAE;4BACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,uBAAuB,CACnE,QAAQ,CAAC,SAAS,CAAC,mBAAmB,EACtC,UAAU,EACV,uBAAuB,CACxB,CAAA;4BACD,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;gCACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAG,CAAC,CAAA;4BACpD,CAAC,CAAC,CAAA;4BACF,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;yBAChC;qBACF;oBACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAA;gBACjF,CAAC,CAAA,EACD,GAAG,EAAE,CAAC,IAAI,CACX,CAAA;gBACD,OAAO;oBACL,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,WAAW,EAAE,MAAA,OAAO,CAAC,SAAS,0CAAE,WAAW;oBAC3C,mBAAmB,EAAE,MAAA,OAAO,CAAC,SAAS,0CAAE,mBAAmB;iBAC5D,CAAA;aACF;iBAAM,IAAI,mBAAmB,EAAE;gBAC9B,OAAO,MAAM,IAAI,CAAC,aAAa;qBAC5B,GAAG,CAAC,EAAE,EAAE,GAAS,EAAE;oBAClB,OAAA,IAAI,CAAC,QAAQ,CAAC,GAAS,EAAE;wBACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAA;wBACpD,IAAI,CAAC,IAAI;4BAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAA;wBACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;wBAC9C,IAAI,SAAS,EAAE;4BACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iEAAiE,CACzF,SAAS,CAAC,mBAAmB,EAC7B,UAAU,EACV,uBAAuB,CACxB,CAAA;4BACD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAA;yBAC/E;6BAAM;4BACL,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;yBAC3D;oBACH,CAAC,CAAA,CAAC,CAAA;kBAAA,CACH;qBACA,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,eAAC,OAAA,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,MAAA,CAAC,CAAC,SAAS,0CAAE,WAAW,EAAE,mBAAmB,EAAE,MAAA,CAAC,CAAC,SAAS,0CAAE,mBAAmB,EAAE,CAAC,CAAA,EAAA,CAAC,CAAA;aACjJ;;gBAAM,OAAO,SAAS,CAAA;;KACxB;IAEK,2BAA2B,CAC/B,UAAkB,EAClB,UAAoD,EACpD,uBAA6C;;YAE7C,IAAI,UAAU,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACxE,IAAI,CAAC,UAAU,EAAE;gBACf,MAAM,IAAI,CAAC,uBAAuB,CAAC,UAAU,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAA;gBACnF,UAAU,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;aACrE;YACD,IAAI,UAAU,EAAE;gBACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,UAAU,CAAC,CAAA;gBAClE,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,UAAU,4BAA4B,CAAC,CAAA;gBACnG,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE;oBACzB,OAAO;wBACL,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY;wBACtC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW;wBAC9C,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB;qBAC/D,CAAA;iBACF;;oBAAM,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;aACnF;iBAAM;gBACL,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAA;gBAC9C,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;gBAClE,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CACxE,IAAI,CAAC,QAAQ,CAAC,GAAS,EAAE;oBACvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;oBACvE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iEAAiE,CACzF,OAAO,CAAC,mBAAmB,EAC3B,UAAU,EACV,uBAAuB,CACxB,CAAA;oBACD,OAAO;wBACL,YAAY,EAAE,OAAO,CAAC,YAAY;wBAClC,SAAS,EAAE;4BACT,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;4BAChD,WAAW,EAAE,OAAO,CAAC,WAAW;4BAChC,QAAQ,EAAE,IAAI;yBACf;wBACD,MAAM;qBACP,CAAA;gBACH,CAAC,CAAA,CAAC,CACH,CAAA;gBACD,IAAI,CAAC,oBAAoB;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAA;gBACxF,OAAO;oBACL,YAAY,EAAE,oBAAoB,CAAC,YAAY;oBAC/C,WAAW,EAAE,oBAAoB,CAAC,SAAU,CAAC,WAAW;oBACxD,mBAAmB,EAAE,oBAAoB,CAAC,SAAU,CAAC,mBAAmB;iBACzE,CAAA;aACF;QACH,CAAC;KAAA;IAED,iJAAiJ;IACjJ,uEAAuE;IACzD,uBAAuB,CACnC,UAAkB,EAClB,UAAoD,EACpD,uBAA6C;;YAE7C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,sCAAsC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,EAAE,UAAU,CAAC,CAAA;YAC1I,MAAM,OAAO,CAAC,GAAG,CACf,cAAc,CAAC,GAAG,CAAC,CAAO,IAAI,EAAE,EAAE;gBAChC,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAG,EAAE,GAAG,EAAE,CAC1C,IAAI,CAAC,QAAQ,CAAC,GAAS,EAAE;oBACvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;oBAC9C,IAAI,SAAS,EAAE;wBACb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iEAAiE,CACzF,SAAS,CAAC,mBAAmB,EAC7B,UAAU,EACV,uBAAuB,CACxB,CAAA;wBACD,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;qBACjD;yBAAM;wBACL,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAA;qBAC1C;gBACH,CAAC,CAAA,CAAC,CACH,CAAA;YACH,CAAC,CAAA,CAAC,CACH,CAAA;QACH,CAAC;KAAA;IAEa,QAAQ,CACpB,yBAAmF;;;YAEnF,MAAM,IAAI,GAAG,MAAM,yBAAyB,EAAE,CAAA;YAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,CAAC,EAAG,CAAC,CAAC,CAAA;YAC9E,IAAI,MAAA,IAAI,CAAC,SAAS,0CAAE,QAAQ;gBAAE,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,EAAG,CAAC,CAAA;YAC5H,MAAM,IAAI,GAAG;gBACX,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAA;YACD,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC;aACjD,CAAA;;KACF;IAEa,eAAe,CAAC,aAAsB,EAAE,IAA+C;;YACnG,IAAI,CAAC,aAAa,EAAE;gBAClB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;gBACzD,IAAI,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE;oBACpG,IAAI,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;iBAC3E;aACF;QACH,CAAC;KAAA;IAED,yBAAyB,CAAC,UAAwC;QAChE,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;IAED,oBAAoB,CAAC,UAAwC;QAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;CACF","sourcesContent":["import { ExchangeData } from '../../icc-api/model/internal/ExchangeData'\nimport { IccDataOwnerXApi } from '../icc-data-owner-x-api'\nimport { BaseExchangeDataManager } from './BaseExchangeDataManager'\nimport { UserEncryptionKeysManager } from './UserEncryptionKeysManager'\nimport { UserSignatureKeysManager } from './UserSignatureKeysManager'\nimport { AccessControlSecretUtils } from './AccessControlSecretUtils'\nimport { CryptoStrategies } from './CryptoStrategies'\nimport { fingerprintV1, getShaVersionForKey, hexPublicKeysWithSha1Of, hexPublicKeysWithSha256Of } from './utils'\nimport { CryptoPrimitives } from './CryptoPrimitives'\nimport { hex2ua, ua2b64 } from '../utils'\nimport { LruTemporisedAsyncCache } from '../utils/lru-temporised-async-cache'\nimport { EntityWithDelegationTypeName, entityWithDelegationTypeNames } from '../utils/EntityWithDelegationTypeName'\nimport { CryptoActorStubWithType } from '../../icc-api/model/CryptoActorStub'\n\nexport type ExchangeDataManagerOptionalParameters = {\n  // Only for not fully cached implementation (data owner can't request all his exchange data), amount of exchange data which can be cached\n  lruCacheSize?: number // default = 2000\n}\n\n/**\n * @internal this function is for internal use only and may be changed without notice.\n * Initialises and returns the exchange data manager which is most appropriate for the current data owner.\n */\nexport async function initialiseExchangeDataManagerForCurrentDataOwner(\n  base: BaseExchangeDataManager,\n  encryptionKeys: UserEncryptionKeysManager,\n  signatureKeys: UserSignatureKeysManager,\n  accessControlSecret: AccessControlSecretUtils,\n  cryptoStrategies: CryptoStrategies,\n  dataOwnerApi: IccDataOwnerXApi,\n  primitives: CryptoPrimitives,\n  useParentKeys: boolean,\n  optionalParameters: ExchangeDataManagerOptionalParameters = {}\n): Promise<ExchangeDataManager> {\n  const currentOwner = CryptoActorStubWithType.fromDataOwner(await dataOwnerApi.getCurrentDataOwner())\n  if (cryptoStrategies.dataOwnerRequiresAnonymousDelegation(currentOwner)) {\n    const res = new FullyCachedExchangeDataManager(\n      base,\n      encryptionKeys,\n      signatureKeys,\n      accessControlSecret,\n      cryptoStrategies,\n      dataOwnerApi,\n      primitives,\n      useParentKeys\n    )\n    await res.clearOrRepopulateCache()\n    return res\n  } else {\n    return new LimitedLruCacheExchangeDataManager(\n      base,\n      encryptionKeys,\n      signatureKeys,\n      accessControlSecret,\n      cryptoStrategies,\n      dataOwnerApi,\n      primitives,\n      useParentKeys,\n      optionalParameters\n    )\n  }\n}\n\ntype CachedExchangeData = {\n  exchangeData: ExchangeData\n  decrypted?: {\n    accessControlSecret: string\n    exchangeKey: CryptoKey\n    verified: boolean\n  }\n}\n\n/**\n * @internal this class is intended for internal use only and may be changed without notice.\n * Exchange data manager which automatically handles decryption and cache\n */\nexport interface ExchangeDataManager {\n  readonly base: BaseExchangeDataManager\n\n  /**\n   * Updates all exchange data between the current data owner and another data owner to allow the other data owner to access existing exchange data\n   * using a new public key. Note that this will make existing exchange keys from the other data owner to the current data owner unverified, therefore\n   * invalid for encryption.\n   * @param otherDataOwner the other data owner.\n   * @param newDataOwnerPublicKey a new public key of the other data owner.\n   */\n  giveAccessBackTo(otherDataOwner: string, newDataOwnerPublicKey: string): Promise<void>\n\n  /**\n   * Gets any existing and verified exchange data from the current data owner to the provided delegate or creates new data if no verified data is\n   * available, then caches it. The {@link entityType} and {@link entitySecretForeignKeys} will be used for the secure-delegation-hash-based cache\n   * of the exchange data and not for actually creating the exchange data.\n   * @param delegateId the id of the delegate.\n   * @param entityType type of the entity for which you want to create new metadata.\n   * @param entitySecretForeignKeys the secret foreign keys of the entity which you want to create new metadata.\n   * @return the access control secret and key of the data to use for encryption.\n   */\n  getOrCreateEncryptionDataTo(\n    delegateId: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined\n  ): Promise<{ exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey }>\n\n  /**\n   * Retrieve the cached decrypted exchange data key associated with any of the provided hashes/entry keys of secure delegations. Depending on the\n   * implementation the {@link entityType} and {@link entitySecretForeignKeys} may be used to improve the secure-delegation-hash-based cache of\n   * exchange data from the other available exchange data caches.