@icure/api 7.1.16 → 8.0.0-RC.2

package/icc-x-api/icc-crypto-x-api.js

@@ -10,100 +10,89 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IccCryptoXApi = void 0;
-const _ = require("lodash");
-const binary_utils_1 = require("./utils/binary-utils");
-const utils_1 = require("./utils");
 class IccCryptoXApi {
+    /**
+     * The instance of {@link CryptoPrimitives} used by this instance of the iCure SDK.
+     */
     get primitives() {
-        return this.cryptoPrimitives;
+        return this._cryptoPrimitives;
     }
     /**
      * @internal this method is for internal use only and may be changed without notice.
      */
     get exchangeKeys() {
-        return this.exchangeKeysManager;
-    }
-    /**
-     * @deprecated replace with {@link CryptoPrimitives.crypto} at {@link primitives}.
-     */
-    get crypto() {
-        return this.cryptoPrimitives.crypto;
+        return this._exchangeKeysManager;
     }
     /**
-     * @deprecated replace with {@link CryptoPrimitives.shamir} at {@link primitives}.
+     * @internal this is for internal use only and may be changed without notice.
      */
-    get shamir() {
-        return this.cryptoPrimitives.shamir;
+    get keyStorage() {
+        return this._keyStorage;
     }
     /**
-     * @deprecated replace with {@link CryptoPrimitives.RSA} at {@link primitives}.
+     * @internal this is for internal use only and may be changed without notice.
      */
-    get RSA() {
-        return this.cryptoPrimitives.RSA;
+    get storage() {
+        return this._storage;
     }
     /**
-     * @deprecated replace with {@link CryptoPrimitives.AES} at {@link primitives}.
+     * @internal this is for internal use only and may be changed without notice.
      */
-    get AES() {
-        return this.cryptoPrimitives.AES;
+    get xapi() {
+        return this.xapiUtils;
     }
     /**
      * @internal this is for internal use only and may be changed without notice.
      */
-    get keyStorage() {
-        return this._keyStorage;
+    get exchangeData() {
+        return this._exchangeDataManager;
     }
     /**
      * @internal this is for internal use only and may be changed without notice.
      */
-    get storage() {
-        return this._storage;
+    get confidential() {
+        return this._confidentialEntities;
     }
     /**
      * @internal this is for internal use only and may be changed without notice.
      */
-    get entities() {
-        return this.entitiesEncrypiton;
+    get accessControlKeysHeaders() {
+        return this._accessControlKeysHeaders;
     }
     /**
      * @internal this is for internal use only and may be changed without notice.
      */
-    get confidential() {
-        return this.confidentialEntities;
+    get userKeysManager() {
+        return this._keyManager;
     }
     /**
      * @internal this is for internal use only and may be changed without notice.
      */
-    get userKeysManager() {
-        return this.keyManager;
+    get shamirKeysManager() {
+        return this._shamirManager;
     }
     /**
      * @internal this is for internal use only and may be changed without notice.
      */
-    get shamirKeysManager() {
-        return this.shamirManager;
+    get delegationsDeAnonymization() {
+        return this._delegationsDeAnonymisation;
     }
     /**
      * @internal
      */
-    constructor(exchangeKeysManager, cryptoPrimitives, keyManager, dataOwnerApi, entitiesEncrypiton, shamirManager, storage, keyStorage, icureStorageFacade, hcPartyBaseApi, confidentialEntities, basePatientApi) {
-        this.basePatientApi = basePatientApi;
-        this.keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.';
-        this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
-        this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
-        this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
-        this.rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.';
-        this.exchangeKeysManager = exchangeKeysManager;
-        this.cryptoPrimitives = cryptoPrimitives;
-        this.keyManager = keyManager;
-        this.dataOwnerApi = dataOwnerApi;
-        this.entitiesEncrypiton = entitiesEncrypiton;
-        this.shamirManager = shamirManager;
-        this._storage = storage;
-        this._keyStorage = keyStorage;
-        this.icureStorage = icureStorageFacade;
-        this.hcpartyBaseApi = hcPartyBaseApi;
-        this.confidentialEntities = confidentialEntities;
+    constructor(_exchangeKeysManager, _cryptoPrimitives, _keyManager, _dataOwnerApi, xapiUtils, _shamirManager, _storage, _keyStorage, _confidentialEntities, _exchangeDataManager, _accessControlKeysHeaders, _delegationsDeAnonymisation) {
+        this._exchangeKeysManager = _exchangeKeysManager;
+        this._cryptoPrimitives = _cryptoPrimitives;
+        this._keyManager = _keyManager;
+        this._dataOwnerApi = _dataOwnerApi;
+        this.xapiUtils = xapiUtils;
+        this._shamirManager = _shamirManager;
+        this._storage = _storage;
+        this._keyStorage = _keyStorage;
+        this._confidentialEntities = _confidentialEntities;
+        this._exchangeDataManager = _exchangeDataManager;
+        this._accessControlKeysHeaders = _accessControlKeysHeaders;
+        this._delegationsDeAnonymisation = _delegationsDeAnonymisation;
     }
     /**
      * Deletes values cached by the crypto api, to allow to detect changes in stored key pairs, exchange keys and/or current data owner details.
