@icure/api 8.0.64 → 8.0.66

package/icc-x-api/crypto/ExchangeDataManager.js

@@ -12,33 +12,32 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.initialiseExchangeDataManagerForCurrentDataOwner = void 0;
 const utils_1 = require("./utils");
 const utils_2 = require("../utils");
-const lru_temporised_async_cache_1 = require("../utils/lru-temporised-async-cache");
-const EntityWithDelegationTypeName_1 = require("../utils/EntityWithDelegationTypeName");
 const CryptoActorStub_1 = require("../../icc-api/model/CryptoActorStub");
 const RSA_1 = require("./RSA");
+const async_mutex_1 = require("async-mutex");
+const simple_lru_cache_1 = require("../utils/simple-lru-cache");
 /**
  * @internal this function is for internal use only and may be changed without notice.
  * Initialises and returns the exchange data manager which is most appropriate for the current data owner.
  */
-function initialiseExchangeDataManagerForCurrentDataOwner(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys, optionalParameters = {}) {
+function initialiseExchangeDataManagerForCurrentDataOwner(base, encryptionKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys, optionalParameters = {}) {
     return __awaiter(this, void 0, void 0, function* () {
         const currentOwner = CryptoActorStub_1.CryptoActorStubWithType.fromDataOwner(yield dataOwnerApi.getCurrentDataOwner());
         if (cryptoStrategies.dataOwnerRequiresAnonymousDelegation(currentOwner)) {
-            const res = new FullyCachedExchangeDataManager(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys);
+            const res = new FullyCachedExchangeDataManager(base, encryptionKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys);
             yield res.clearOrRepopulateCache();
             return res;
         }
         else {
-            return new LimitedLruCacheExchangeDataManager(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys, optionalParameters);
+            return new LimitedLruCacheExchangeDataManager(base, encryptionKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys, optionalParameters);
         }
     });
 }
 exports.initialiseExchangeDataManagerForCurrentDataOwner = initialiseExchangeDataManagerForCurrentDataOwner;
 class AbstractExchangeDataManager {
-    constructor(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys) {
+    constructor(base, encryptionKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys) {
         this.base = base;
         this.encryptionKeys = encryptionKeys;
-        this.signatureKeys = signatureKeys;
         this.accessControlSecret = accessControlSecret;
         this.cryptoStrategies = cryptoStrategies;
         this.dataOwnerApi = dataOwnerApi;
@@ -48,6 +47,7 @@ class AbstractExchangeDataManager {
     decryptData(data) {
         return __awaiter(this, void 0, void 0, function* () {
             const decryptionKeys = this.encryptionKeys.getDecryptionKeys();
+            const encryptionKeys = Object.fromEntries(this.encryptionKeys.getSelfVerifiedKeys().map((x) => [x.fingerprint, x.pair.privateKey]));
             const decryptedExchangeKey = (yield this.base.tryDecryptExchangeKeys([data], decryptionKeys)).successfulDecryptions[0];
             if (!decryptedExchangeKey)
                 return undefined;
@@ -65,14 +65,15 @@ class AbstractExchangeDataManager {
                     decryptedAccessControlSecret,
                     decryptedExchangeKey,
                     decryptedSharedSignatureKey,
-                }, (fp) => this.signatureKeys.getSignatureVerificationKey(fp), true),
+                }, encryptionKeys, true),
             };
         });
     }
     createNewExchangeData(delegateId, options) {
         return __awaiter(this, void 0, void 0, function* () {
             const encryptionKeys = {};
-            this.encryptionKeys.getSelfVerifiedKeys().forEach(({ fingerprint, pair }) => {
+            const selfVerifiedKeys = this.encryptionKeys.getSelfVerifiedKeys();
+            selfVerifiedKeys.forEach(({ fingerprint, pair }) => {
                 encryptionKeys[fingerprint] = pair.publicKey;
             });
             if (delegateId != (yield this.dataOwnerApi.getCurrentDataOwnerId())) {
@@ -104,8 +105,7 @@ class AbstractExchangeDataManager {
                         throw new Error('Illegal state: verified keys should contain only keys for OAPE-SHA1 or OAPE-SHA256.');
                 }
             }
-            const signatureKey = yield this.signatureKeys.getOrCreateSignatureKeyPair();
-            const newData = yield this.base.createExchangeData(delegateId, { [signatureKey.fingerprint]: signatureKey.keyPair.privateKey }, encryptionKeys, options.newDataId ? { id: options.newDataId } : {});