\n   * @param hashes hashes of access control secrets for a specific entity, as they appear in the key of secure delegation entries\n   * @param entityType type of the entity containing the metadata for which you are retrieving the encryption key.\n   * @param entitySecretForeignKeys the secret foreign keys of the entity containing the metadata for which you are retrieving the encryption key.\n   * @return the exchange data and decrypted key associated to that hash if cached\n   */\n  getCachedDecryptionDataKeyByAccessControlHash(\n    hashes: string[],\n    entityType: EntityWithDelegationTypeName,\n    entitySecretForeignKeys: string[]\n  ): Promise<{ [hash: string]: { exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey } }>\n\n  /**\n   * Retrieves the exchange data with the provided id (from the cache if available or from the server otherwise if allowed by\n   * {@link retrieveIfNotCached}) and attempts to decrypt it, then caches the result. The {@link entityType} and {@link entitySecretForeignKeys} will\n   * be used for the secure-delegation-hash-based cache of the exchange data.\n   * @param id id of the exchange data\n   * @param entityType type of the entity containing the metadata for which you are retrieving the encryption key.\n   * @param entitySecretForeignKeys the secret foreign keys of the entity containing the metadata for which you are retrieving the encryption key.\n   * @param retrieveIfNotCached if false and there is no cached exchange data with the provided id the method returns undefined, else the method will\n   * attempt to load the exchange data from the server.\n   * @return undefined if the exchange data is not cached and {@link retrieveIfNotCached} is false. Else an object containing:\n   * - exchangeData: the exchange data with the provided id\n   * - exchangeKey: the exchange key corresponding to the provided exchange data if it could be decrypted, else undefined\n   * @throws if no exchange data with the given id is cached and {@link retrieveIfNotCached} is true and the data could not be found in the server\n   * either.\n   */\n  getDecryptionDataKeyById(\n    id: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined,\n    retrieveIfNotCached: boolean\n  ): Promise<{ exchangeKey: CryptoKey | undefined; accessControlSecret: string | undefined; exchangeData: ExchangeData } | undefined>\n\n  /**\n   * Clears the cache or fully repopulates the cache if the current data owner can retrieve all of his exchange data according to the crypto\n   * strategies.\n   */\n  clearOrRepopulateCache(): Promise<void>\n\n  /**\n   * If the current data owner requires anonymous delegations this returns the base64 representation of the concatenation of all available access\n   * control keys for the current data owner.\n   */\n  getAccessControlKeysValue(entityType: EntityWithDelegationTypeName): Promise<string | undefined>\n\n  /**\n   * If the current data owner requires anonymous delegations this returns the access control keys which may be used in secure delegations for the\n   * data owner, which can be used to search for data.\n   */\n  getAllDelegationKeys(entityType: EntityWithDelegationTypeName): Promise<string[] | undefined>\n}\n\nabstract class AbstractExchangeDataManager implements ExchangeDataManager {\n  constructor(\n    readonly base: BaseExchangeDataManager,\n    protected readonly encryptionKeys: UserEncryptionKeysManager,\n    protected readonly signatureKeys: UserSignatureKeysManager,\n    protected readonly accessControlSecret: AccessControlSecretUtils,\n    protected readonly cryptoStrategies: CryptoStrategies,\n    protected readonly dataOwnerApi: IccDataOwnerXApi,\n    protected readonly primitives: CryptoPrimitives,\n    private readonly useParentKeys: boolean\n  ) {}\n\n  protected async decryptData(data: ExchangeData): Promise<\n    | {\n        accessControlSecret: string\n        exchangeKey: CryptoKey\n        verified: boolean\n      }\n    | undefined\n  > {\n    const decryptionKeys = this.encryptionKeys.getDecryptionKeys()\n    const decryptedKey = (await this.base.tryDecryptExchangeKeys([data], decryptionKeys)).successfulDecryptions[0]\n    if (!decryptedKey) return undefined\n    const decryptedAccessControlSecret = (await this.base.tryDecryptAccessControlSecret([data], decryptionKeys)).successfulDecryptions[0]\n    if (!decryptedAccessControlSecret) throw new Error(`Decryption key could be decrypted but access control secret could not for data ${data}`)\n    return {\n      accessControlSecret: decryptedAccessControlSecret,\n      exchangeKey: decryptedKey,\n      verified: await