@@ -112,9 +101,10 @@ class IccCryptoXApi {
      */
     forceReload() {
         return __awaiter(this, void 0, void 0, function* () {
-            this.exchangeKeysManager.clearCache(true);
-            this.dataOwnerApi.clearCurrentDataOwnerIdsCache();
-            yield this.keyManager.reloadKeys();
+            this._exchangeKeysManager.clearCache(true);
+            this._dataOwnerApi.clearCurrentDataOwnerIdsCache();
+            yield this._keyManager.reloadKeys();
+            yield this._exchangeDataManager.clearOrRepopulateCache();
         });
     }
     /**
@@ -126,7 +116,7 @@ class IccCryptoXApi {
      *   topmost ancestor (at index 0) to the direct parent of the current data owner (at the last index, may be 0).
      */
     getEncryptionDecryptionKeypairsForDataOwnerHierarchy() {
-        return this.keyManager.getCurrentUserHierarchyAvailableKeypairs();
+        return this._keyManager.getCurrentUserHierarchyAvailableKeypairs();
     }
     /**
      * Get a key pair with the provided fingerprint if present.
@@ -134,7 +124,7 @@ class IccCryptoXApi {
      * @return the pair associated to the fingerprint and a boolean indicating if the pair is verified, if present, else undefined
      */
     getKeyPairForFingerprint(fingerprint) {
-        return this.keyManager.getKeyPairForFingerprint(fingerprint);
+        return this._keyManager.getKeyPairForFingerprint(fingerprint);
     }
     /**
      * Get the public keys of available key pairs for the current user and his parents in hex-encoded spki representation (uses cached keys: no request
@@ -144,7 +134,7 @@ class IccCryptoXApi {
      */
     getCurrentUserHierarchyAvailablePublicKeysHex() {
         return __awaiter(this, void 0, void 0, function* () {
-            return this.keyManager.getCurrentUserHierarchyAvailablePublicKeysHex();
+            return this._keyManager.getCurrentUserHierarchyAvailablePublicKeysHex();
         });
     }
     /**
@@ -157,714 +147,7 @@ class IccCryptoXApi {
      */
     getCurrentUserAvailablePublicKeysHex(verifiedOnly) {
         return __awaiter(this, void 0, void 0, function* () {
-            return this.keyManager.getCurrentUserAvailablePublicKeysHex(verifiedOnly);
-        });
-    }
-    /**
-     * @deprecated depending on your use case you should delete the calls to this method or call {@link forceReload}:
-     * - Replace with `forceReload()` if one of the following parts of the current data owner may have been modified from a different api instance:
-     *   - Hcp hierarchy
-     *   - Key recovery data (transfer keys or shamir)
-     *   - Exchange keys (formerly hcp keys)
-     * - Remove the call if the main goal was to force reload the data owner: data owner are not cached anymore.
-     */
-    emptyHcpCache(hcpartyId) {
-        this.exchangeKeysManager.clearCache(false);
-    }
-    /**
-     * @deprecated you should not need this method anymore to deal with the encryption of iCure entities because everything related to entities
-     * encryption should be done either through the entity-specific extended api or through the extended apis.
-     * Note that keys returned by the current implementation of this method may not be safe for encryption/sharing.
-     * If instead you are using this method to retrieve key pairs for other purposes, for example because you want to reuse the user keys in iCure for
-     * other services consider the following alternatives:
-     * - If you want to use all iCure facilities including key recovery and key verification you can use {@link getKeyPairForFingerprint}.
-     *   Note that this solution can only give access to keys for the data owner of the instantiated api and his parents.
-     * - Alternatively you can use directly your choice of {@link KeyStorageFacade} and {@link StorageEntryKeysFactory}: if these are the same you use
-     *   for the iCure API client the keys will be shared with it. Note however that the iCure api client uses
-     *   {@link StorageEntryKeysFactory.cachedRecoveredKeypairOfDataOwner} to cache recovered keys of a data owner which may not have originated from
-     *   this device, so you should only use {@link StorageEntryKeysFactory.deviceKeypairOfDataOwner} if you want to make sure the keys you use are safe
-     *   for encryption.
-     */
-    getCachedRsaKeyPairForFingerprint(dataOwnerId, pubKeyOrFingerprint) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const fingerprint = pubKeyOrFingerprint.slice(-32);
-            const res = this.keyManager.getDecryptionKeys()[fingerprint];
-            if (!res)
-                console.warn(`Could not find any keypair for fingerprint ${fingerprint}`);
-            return res;
-        });
-    }
-    /**
-     * @deprecated You do not need this method to encrypt/decrypt data of iCure, but if you want to reuse the iCure keys for the user for other purposes
-     * you have different options to replace this method, depending on what you actually need. All options return the hex-encoded spki representation of
-     * the public keys.
-     * - If you want only the public keys for which we have a private key available
-     *   - you can replicate the current behaviour using {@link getCurrentUserHierarchyAvailablePublicKeysHex}. This includes keys for the current user
-     *   and his parents.
-     *   - use {@link getCurrentUserAvailablePublicKeysHex} to get public keys only for the current data owner, ignoring any keys of the
-     *     parent hierarchy. In this case you can also apply a filter to only get verified keys (safe for encryption).
-     * - If you need all public keys for the data owner, including those for which there is no corresponding private key available on the device use
-     *   {@link IccDataOwnerXApi.getHexPublicKeysOf} with the current data owner. If you don't have it available you may get it from
-     *   {@link IccDataOwnerXApi.getCurrentDataOwner}, but this will require to do a request to the iCure server (other options use only cached data).
-     */
-    getPublicKeys() {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.userKeysManager.getCurrentUserHierarchyAvailablePublicKeysHex();
-        });
-    }
-    /**
-     * @deprecated replace with {@link CryptoPrimitives.randomUuid} at {@link primitives}.