+            const newData = yield this.base.createExchangeData(delegateId, Object.fromEntries(selfVerifiedKeys.map((x) => [x.fingerprint, x.pair.privateKey])), encryptionKeys, options.newDataId ? { id: options.newDataId } : {});
             return {
                 exchangeData: newData.exchangeData,
                 accessControlSecret: newData.accessControlSecret,
@@ -122,7 +122,6 @@ class AbstractExchangeDataManager {
             if (!newKeyHashVersion)
                 throw new Error(`Public key not found for data owner ${otherDataOwner}`);
             const importedNewKey = yield this.primitives.RSA.importKey('spki', (0, utils_2.hex2ua)(newDataOwnerPublicKey), ['encrypt'], newKeyHashVersion);
-            const signatureKey = yield this.signatureKeys.getOrCreateSignatureKeyPair();
             const decryptionKeys = this.encryptionKeys.getDecryptionKeys();
             const allExchangeDataToUpdate = self == otherDataOwner
                 ? yield this.base.getExchangeDataByDelegatorDelegatePair(self, self)
@@ -143,13 +142,13 @@ class AbstractExchangeDataManager {
     clearOrRepopulateCache() {
         throw new Error('Implemented by concrete class');
     }
-    getOrCreateEncryptionDataTo(delegateId, entityType, entitySecretForeignKeys, allowCreationWithoutDelegateKey) {
+    getOrCreateEncryptionDataTo(delegateId, allowCreationWithoutDelegateKey) {
         throw new Error('Implemented by concrete class');
     }
-    getCachedDecryptionDataKeyByAccessControlHash(hashes, entityType, entitySecretForeignKeys) {
+    getCachedDecryptionDataKeyByAccessControlHash(hashes) {
         throw new Error('Implemented by concrete class');
     }
-    getDecryptionDataKeyById(id, entityType, entitySecretForeignKeys, retrieveIfNotCached) {
+    getDecryptionDataKeyByIds(ids, retrieveIfNotCached) {
         throw new Error('Implemented by concrete class');
     }
     getAccessControlKeysValue(entityType) {
@@ -162,7 +161,8 @@ class AbstractExchangeDataManager {
 class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
     constructor() {
         super(...arguments);
-        this.caches = Promise.resolve({ dataById: {}, hashToId: new Map(), delegateToVerifiedEncryptionDataId: {}, entityTypeToAccessControlKeysValue: {} });
+        this.caches = Promise.resolve({ dataById: {}, hashToId: {}, delegateToVerifiedEncryptionDataId: {}, entityTypeToAccessControlKeysValue: {} });
+        this.createExchangeDataMutex = new async_mutex_1.Mutex();
     }
     clearOrRepopulateCache() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -170,11 +170,11 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
             yield this.caches;
         });
     }
-    getCachedDecryptionDataKeyByAccessControlHash(hashes, entityType, entitySecretForeignKeys) {
+    getCachedDecryptionDataKeyByAccessControlHash(hashes) {
         return __awaiter(this, void 0, void 0, function* () {
             function retrieveByHashesFromCaches(caches) {
                 return hashes.reduce((res, hash) => {
-                    const id = caches.hashToId.get(hash);
+                    const id = caches.hashToId[hash];
                     if (id) {
                         const cached = caches.dataById[id];
                         if (cached === null || cached === void 0 ? void 0 : cached.decrypted) {
@@ -188,25 +188,10 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
                     return res;
                 }, {});
             }
-            const retrievedFromHashesCache = retrieveByHashesFromCaches(yield this.caches);
-            if (Object.keys(retrievedFromHashesCache).length) {
-                return retrievedFromHashesCache;
-            }
-            else {
-                this.caches = this.caches.then((caches) => __awaiter(this, void 0, void 0, function* () {
-                    for (const currData of Object.values(caches.dataById)) {
-                        if (currData.decrypted) {
-                            const currDataHashes = yield this.accessControlSecret.secureDelegationKeysFor(currData.decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
-                            currDataHashes.forEach((hash) => caches.hashToId.set(hash, currData.exchangeData.id));
-                        }
-                    }
-                    return caches;
-                }));
-                return retrieveByHashesFromCaches(yield this.caches);
-            }
+            return retrieveByHashesFromCaches(yield this.caches);
         });
     }
-    getOrCreateEncryptionDataTo(delegateId, entityType, entitySecretForeignKeys, allowCreationWithoutDelegateKey) {
+    getCachedEncryptionDataTo(delegateId) {
         return __awaiter(this, void 0, void 0, function* () {
             const caches = yield this.caches;