this.base.verifyExchangeData(data, (fp) => this.signatureKeys.getSignatureVerificationKey(fp)),\n    }\n  }\n\n  protected async createNewExchangeData(\n    delegateId: string,\n    newDataId?: string\n  ): Promise<{ exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey }> {\n    const encryptionKeys: { [fp: string]: CryptoKey } = {}\n    this.encryptionKeys.getSelfVerifiedKeys().forEach(({ fingerprint, pair }) => {\n      encryptionKeys[fingerprint] = pair.publicKey\n    })\n    if (delegateId != (await this.dataOwnerApi.getCurrentDataOwnerId())) {\n      const delegate = await this.dataOwnerApi.getCryptoActorStub(delegateId)\n      const sha256KeysOfDelegate = hexPublicKeysWithSha256Of(delegate.stub)\n      const sha1KeysOfDelegate = hexPublicKeysWithSha1Of(delegate.stub)\n      let allVerifiedDelegateKeys: string[]\n      if (this.useParentKeys && (await this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()).includes(delegateId)) {\n        allVerifiedDelegateKeys = await this.encryptionKeys.getVerifiedPublicKeysFor(delegate.stub)\n      } else {\n        allVerifiedDelegateKeys = await this.cryptoStrategies.verifyDelegatePublicKeys(\n          delegate,\n          [...Array.from(sha256KeysOfDelegate), ...Array.from(sha1KeysOfDelegate)],\n          this.primitives\n        )\n      }\n      if (!allVerifiedDelegateKeys.length)\n        throw new Error(`Could not create exchange data to ${delegateId} as no public key for the delegate could be verified.`)\n      for (const delegateKey of allVerifiedDelegateKeys) {\n        if (sha1KeysOfDelegate.has(delegateKey)) {\n          encryptionKeys[fingerprintV1(delegateKey)] = await this.primitives.RSA.importKey('spki', hex2ua(delegateKey), ['encrypt'], 'sha-1')\n        } else if (sha256KeysOfDelegate.has(delegateKey)) {\n          encryptionKeys[fingerprintV1(delegateKey)] = await this.primitives.RSA.importKey('spki', hex2ua(delegateKey), ['encrypt'], 'sha-256')\n        } else throw new Error('Illegal state: verified keys should contain only keys for OAPE-SHA1 or OAPE-SHA256.')\n      }\n    }\n    const signatureKey = await this.signatureKeys.getOrCreateSignatureKeyPair()\n    const newData = await this.base.createExchangeData(\n      delegateId,\n      { [signatureKey.fingerprint]: signatureKey.keyPair.privateKey },\n      encryptionKeys,\n      newDataId ? { id: newDataId } : {}\n    )\n    return {\n      exchangeData: newData.exchangeData,\n      accessControlSecret: newData.accessControlSecret,\n      exchangeKey: newData.exchangeKey,\n    }\n  }\n\n  async giveAccessBackTo(otherDataOwner: string, newDataOwnerPublicKey: string) {\n    const self = await this.dataOwnerApi.getCurrentDataOwnerId()\n    const newKeyFp = fingerprintV1(newDataOwnerPublicKey)\n    const other = await this.dataOwnerApi.getCryptoActorStub(otherDataOwner)\n    const newKeyHashVersion = getShaVersionForKey(other.stub, newDataOwnerPublicKey)\n    if (!newKeyHashVersion) throw new Error(`Public key not found for data owner ${otherDataOwner}`)\n    const importedNewKey = await this.primitives.RSA.importKey('spki', hex2ua(newDataOwnerPublicKey), ['encrypt'], newKeyHashVersion)\n    const signatureKey = await this.signatureKeys.getOrCreateSignatureKeyPair()\n    const decryptionKeys = this.encryptionKeys.getDecryptionKeys()\n    const allExchangeDataToUpdate =\n      self == otherDataOwner\n        ? await this.base.getExchangeDataByDelegatorDelegatePair(self, self)\n        : [\n            ...(await this.base.getExchangeDataByDelegatorDelegatePair(self, otherDataOwner)),\n            ...(await this.base.getExchangeDataByDelegatorDelegatePair(otherDataOwner, self)),\n          ]\n    for (const dataToUpdate of allExchangeDataToUpdate) {\n      if (!Object.keys(dataToUpdate.exchangeKey).find((fp) => fp == newKeyFp)) {\n        const updated = await this.base.tryUpdateExchangeData(\n          dataToUpdate,\n          decryptionKeys,\n          { [newKeyFp]: importedNewKey },\n          { [signatureKey.fingerprint]: signatureKey.keyPair.privateKey },\n          (verificationFp) => this.signatureKeys.getSignatureVerificationKey(verificationFp)\n        )\n        if (!updated) {\n          console.warn(`Failed to give access back to exchanged data ${JSON.stringify(dataToUpdate)}`)\n        }\n      }\n    }\n  }\n\n  clearOrRepopulateCache(): Promise<void> {\n    throw new Error('Implemented by concrete class')\n  }\n\n  getOrCreateEncryptionDataTo(\n    delegateId: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined\n  ): Promise<{ exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey }> {\n    throw new Error('Implemented by concrete class')\n  }\n\n  getCachedDecryptionDataKeyByAccessControlHash(\n    hashes: string[],\n    entityType: EntityWithDelegationTypeName,\n    entitySecretForeignKeys: string[]\n  ): Promise<{ [p: string]: { exchangeData: ExchangeData; exchangeKey: CryptoKey; accessControlSecret: string } }> {\n    throw new Error('Implemented by concrete class')\n  }\n\n  getDecryptionDataKeyById(\n    id: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined,\n    retrieveIfNotCached: boolean\n  ): Promise<{ exchangeData: ExchangeData; exchangeKey: CryptoKey | undefined; accessControlSecret: string | undefined } | undefined> {\n    throw new Error('Implemented by concrete class')\n  }\n\n  getAccessControlKeysValue(entityType: EntityWithDelegationTypeName): Promise<string | undefined> {\n    throw new Error('Implemented by concrete class')\n  }\n\n  getAllDelegationKeys(entityType: EntityWithDelegationTypeName): Promise<string[] | undefined> {\n    throw new Error('Implemented by concrete class')\n  }\n}\n\nclass FullyCachedExchangeDataManager extends AbstractExchangeDataManager {\n  private caches: Promise<{\n    dataById: { [id: string]: CachedExchangeData }\n    hashToId: Map<string, string>\n    delegateToVerifiedEncryptionDataId: { [delegate: string]: string }\n    entityTypeToAccessControlKeysValue: { [entityType in EntityWithDelegationTypeName]?: string }\n  }> = Promise.resolve({ dataById: {}, hashToId: new Map(), delegateToVerifiedEncryptionDataId: {}, entityTypeToAccessControlKeysValue: {} })\n\n  async clearOrRepopulateCache(): Promise<void> {\n    this.caches = this.doRepopulateCache()\n    await this.caches\n  }\n\n  async getCachedDecryptionDataKeyByAccessControlHash(\n    hashes: string[],\n    entityType: EntityWithDelegationTypeName,\n    entitySecretForeignKeys: string[]\n  ): Promise<{ [hash: string]: { exchangeData: ExchangeData; exchangeKey: CryptoKey; accessControlSecret: string } }> {\n    function retrieveByHashesFromCaches(caches: {\n      dataById: { [id: string]: CachedExchangeData }\n      hashToId: Map<string, string>\n      delegateToVerifiedEncryptionDataId: { [delegate: string]: string }\n    }): { [hash: string]: { exchangeData: ExchangeData; exchangeKey: CryptoKey; accessControlSecret: string } } {\n      return hashes.reduce((res, hash) => {\n        const id = caches.hashToId.get(hash)\n        if (id) {\n          const cached = caches.dataById[id]\n          if (cached?.decrypted) {\n            res[hash] = {\n              exchangeData: cached.exchangeData,\n              exchangeKey: cached.decrypted.exchangeKey,\n              accessControlSecret: cached.decrypted.accessControlSecret,\n            }\n          }\n        }\n        return res\n      }, {} as { [hash: string]: { exchangeData: ExchangeData; exchangeKey: CryptoKey; accessControlSecret: string } })\n    }\n\n    const retrievedFromHashesCache = retrieveByHashesFromCaches(await this.caches)\n    if (Object.keys(retrievedFromHashesCache).length) {\n      return retrievedFromHashesCache\n    } else {\n      this.caches = this.caches.then(async (caches) => {\n        for (const currData of Object.values(caches.dataById)) {\n          if (currData.decrypted) {\n            const currDataHashes = await this.accessControlSecret.secureDelegationKeysFor(\n              currData.decrypted.accessControlSecret,\n              entityType,\n              entitySecretForeignKeys\n            )\n            currDataHashes.forEach((hash) => caches.hashToId.set(hash, currData.exchangeData.id!))\n          }\n        }\n        return caches\n      })\n      return retrieveByHashesFromCaches(await this.caches)\n    }\n  }\n\n  async getOrCreateEncryptionDataTo(\n    delegateId: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined\n  ): Promise<{ exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey }> {\n    const caches = await this.caches\n    const dataId = caches.delegateToVerifiedEncryptionDataId[delegateId]\n    const cached = dataId ? caches.dataById[dataId] : undefined\n    if (cached && cached?.decrypted) {\n      return {\n        exchangeData: cached.exchangeData,\n        accessControlSecret: cached.decrypted.accessControlSecret,\n        exchangeKey: cached.decrypted.exchangeKey,\n      }\n    }\n    const created = await this.createNewExchangeData(delegateId)\n    this.cacheData(\n      created.exchangeData,\n      { accessControlSecret: created.accessControlSecret, exchangeKey: created.exchangeKey, verified: true },\n      entityType,\n      entitySecretForeignKeys\n    )\n    return created\n  }\n\n  async getDecryptionDataKeyById(\n    id: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined,\n    retrieveIfNotCached: boolean\n  ): Promise<{ exchangeData: ExchangeData; exchangeKey: CryptoKey | undefined; accessControlSecret: string | undefined } | undefined> {\n    const caches = await this.caches\n    const cachedData = caches.dataById[id]\n    if (cachedData) {\n      return {\n        exchangeData: cachedData.exchangeData,\n        