-     */
-    randomUuid() {
-        return this.primitives.randomUuid();
-    }
-    /**
-     * @deprecated replace with {@link CryptoPrimitives.sha256} at {@link primitives}.
-     */
-    sha256(data) {
-        return this.primitives.sha256(data);
-    }
-    /**
-     * @deprecated Use {@link ShamirKeysManager.updateSelfSplits} from {@link shamirKeysManager} instead. Note that the new method completely replaces
-     * all current values if a split for the provided key already exists.
-     */
-    encryptShamirRSAKey(hcp, notaries, threshold) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const legacyKeyFp = (_a = hcp.publicKey) === null || _a === void 0 ? void 0 : _a.slice(-32);
-            if (!legacyKeyFp)
-                throw new Error(`No legacy/default key for hcp ${hcp.id}`);
-            yield this.shamirKeysManager.updateSelfSplits({ [legacyKeyFp]: { notariesIds: notaries.map((x) => x.id), minShares: threshold !== null && threshold !== void 0 ? threshold : notaries.length } }, []);
-            return (yield this.dataOwnerApi.getDataOwner(hcp.id)).dataOwner;
-        });
-    }
-    /**
-     * @deprecated You should not need this method anymore because the api will automatically try to recover the available shamir keys on startup.
-     */
-    decryptShamirRSAKey(hcp, notaries) {
-        return __awaiter(this, void 0, void 0, function* () {
-            try {
-                const publicKeys = yield this.getPublicKeys();
-                const nLen = notaries.length;
-                let decryptedPrivatedKey;
-                if (nLen == 1) {
-                    const notaryHcPartyId = notaries[0].id;
-                    const encryptedAesKeyMap = yield this.getEncryptedAesExchangeKeys(hcp, notaryHcPartyId);
-                    const importedAESHcPartyKey = yield Promise.all(Object.entries(encryptedAesKeyMap).map(([idPubKey, keysMap]) => __awaiter(this, void 0, void 0, function* () { return yield this.decryptHcPartyKey(notaryHcPartyId, hcp.id, notaryHcPartyId, idPubKey, keysMap, publicKeys); })));
-                    const cryptedPrivatedKey = hcp.privateKeyShamirPartitions[notaryHcPartyId];
-                    decryptedPrivatedKey = (0, binary_utils_1.ua2hex)(yield this.AES.decryptSome(importedAESHcPartyKey.map((k) => k.key), (0, binary_utils_1.hex2ua)(cryptedPrivatedKey)));
-                }
-                else {
-                    const decryptedShares = yield _.reduce(notaries, (queue, notary) => {
-                        return queue.then((shares) => __awaiter(this, void 0, void 0, function* () {
-                            try {
-                                // now, we get the encrypted shares in db and decrypt them. This assumes that the
-                                // the notaries' private keys are in localstorage. We should implement a way for the notaries to
-                                // give hcp the decrypted shares without having to also share their private keys.
-                                const encryptedAesKeyMap = yield this.getEncryptedAesExchangeKeys(hcp, notary.id);
-                                const importedAESHcPartyKey = yield Promise.all(Object.entries(encryptedAesKeyMap).map(([idPubKey, keysMap]) => __awaiter(this, void 0, void 0, function* () { return yield this.decryptHcPartyKey(notary.id, hcp.id, notary.id, idPubKey, keysMap, publicKeys); })));
-                                const encryptedShare = hcp.privateKeyShamirPartitions[notary.id];
-                                const decryptedShamirPartition = (0, binary_utils_1.ua2hex)(yield this.AES.decryptSome(importedAESHcPartyKey.map((k) => k.key), (0, binary_utils_1.hex2ua)(encryptedShare)));
-                                shares.push(decryptedShamirPartition);
-                            }
-                            catch (e) {
-                                console.log('Error during encryptedShamirRSAKey', notary.id, e);
-                            }
-                            return shares;
-                        }));
-                    }, Promise.resolve([]));
-                    decryptedPrivatedKey = this.primitives.shamir.combine(decryptedShares);
-                }
-                const importedPrivateKey = yield this.primitives.RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(decryptedPrivatedKey), ['decrypt']);
-                const importedPublicKey = yield this.primitives.RSA.importKey('spki', (0, binary_utils_1.hex2ua)(hcp.publicKey), ['encrypt']);
-                const exportedKeyPair = yield this.primitives.RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk');
-                yield this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${hcp.id}`, exportedKeyPair);
-            }
-            catch (e) {
-                console.log('Cannot decrypt shamir RSA key');
-            }
-        });
-    }
-    /**
-     * @deprecated you should not need this method anymore because everything related to entities encryption should be done either through the
-     * entity-specific extended api.
-     * Note that currently this method does not cache results anymore (but the updated methods do).
-     */
-    decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, publicKeys) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!publicKeys.length) {
-                const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: no public key`;
-                console.warn(reason);
-                throw new Error(reason);
-            }
-            const keysFpSet = new Set(publicKeys.map((x) => x.slice(-32)));
-            const filteredKeys = Object.fromEntries(Object.entries(this.keyManager.getDecryptionKeys()).filter(([fp]) => keysFpSet.has(fp)));
-            const decrypted = yield this.exchangeKeysManager.base.tryDecryptExchangeKeys([encryptedHcPartyKeys], filteredKeys);
-            const res = decrypted.successfulDecryptions[0];
-            if (!res) {
-                const error = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: impossible to decrypt. ` +
-                    'No private key was found or could be used to decrypt the aes exchange keys`';
-                console.warn(error);
-                throw new Error(error);
-            }
-            return {
-                delegatorId,
-                key: res,
-                rawKey: (0, binary_utils_1.ua2hex)(yield this.primitives.AES.exportKey(res, 'raw')),
-            };
-        });
-    }
-    /**
-     * @deprecated you should not need this method anymore. The new API will automatically load on startup all keys available through the key storage
-     * facade and/or recoverable through transfer keys or shamir split. If no verified key (safe for encryption) can be found during the instantiation
-     * of the API, depending on the parameters passed to the factory one of two scenarios will happen:
-     * - A new key will be automatically created on the device and stored using the key storage facade.
-     * - The api instantiation fails with an exception. This is ideal if you want to try to recover an existing key pair before creating a new one.
-     *
-     * If you were using this method to allow the user to recover an existing key that is not available in the storage facade nor recoverable through
-     * transfer keys or shamir split (for example by scanning a qr code, or by loading a file from the computer to the web browser's local storage)
-     * you will have to move that logic in your implementation of CryptoStrategies.
-     * It is currently not allowed to create new key pairs if a verified key pair is already available on the device, as this would be wasteful.
-     * If you want to convert a `JsonWebKey` pair to a `CryptoKey` pair you should use directly the method in `primitives.RSA`.
-     */
-    cacheKeyPair(keyPairInJwk) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const cryptoKeyPair = yield this.primitives.RSA.importKeyPair('jwk', keyPairInJwk.privateKey, 'jwk', keyPairInJwk.publicKey);
-            const pubHex = (0, binary_utils_1.ua2hex)(yield this.primitives.RSA.exportKey(cryptoKeyPair.publicKey, 'spki'));
-            const fingerprint = pubHex.slice(-32);
-            if (!this.keyManager.getDecryptionKeys()[fingerprint]) {
-                const selfId = yield this.dataOwnerApi.getCurrentDataOwnerId();
-                const selfKeys = this.dataOwnerApi.getHexPublicKeysOf((yield this.dataOwnerApi.getCurrentDataOwner()).dataOwner);
-                if (!selfKeys.has(pubHex))
-                    throw new Error(`Impossible to add key pair with fingerprint ${fingerprint} to data owner ${selfId}: the data owner has no matching public key`);
-                yield this.icureStorage.saveKey(selfId, fingerprint, keyPairInJwk, true);
-                // Force reload to check if more private keys can be recovered or more exchange keys become available.
-                yield this.forceReload();
-            }
-            return cryptoKeyPair;
-        });
-    }
-    /**
-     * @deprecated Usually you should not need this method, since the preferred sfk is automatically chosen by the extended entity apis when creating a
-     * new instance of the entity.
-     */
-    extractPreferredSfk(parent, hcpartyId, confidential) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return confidential ? this.confidential.getConfidentialSecretId(parent, hcpartyId) : this.confidential.getAnySecretIdSharedWithParents(parent);
-        });
-    }
-    /**
-     * @deprecated you should not need this method anymore because everything related to entities encryption should be done either through the
-     * entity-specific extended api.
-     */
-    decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds = 60) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield delegatorsHcPartyIdsSet.reduce((acc, delegator) => __awaiter(this, void 0, void 0, function* () {
-                const awaitedAcc = yield acc;
-                const keys = yield this.exchangeKeysManager.getDecryptionExchangeKeysFor(delegator, delegateHcPartyId);
-                const keysForDelegator = yield keys.reduce((accForKey, cryptoKey) => __awaiter(this, void 0, void 0, function* () {
-                    const awaitedAccForKey = yield accForKey;
-                    const rawKey = (0, binary_utils_1.ua2hex)(yield this.primitives.RSA.exportKey(cryptoKey, 'spki'));
-                    return [
-                        ...awaitedAccForKey,
-                        {
-                            key: cryptoKey,
-                            delegatorId: delegator,
-                            rawKey: rawKey,
-                        },
-                    ];
-                }), Promise.resolve([]));
-                return [...awaitedAcc, ...keysForDelegator];
-            }), Promise.resolve([]));
-        });
-    }
-    /**
-     * @deprecated you should not need this method anymore because everything related to entities encryption should be done either through the
-     * entity-specific extended api.
-     * Note that currently this method does not cache results anymore (but the updated methods do).