exchangeKey: cachedData.decrypted?.exchangeKey,\n        accessControlSecret: cachedData.decrypted?.accessControlSecret,\n      }\n    } else if (retrieveIfNotCached) {\n      const data = await this.base.getExchangeDataById(id)\n      if (!data) throw new Error(`Could not find exchange data with id ${id}`)\n      const decrypted = await this.decryptData(data)\n      this.cacheData(data, decrypted, entityType, entitySecretForeignKeys)\n      return { exchangeData: data, exchangeKey: decrypted?.exchangeKey, accessControlSecret: decrypted?.accessControlSecret }\n    } else return undefined\n  }\n\n  private cacheData(\n    exchangeData: ExchangeData,\n    decrypted: { accessControlSecret: string; exchangeKey: CryptoKey; verified: boolean } | undefined,\n    entityType?: EntityWithDelegationTypeName,\n    entitySecretForeignKeys?: string[]\n  ): void {\n    this.caches = this.caches.then(async (caches) => {\n      caches.dataById[exchangeData.id!] = { exchangeData, decrypted }\n      if (decrypted) {\n        // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact\n        // `secureDelegationKeysFor` is currently ignoring the sfks\n        if (entityType && entitySecretForeignKeys) {\n          const hashes = await this.accessControlSecret.secureDelegationKeysFor(decrypted.accessControlSecret, entityType, entitySecretForeignKeys)\n          hashes.forEach((hash) => {\n            caches.hashToId.set(hash, exchangeData.id!)\n          })\n        }\n        if (decrypted.verified) {\n          caches.delegateToVerifiedEncryptionDataId[exchangeData.delegate] = exchangeData.id!\n        }\n      }\n      return caches\n    })\n  }\n\n  private async doRepopulateCache(): Promise<{\n    dataById: { [id: string]: CachedExchangeData }\n    hashToId: Map<string, string>\n    delegateToVerifiedEncryptionDataId: { [delegate: string]: string }\n    entityTypeToAccessControlKeysValue: { [entityType in EntityWithDelegationTypeName]?: string }\n  }> {\n    const allData = await this.base.getAllExchangeDataForCurrentDataOwnerIfAllowed()\n    if (!allData) throw new Error('Impossible to use fully cached exchange data manager for current data owner.')\n    const dataById: { [id: string]: CachedExchangeData } = {}\n    const hashToId = new Map<string, string>()\n    const delegateToVerifiedEncryptionDataId: { [delegate: string]: string } = {}\n    for (const currData of allData) {\n      const currDecrypted = await this.decryptData(currData)\n      dataById[currData.id!] = { exchangeData: currData, decrypted: currDecrypted }\n      if (currDecrypted?.verified) {\n        delegateToVerifiedEncryptionDataId[currData.delegate] = currData.id!\n      }\n    }\n    const entityTypeToAccessControlKeysValue: { [entityType in EntityWithDelegationTypeName]?: string } = {}\n    return { dataById, hashToId, delegateToVerifiedEncryptionDataId, entityTypeToAccessControlKeysValue }\n  }\n\n  async getAccessControlKeysValue(entityType: EntityWithDelegationTypeName): Promise<string | undefined> {\n    const caches = await this.caches\n    const cached = caches.entityTypeToAccessControlKeysValue[entityType]\n    if (cached) return cached\n    const accessControlSecrets = Object.values(caches.dataById).flatMap((x) => (x.decrypted ? [x.decrypted.accessControlSecret] : []))\n    const fullData = await this.accessControlSecret.getEncodedAccessControlKeys(accessControlSecrets, entityType)\n    caches.entityTypeToAccessControlKeysValue[entityType] = fullData\n    return fullData\n  }\n\n  async getAllDelegationKeys(entityType: EntityWithDelegationTypeName): Promise<string[] | undefined> {\n    const caches = await this.caches\n    const accessControlSecrets = Object.values(caches.dataById).flatMap((x) => (x.decrypted ? [x.decrypted.accessControlSecret] : []))\n    const res: string[] = []\n    for (const accessControlSecret of accessControlSecrets) {\n      // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact\n      res.push(await this.accessControlSecret.secureDelegationKeyFor(accessControlSecret, entityType, undefined))\n    }\n    return res\n  }\n}\n\nclass LimitedLruCacheExchangeDataManager extends AbstractExchangeDataManager {\n  private readonly idToDataCache: LruTemporisedAsyncCache<string, CachedExchangeData & { hashes: string[] }>\n  private readonly hashToId: Map<string, string> = new Map()\n  private readonly delegateToVerifiedEncryptionDataId: Map<string, string> = new Map()\n\n  constructor(\n    base: BaseExchangeDataManager,\n    encryptionKeys: UserEncryptionKeysManager,\n    signatureKeys: UserSignatureKeysManager,\n    accessControlSecret: AccessControlSecretUtils,\n    cryptoStrategies: CryptoStrategies,\n    dataOwnerApi: IccDataOwnerXApi,\n    primitives: CryptoPrimitives,\n    useParentKeys: boolean,\n    optionalParameters: {\n      lruCacheSize?: number\n    }\n  ) {\n    super(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys)\n    this.idToDataCache = new LruTemporisedAsyncCache(optionalParameters.lruCacheSize ?? 