-     */
-    getEncryptedAesExchangeKeys(owner, delegateId) {
-        var _a, _b;
-        return __awaiter(this, void 0, void 0, function* () {
-            const publicKeys = Array.from(this.dataOwnerApi.getHexPublicKeysOf(owner));
-            const mapOfAesExchangeKeys = Object.entries((_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})
-                .filter((e) => e[1][delegateId] && Object.keys(e[1][delegateId]).some((k1) => publicKeys.some((pk) => pk.endsWith(k1))))
-                .reduce((map, e) => {
-                const candidates = Object.entries(e[1][delegateId]); //[fingerprint of delegate pub key, key], [fingerprint of owner pub key, key]
-                const [publicKeyFingerprint, encryptedAesExchangeKey] = candidates[candidates.findIndex(([k, v]) => publicKeys.some((pk) => pk.endsWith(k)))];
-                return Object.assign(Object.assign({}, map), { [e[0]]: { [publicKeyFingerprint]: encryptedAesExchangeKey } });
-            }, {});
-            if (!owner.publicKey || mapOfAesExchangeKeys[owner.publicKey] || !((_b = owner.hcPartyKeys) === null || _b === void 0 ? void 0 : _b[delegateId])) {
-                return mapOfAesExchangeKeys;
-            }
-            const delegate = (yield this.dataOwnerApi.getDataOwner(delegateId)).dataOwner;
-            if (delegate.publicKey && publicKeys.includes(delegate.publicKey)) {
-                return Object.assign(Object.assign({}, mapOfAesExchangeKeys), { [owner.publicKey]: { [delegate.publicKey.slice(-32)]: owner.hcPartyKeys[delegateId][1] } });
-            }
-            else if (publicKeys.includes(owner.publicKey)) {
-                return Object.assign(Object.assign({}, mapOfAesExchangeKeys), { [owner.publicKey]: { [owner.publicKey.slice(-32)]: owner.hcPartyKeys[delegateId][0] } });
-            }
-            return mapOfAesExchangeKeys;
-        });
-    }
-    /**
-     * @deprecated you should not use this method because initialisation of encrypted entities keys is done automatically by the entity-specific
-     * extended api. Also note that it is now forbidden to initialise an entity as a data owner which is not the current data owner: you should instead
-     * create the entity as the current data owner then create a delegation to the other data owner.
-     */
-    initEncryptionKeys(createdObject, ownerId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (ownerId !== (yield this.dataOwnerApi.getCurrentDataOwnerId())) {
-                throw new Error('Impossible to initialise keys as a data owner which is not the current data owner');
-            }
-            const { updatedEntity, rawEncryptionKey } = yield this.entities.entityWithInitialisedEncryptedMetadata(Object.assign(Object.assign({}, createdObject), { delegations: undefined, encryptionKeys: undefined, cryptedForeignKeys: undefined, secretForeignKeys: undefined }), undefined, undefined, true);
-            return {
-                encryptionKeys: updatedEntity.encryptionKeys,
-                secretId: rawEncryptionKey,
-            };
-        });
-    }
-    /**
-     * @deprecated You should use:
-     * - {@link IccPatientXApi.decryptSecretIdsOf} or {@link IccMessageXApi.decryptSecretIdsOf} to get the delegation sfks (now called secret ids).
-     * - {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds} to get the full hierarchy for the current data owner (cached). The first element is
-     *   the id of the topmost parent, while the last is the current data owner.
-     * Note that the behaviour of this method has some subtle changes compared to the past:
-     * - throws an error if the provided hcpartyId is not part of the current data owner hierarchy.
-     * - does not provide any guarantees on the ordering of the extracted keys
-     * - deduplicates extracted keys
-     */
-    extractDelegationsSFKs(document, hcpartyId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!document || !hcpartyId) {
-                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-            }
-            const delegationsForAllDelegates = document.delegations;
-            if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
-                console.log(`There is no delegation in document (${document.id})`);
-                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-            }
-            return {
-                extractedKeys: yield this.entities.secretIdsOf(document, hcpartyId),
-                hcpartyId: (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())[0],
-            };
-        });
-    }
-    /**
-     * @deprecated (light) You should use:
-     * - {@link IccHelementXApi.decryptPatientIdOf}, {@link IccDocumentXApi.decryptMessageIdOf}, ... to get the crypted foreign keys.
-     * - {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds} to get the full hierarchy for the current data owner (cached). The first element is
-     *   the id of the topmost parent, while the last is the current data owner.
-     * Note that the behaviour of this method has some subtle changes compared to the past:
-     * - throws an error if the provided hcpartyId is not part of the current data owner hierarchy.
-     * - does not provide any guarantees on the ordering of the extracted keys
-     * - deduplicates extracted keys
-     */
-    extractCryptedFKs(document, hcpartyId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!document || !document.cryptedForeignKeys) {
-                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-            }
-            const cfksForAllDelegates = document.cryptedForeignKeys;
-            if (!cfksForAllDelegates || !Object.keys(cfksForAllDelegates).length) {
-                console.log(`There is no cryptedForeignKeys in document (${document.id})`);
-                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-            }
-            return {
-                extractedKeys: yield this.entities.owningEntityIdsOf(document, hcpartyId),
-                hcpartyId: (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())[0],
-            };
-        });
-    }
-    /**
-     * @deprecated You should use the extended apis methods to encrypt/decrypt entities or their attachments
-     * Note that the behaviour of this method has some subtle changes compared to the past:
-     * - throws an error if the provided hcpartyId is not part of the current data owner hierarchy.
-     * - does not provide any guarantees on the ordering of the extracted keys
-     * - deduplicates extracted keys
-     */
-    extractEncryptionsSKs(document, hcpartyId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!document.encryptionKeys) {
-                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-            }
-            const eckeysForAllDelegates = document.encryptionKeys;
-            if (!eckeysForAllDelegates || !Object.keys(eckeysForAllDelegates).length) {
-                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-            }
-            return {
-                extractedKeys: yield this.entities.encryptionKeysOf(document, hcpartyId),
-                hcpartyId: (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())[0],
-            };
-        });
-    }
-    /**
-     * @deprecated You should not use this method anymore, depending on what you were passing as {@link delegations} you should replace this method as
-     * explained in {@link extractEncryptionsSKs} (if you were passing encryptionKeys), {@link extractCryptedFKs} (cryptedForeignKeys), or
-     * {@link extractDelegationsSFKs} (delegations).
-     */
-    extractKeysFromDelegationsForHcpHierarchy(dataOwnerId, objectId, delegations) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return {
-                extractedKeys: yield this.entities.extractMergedHierarchyFromDelegationAndOwner(delegations, dataOwnerId, (x) => !!x, () => Promise.resolve(true)),
-                hcpartyId: (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())[0],
-            };
-        });
-    }
-    /**
-     * @deprecated you should not need this method anymore: the new API will automatically load on startup all keys available through the key storage
-     * facade and/or recoverable through transfer keys or shamir split. If you were using this method to load a key recovered through other means you
-     * will have to do so in your implementation of CryptoStrategies.
-     * You can convert the private key pkcs8 array to a jwk key using {@link pkcs8ToJwk} then you can extract the full key pair using
-     * {@link keyPairFromPrivateKeyJwk}.
-     */
-    loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, privateKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.cacheKeyPair((0, utils_1.keyPairFromPrivateKeyJwk)((0, utils_1.pkcs8ToJwk)(privateKey)));
-        });
-    }
-    /**
-     * @deprecated you should not need this method anymore: the new API will automatically load on startup all keys available through the key storage
-     * facade and/or recoverable through transfer keys or shamir split. If you were using this method to load a key recovered through other means you
-     * will have to do so in your implementation of CryptoStrategies.
-     * You can extract the full key pair using {@link keyPairFromPrivateKeyJwk}.
-     */
-    loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privateKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.cacheKeyPair((0, utils_1.keyPairFromPrivateKeyJwk)(privateKey));
-        });
-    }
-    /**
-     * @deprecated you should not need this method anymore: the new API will automatically load on startup all keys available through the key storage
-     * facade and/or recoverable through transfer keys or shamir split. If you were using this method to load a key recovered through other means you
-     * will have to do so in your implementation of CryptoStrategies.
-     */
-    loadKeyPairsInBrowserLocalStorage(healthcarePartyId, file) {
-        const fr = new FileReader();
-        return new Promise((resolve, reject) => {
-            fr.onerror = reject;
-            fr.onabort = reject;
-            fr.onload = (e) => {
-                const privateKey = e.target.result;
-                this.loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, (0, binary_utils_1.hex2ua)(privateKey))
-                    .then(() => resolve())
-                    .catch(reject);
-            };
-            fr.readAsText(file);
-        });
-    }
-    // noinspection JSUnusedGlobalSymbols
-    /**
-     * @deprecated keychains are not part of iCure's api: this method will be removed.
-     */
-    saveKeychainInBrowserLocalStorage(id, keychain) {
-        this._storage.setItem(this.keychainLocalStoreIdPrefix + id, (0, binary_utils_1.b2a)(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), '')));
-    }
-    /**
-     * @deprecated keychains are not part of iCure's api: this method will be removed.
-     */
-    saveKeychainInBrowserLocalStorageAsBase64(id, keyChainB64) {
-        this._storage.setItem(this.keychainLocalStoreIdPrefix + id, keyChainB64);
-    }
-    // noinspection JSUnusedGlobalSymbols
-    /**
-     * @deprecated keychains are not part of iCure's api: this method will be removed.
-     */
-    saveKeychainValidityDateInBrowserLocalStorage(id, date) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!id)
-                return;
-            if (!date) {
-                yield this._storage.removeItem(this.keychainValidityDateLocalStoreIdPrefix + id);
-            }
-            else {
-                yield this._storage.setItem(this.keychainValidityDateLocalStoreIdPrefix + id, date);
-            }
-        });
-    }
-    /**
-     * @deprecated keychains are not part of iCure's api: this method will be removed.
-     *
-     * Populate the HCP.options dict with an encrypted eHealth certificate and unencryped expiry date.
-     * Any potentially unencrypted certificates will be pruned from the HCP.
-     * @param hcpId Id of the hcp to modify
-     * @returns modified HCP
-     */
-    saveKeyChainInHCPFromLocalStorage(hcpId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
-                let aesKey = null;
-                try {
-                    aesKey = _.find(yield this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id], hcp.id), (delegator) => delegator.delegatorId === hcp.id).key;
-                }
-                catch (e) {
-                    console.error('Error while importing the AES key.');
-                }
-                if (!aesKey) {
-                    console.error('No encryption key!');
-                }
-                const opts = hcp.options || {};
-                const crt = yield this.getKeychainInBrowserLocalStorageAsBase64(hcp.id);
-                if (!!aesKey && !!crt) {
-                    let crtEncrypted = null;
-                    try {
-                        crtEncrypted = yield this.AES.encrypt(aesKey, new Uint8Array((0, binary_utils_1.string2ua)(atob(crt))));
-                    }
-                    catch (e) {
-                        console.error('Error while encrypting the certificate', e);
-                    }
-                    // add the encrypted certificate to the options
-                    _.set(opts, this.hcpPreferenceKeyEhealthCert, (0, binary_utils_1.ua2string)(new Uint8Array(crtEncrypted)));
-                }
-                const crtValidityDate = this.getKeychainValidityDateInBrowserLocalStorage(hcp.id);
-                if (!!crtValidityDate) {
-                    _.set(opts, this.hcpPreferenceKeyEhealthCertDate, crtValidityDate);
-                }
-                hcp.options = opts;
-                return hcp;
-            }));
-        });
-    }
-    /**
-     * @deprecated keychains are not part of iCure's api: this method will be removed.