2000, () => -1)\n  }\n\n  async clearOrRepopulateCache(): Promise<void> {\n    this.idToDataCache.clear(false)\n    this.hashToId.clear()\n    this.delegateToVerifiedEncryptionDataId.clear()\n  }\n\n  async getCachedDecryptionDataKeyByAccessControlHash(\n    hashes: string[],\n    entityType: EntityWithDelegationTypeName,\n    entitySecretForeignKeys: string[]\n  ): Promise<{ [p: string]: { exchangeData: ExchangeData; exchangeKey: CryptoKey; accessControlSecret: string } }> {\n    const res: { [p: string]: { exchangeData: ExchangeData; exchangeKey: CryptoKey; accessControlSecret: string } } = {}\n    for (const hash of hashes) {\n      const dataId = this.hashToId.get(hash)\n      if (dataId) {\n        const retrieved = await this.idToDataCache.get(dataId, () => {\n          throw new Error(`Data with id ${dataId} should have been already cached.`)\n        })\n        if (retrieved.decrypted) {\n          res[hash] = {\n            exchangeData: retrieved.exchangeData,\n            exchangeKey: retrieved.decrypted.exchangeKey,\n            accessControlSecret: retrieved.decrypted.accessControlSecret,\n          }\n        }\n      }\n    }\n    return res\n  }\n\n  private async secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(\n    accessControlSecret: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined\n  ): Promise<string[]> {\n    const noSfkDelegationKeys = await Promise.all(\n      [...entityWithDelegationTypeNames].map((t) => this.accessControlSecret.secureDelegationKeyFor(accessControlSecret, t, undefined))\n    )\n    if (entityType && entitySecretForeignKeys?.length) {\n      // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact\n      // `secureDelegationKeysFor` is currently ignoring the sfks\n      return [\n        ...noSfkDelegationKeys,\n        ...(await this.accessControlSecret.secureDelegationKeysFor(accessControlSecret, entityType, entitySecretForeignKeys)),\n      ]\n    } else {\n      return noSfkDelegationKeys\n    }\n  }\n\n  async getDecryptionDataKeyById(\n    id: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined,\n    retrieveIfNotCached: boolean\n  ): Promise<{ exchangeData: ExchangeData; exchangeKey: CryptoKey | undefined; accessControlSecret: string | undefined } | undefined> {\n    const cached = await this.idToDataCache.getIfCachedJob(id)\n    if (cached) {\n      const updated = await this.idToDataCache.get(\n        id,\n        async (prevData) => {\n          const toUpdate = prevData ?? cached.item\n          if (toUpdate.decrypted) {\n            // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users, and it has some performance impact\n            // `secureDelegationKeysFor` is currently ignoring the sfks\n            if (entityType && entitySecretForeignKeys) {\n              const hashes = await this.accessControlSecret.secureDelegationKeysFor(\n                toUpdate.decrypted.accessControlSecret,\n                entityType,\n                entitySecretForeignKeys\n              )\n              hashes.forEach((hash) => {\n                this.hashToId.set(hash, toUpdate.exchangeData.id!)\n              })\n              toUpdate.hashes.push(...hashes)\n            }\n          }\n          return { item: toUpdate, onEviction: (b) => this.doOnEvictionJob(b, toUpdate) }\n        },\n        () => true\n      )\n      return {\n        exchangeData: updated.exchangeData,\n        exchangeKey: updated.decrypted?.exchangeKey,\n        accessControlSecret: updated.decrypted?.accessControlSecret,\n      }\n    } else if (retrieveIfNotCached) {\n      return await this.idToDataCache\n        .get(id, async () =>\n          this.cacheJob(async () => {\n            const data = await this.base.getExchangeDataById(id)\n            if (!data) throw new Error(`Could not find exchange data with id ${id}`)\n            const decrypted = await this.decryptData(data)\n            if (decrypted) {\n              const hashes = await this.secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(\n                decrypted.accessControlSecret,\n                entityType,\n                entitySecretForeignKeys\n              )\n              return { exchangeData: data, hashes, decrypted, verified: decrypted.verified }\n            } else {\n              return { exchangeData: data, hashes: [], verified: false }\n            }\n          })\n        )\n        .then((x) => ({ exchangeData: x.exchangeData, exchangeKey: x.decrypted?.exchangeKey, accessControlSecret: x.decrypted?.accessControlSecret }))\n    } else return undefined\n  }\n\n  async getOrCreateEncryptionDataTo(\n    delegateId: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined\n  ): Promise<{ exchangeData: ExchangeData; accessControlSecret: string; exchangeKey: CryptoKey }> {\n    let existingId = this.delegateToVerifiedEncryptionDataId.get(delegateId)\n    if (!existingId) {\n      await this.populateCacheToDelegate(delegateId, entityType, entitySecretForeignKeys)\n      existingId = this.delegateToVerifiedEncryptionDataId.get(delegateId)\n    }\n    if (existingId) {\n      const cached = await this.idToDataCache.getIfCachedJob(existingId)\n      if (!cached) throw new Error(`Illegal state: data with id ${existingId} should have been in cache`)\n      if (cached.item.decrypted) {\n        return {\n          exchangeData: cached.item.exchangeData,\n          exchangeKey: cached.item.decrypted.exchangeKey,\n          accessControlSecret: cached.item.decrypted.accessControlSecret,\n        }\n      } else throw new Error(`Illegal state: cached verified data should be decrypted.`)\n    } else {\n      const newDataId = this.primitives.randomUuid()\n      this.delegateToVerifiedEncryptionDataId.set(delegateId, newDataId)\n      const createdAndCachedData = await this.idToDataCache.get(newDataId, () =>\n        this.cacheJob(async () => {\n          const created = await this.createNewExchangeData(delegateId, newDataId)\n          const hashes = await this.secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(\n            created.accessControlSecret,\n            entityType,\n            entitySecretForeignKeys\n          )\n          return {\n            exchangeData: created.exchangeData,\n            decrypted: {\n              accessControlSecret: created.accessControlSecret,\n              exchangeKey: created.exchangeKey,\n              verified: true,\n            },\n            hashes,\n          }\n        })\n      )\n      if (!createdAndCachedData) throw new Error('Data should have been successfully created')\n      return {\n        exchangeData: createdAndCachedData.exchangeData,\n        exchangeKey: createdAndCachedData.decrypted!.exchangeKey,\n        accessControlSecret: createdAndCachedData.decrypted!.accessControlSecret,\n      }\n    }\n  }\n\n  // Loads and adds to the cache all exchange data from the current data owner to the given delegate. Allows to check if there is already data from\n  // the current data owner to the delegate which is good for encryption.\n  private async populateCacheToDelegate(\n    delegateId: string,\n    entityType: EntityWithDelegationTypeName | undefined,\n    entitySecretForeignKeys: string[] | undefined\n  ): Promise<void> {\n    const dataToDelegate = await this.base.getExchangeDataByDelegatorDelegatePair(await this.dataOwnerApi.getCurrentDataOwnerId(), delegateId)\n    await Promise.all(\n      dataToDelegate.map(async (data) => {\n        await this.idToDataCache.get(data.id!, () =>\n          this.cacheJob(async () => {\n            const decrypted = await this.decryptData(data)\n            if (decrypted) {\n              const hashes = await this.secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(\n                decrypted.accessControlSecret,\n                entityType,\n                entitySecretForeignKeys\n              )\n              return { exchangeData: data, hashes, decrypted }\n            } else {\n              return { exchangeData: data, hashes: [] }\n            }\n          })\n        )\n      })\n    )\n  }\n\n  private async cacheJob(\n    retrieveDecryptedDataInfo: () => Promise<CachedExchangeData & { hashes: string[] }>\n  ): Promise<{ item: CachedExchangeData & { hashes: string[] }; onEviction: (isReplacement: boolean) => void }> {\n    const info = await retrieveDecryptedDataInfo()\n    info.hashes.forEach((hash) => this.hashToId.set(hash, info?.exchangeData.id!))\n    if (info.decrypted?.verified) this.delegateToVerifiedEncryptionDataId.set(info.exchangeData.delegate, info.exchangeData.id!)\n    const item = {\n      exchangeData: info.exchangeData,\n      hashes: info.hashes,\n      decrypted: info.decrypted,\n    }\n    return {\n      item,\n      onEviction: (b) => this.doOnEvictionJob(b, item),\n    }\n  }\n\n  private async doOnEvictionJob(isReplacement: boolean, item: CachedExchangeData & { hashes: string[] }) {\n    if (!isReplacement) {\n      item.hashes.forEach((hash) => this.hashToId.delete(hash))\n      if (this.delegateToVerifiedEncryptionDataId.get(item.exchangeData.delegate) === item.exchangeData.id) {\n        this.delegateToVerifiedEncryptionDataId.delete(item.exchangeData.delegate)\n      }\n    }\n  }\n\n  getAccessControlKeysValue(entityType: EntityWithDelegationTypeName): Promise<string | undefined> {\n    return Promise.resolve(undefined)\n  }\n\n  getAllDelegationKeys(entityType: EntityWithDelegationTypeName): Promise<string[] | undefined> {\n    return Promise.resolve(undefined)\n  }\n}\n"]}