-     */
-    importKeychainInBrowserFromHCP(hcpId) {
-        return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
-            let crtCryp = null;
-            if (!!hcp.options && !!hcp.options[this.hcpPreferenceKeyEhealthCert]) {
-                crtCryp = (0, binary_utils_1.string2ua)(hcp.options[this.hcpPreferenceKeyEhealthCert]);
-            }
-            const crtValidityDate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCertDate);
-            // store the validity date
-            if (!!crtValidityDate) {
-                this.saveKeychainValidityDateInBrowserLocalStorage(hcp.id, crtValidityDate);
-            }
-            let crt = null;
-            let decryptionKey = null;
-            try {
-                decryptionKey = _.find(yield this.decryptAndImportAesHcPartyKeysForDelegators([hcp.id], hcp.id), (delegator) => delegator.delegatorId === hcp.id).key;
-            }
-            catch (e) {
-                console.error('Error while importing the AES key.');
-            }
-            if (!decryptionKey) {
-                throw new Error('No encryption key! eHealth certificate cannot be decrypted.');
-            }
-            if (!!crtCryp && decryptionKey) {
-                try {
-                    crt = yield this.AES.decrypt(decryptionKey, crtCryp);
-                }
-                catch (e) {
-                    console.error(e);
-                }
-            }
-            if (!crt) {
-                throw new Error(`Error while saving certificate in browser local storage! Hcp ${hcp.id} has no certificate.`);
-            }
-            else {
-                this.saveKeychainInBrowserLocalStorageAsBase64(hcp.id, btoa(String.fromCharCode.apply(null, Array.from(new Uint8Array(crt)))));
-            }
-            return;
-        }));
-    }
-    /**
-     * @deprecated e-health certificates and keychains are not part of iCure's api: this method will be removed.
-     *
-     * Synchronizes the eHealth certificate from the database into the LocalStorage, returning information on the presence
-     * of certificate data in either place.
-     *
-     * @param hcpId The healthcare party id
-     * @returns A Promise for an object that represents the existence of a certificate in local storage and in the DB,
-     * through the two boolean properties "local" and "remote".
-     */
-    syncEhealthCertificateFromDatabase(hcpId) {
-        return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => {
-            const remoteCertificate = _.get(hcp.options, this.hcpPreferenceKeyEhealthCert);
-            const localCertificate = this.getKeychainInBrowserLocalStorageAsBase64(hcp.id);
-            if (remoteCertificate) {
-                return this.importKeychainInBrowserFromHCP(hcp.id)
-                    .then(() => ({ local: true, remote: true }))
-                    .catch(() => ({ local: !!localCertificate, remote: true }));
-            }
-            else {
-                return { local: !!localCertificate, remote: !!remoteCertificate };
-            }
-        });
-    }
-    /**
-     * @deprecated keychains are not part of iCure's api: this method will be removed.
-     */
-    getKeychainInBrowserLocalStorageAsBase64(id) {
-        return this._storage.getItem(this.keychainLocalStoreIdPrefix + id);
-    }
-    /**
-     * @deprecated keychains are not part of iCure's api: this method will be removed.
-     */
-    getKeychainValidityDateInBrowserLocalStorage(id) {
-        return this._storage.getItem(this.keychainValidityDateLocalStoreIdPrefix + id);
-    }
-    /**
-     * @deprecated keychains are not part of iCure's api: this method will be removed.
-     */
-    loadKeychainFromBrowserLocalStorage(id) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const lsItem = yield this._storage.getItem(this.keychainLocalStoreIdPrefix + id);
-            return lsItem !== undefined ? (0, binary_utils_1.b64_2uas)(lsItem) : null;
-        });
-    }
-    /**
-     * @deprecated you should not need this method anymore to deal with the encryption of iCure entities because everything related to entities
-     * encryption should be done through the entity-specific extended api.
-     * If instead you were using the method for other reasons check {@link getCachedRsaKeyPairForFingerprint} to get an idea of possible replacements.
-     */
-    loadKeyPairNotImported(id, publicKeyFingerPrint) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (publicKeyFingerPrint) {
-                const cached = (_a = this.keyManager.getKeyPairForFingerprint(publicKeyFingerPrint)) === null || _a === void 0 ? void 0 : _a.pair;
-                if (cached) {
-                    return this.primitives.RSA.exportKeys(cached, 'jwk', 'jwk');
-                }
-            }
-            else {
-                const defaultKey = yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
-                if (defaultKey)
-                    return defaultKey;
-            }
-            console.warn(`No key can be found in local storage for id ${id} and publicKeyFingerPrint ${publicKeyFingerPrint}`);
-        });
-    }
-    /**
-     * @deprecated use {@link IccIcureMaintenanceXApi.applyKeyPairUpdate} instead.
-     */
-    giveAccessBackTo(delegateUser, ownerId, ownerNewPublicKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield this.exchangeKeys.base.giveAccessBackTo(ownerId, ownerNewPublicKey, this.userKeysManager.getDecryptionKeys());
-            return this.dataOwnerApi.getDataOwner(ownerId).then((x) => x.dataOwner);
-        });
-    }
-    /**
-     * @deprecated You don't need to manually generate exchange keys as they will be automatically created by the api when needed.
-     * Note that this method has some changes compared to previous version:
-     * - The method may return any data owner (including devices)
-     * - The method will throw an exception if the provided ownerId does not match the current data owner
-     */
-    generateKeyForDelegate(ownerId, delegateId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (ownerId !== (yield this.dataOwnerApi.getCurrentDataOwnerId())) {
-                throw new Error('You can only create delegation where the delegator is the current data owner');
-            }
-            return (yield this.dataOwnerApi.getDataOwner(ownerId)).dataOwner;
-        });
-    }
-    /**
-     * @deprecated replace with {@link IccDataOwnerXApi.getDataOwner}. Note that data owners are not cached anymore.
-     */
-    getDataOwner(ownerId, loadIfMissingFromCache = true) {
-        return this.dataOwnerApi.getDataOwner(ownerId);
-    }
-    /**
-     * @deprecated the crypto api will automatically verify on startup the validity of private keys, but in some cases you may want to verify the
-     * validity of keys recovered in your implementation of {@link CryptoStrategies}: in this case the method has been replaced with
-     * {@link RSA.checkKeyPairValidity}
-     */
-    checkPrivateKeyValidity(dataOwner) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const publicKeys = Array.from(new Set([dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x)));
-            return yield publicKeys.reduce((pres, publicKey) => __awaiter(this, void 0, void 0, function* () {
-                const res = yield pres;
-                try {
-                    const k = yield this.primitives.RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)), ['encrypt']);
-                    const cipher = yield this.primitives.RSA.encrypt(k, (0, binary_utils_1.utf8_2ua)('shibboleth'));
-                    const ikp = yield this.getCachedRsaKeyPairForFingerprint(dataOwner.id, publicKey.slice(-32));
-                    const plainText = (0, binary_utils_1.ua2utf8)(yield this.primitives.RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)));
-                    return plainText === 'shibboleth' || res;
-                }
-                catch (e) {
-                    return res;
-                }
-            }), Promise.resolve(false));
-        });
-    }
-    /**
-     * @deprecated (See {@link extractEncryptionsSKs} for a detailed explanation).
-     */
-    getEncryptionDecryptionKeys(dataOwnerId, document) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.entities.encryptionKeysOf(document, dataOwnerId);
-        });
-    }
-    /**
-     * @deprecated For the encryption/decryption of iCure entities and attachments you should rely solely on the extended apis methods.
-     */
-    encryptDecrypt(method, content, edKey, user, documentObject) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!content || !(edKey || ((user === null || user === void 0 ? void 0 : user.healthcarePartyId) && documentObject)))
-                return content;
-            if (edKey) {
-                const importedEdKey = yield this.primitives.AES.importKey('raw', (0, binary_utils_1.hex2ua)(edKey.replace(/-/g, '')));
-                try {
-                    return yield this.primitives.AES[method](importedEdKey, content);
-                }
-                catch (e) {
-                    return content;
-                }
-            }
-            const encryptionKeys = yield this.entities.encryptionKeysOf(documentObject, user === null || user === void 0 ? void 0 : user.healthcarePartyId);
-            const importedEdKey = yield this.primitives.AES.importKey('raw', (0, binary_utils_1.hex2ua)(encryptionKeys[0].replace(/-/g, '')));
-            try {
-                return yield this.primitives.AES[method](importedEdKey, content);
-            }
-            catch (e) {
-                return content;
-            }
-        });
-    }
-    /**
-     * @deprecated you should not need to interact directly with the storage instance used by the iCure sdk.
-     */
-    storeKeyPair(id, keyPair) {
-        this._storage.setItem(this.rsaLocalStoreIdPrefix + id, JSON.stringify(keyPair));
-    }
-    /**
-     * @deprecated This method is not safe as it allows any data owner to add a public key to other data owners. The method will be removed in future,
-     * additionally the user calling this method will require a special permission when calling it for another data owner.
-     * @param ownerId the id of the data owner which will have a new key.
-     */
-    generateAndAddNewKeyPairForOwner(ownerId) {
-        var _a, _b;
-        return __awaiter(this, void 0, void 0, function* () {
-            const { dataOwner, type } = yield this.dataOwnerApi.getDataOwner(ownerId);
-            if (type === 'device')
-                throw new Error('Cannot add a key pair to a device');
-            const newPair = yield this.primitives.RSA.generateKeyPair();
-            const exportedPub = (0, binary_utils_1.ua2hex)(yield this.primitives.RSA.exportKey(newPair.publicKey, 'spki'));
-            const exportedPriv = (0, binary_utils_1.ua2hex)(yield this.primitives.RSA.exportKey(newPair.privateKey, 'pkcs8'));
-            let updatedPub;
-            if (dataOwner.publicKey == '') {
-                if (Object.keys((_a = dataOwner.hcPartyKeys) !== null && _a !== void 0 ? _a : {}).length > 0)
-                    throw new Error(`Data owner ${ownerId} has empty public key but non-empty hcPartyKeys`);
-                updatedPub = exportedPub;
-            }
-            else {
-                updatedPub = (_b = dataOwner.publicKey) !== null && _b !== void 0 ? _b : exportedPub;
-            }
-            const updatedDataOwner = Object.assign(Object.assign({}, dataOwner), { publicKey: updatedPub, aesExchangeKeys: Object.assign(Object.assign({}, dataOwner.aesExchangeKeys), { [exportedPub]: {} }) });
-            let savedDataOwner;
-            if (type === 'patient') {
-                savedDataOwner = yield this.basePatientApi.modifyPatient(updatedDataOwner);
-            }
-            else if (type === 'hcp') {
-                savedDataOwner = yield this.hcpartyBaseApi.modifyHealthcareParty(updatedDataOwner);
-            }
-            else
-                throw new Error(`Unknown data owner type ${type}`);
-            return {
-                dataOwner: savedDataOwner,
-                publicKey: exportedPub,
-                privateKey: exportedPriv,
-            };
+            return this._keyManager.getCurrentUserAvailablePublicKeysHex(verifiedOnly);
         });
     }
 }