             const dataId = caches.delegateToVerifiedEncryptionDataId[delegateId];
@@ -218,48 +203,60 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
                     exchangeKey: cached.decrypted.exchangeKey,
                 };
             }
-            // TODO this could technically allow for 2 concurrent exchange data creations, needs fix
-            const created = yield this.createNewExchangeData(delegateId, { allowNoDelegateKeys: allowCreationWithoutDelegateKey });
-            this.cacheData(created.exchangeData, true, { accessControlSecret: created.accessControlSecret, exchangeKey: created.exchangeKey, verified: true }, entityType, entitySecretForeignKeys);
-            return created;
+            else {
+                return undefined;
+            }
         });
     }
-    getDecryptionDataKeyById(id, entityType, entitySecretForeignKeys, retrieveIfNotCached) {
+    getOrCreateEncryptionDataTo(delegateId, allowCreationWithoutDelegateKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const initialCached = yield this.getCachedEncryptionDataTo(delegateId);
+            if (initialCached)
+                return initialCached;
+            const release = yield this.createExchangeDataMutex.acquire();
+            try {
+                const cachedAfterMutex = yield this.getCachedEncryptionDataTo(delegateId);
+                if (cachedAfterMutex)
+                    return cachedAfterMutex;
+                const created = yield this.createNewExchangeData(delegateId, { allowNoDelegateKeys: allowCreationWithoutDelegateKey });
+                this.cacheData(created.exchangeData, true, {
+                    accessControlSecret: created.accessControlSecret,
+                    exchangeKey: created.exchangeKey,
+                    verified: true,
+                });
+                return created;
+            }
+            finally {
+                release();
+            }
+        });
+    }
+    getDecryptionDataKeyByIds(ids, retrieveIfNotCached) {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
             const caches = yield this.caches;
-            const cachedData = caches.dataById[id];
-            if (cachedData) {
-                return {
-                    exchangeData: cachedData.exchangeData,
-                    exchangeKey: (_a = cachedData.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey,
-                    accessControlSecret: (_b = cachedData.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret,
-                };
-            }
-            else if (retrieveIfNotCached) {
-                const data = yield this.base.getExchangeDataById(id);
-                if (!data)
-                    throw new Error(`Could not find exchange data with id ${id}`);
-                const decrypted = yield this.decryptData(data);
-                this.cacheData(data, false, decrypted, entityType, entitySecretForeignKeys);
-                return { exchangeData: data, exchangeKey: decrypted === null || decrypted === void 0 ? void 0 : decrypted.exchangeKey, accessControlSecret: decrypted === null || decrypted === void 0 ? void 0 : decrypted.accessControlSecret };
+            const res = {};
+            for (const id of ids) {
+                const data = caches.dataById[id];
+                if (data) {
+                    res[id] = {
+                        exchangeData: data.exchangeData,
+                        exchangeKey: (_a = data.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey,
+                        accessControlSecret: (_b = data.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret,
+                    };
+                }
             }
-            else
-                return undefined;
+            return res;
         });
     }
-    cacheData(exchangeData, isNewData, decrypted, entityType, entitySecretForeignKeys) {
+    cacheData(exchangeData, isNewData, decrypted) {
         this.caches = this.caches.then((caches) => __awaiter(this, void 0, void 0, function* () {
             caches.dataById[exchangeData.id] = { exchangeData, decrypted };
             if (decrypted) {
-                // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact
-                // `secureDelegationKeysFor` is currently ignoring the sfks
-                if (entityType && entitySecretForeignKeys) {
-                    const hashes = yield this.accessControlSecret.secureDelegationKeysFor(decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
-                    hashes.forEach((hash) => {
-                        caches.hashToId.set(hash, exchangeData.id);
-                    });
-                }
+                const hashes = yield this.accessControlSecret.allSecureDelegationKeysFor(decrypted.accessControlSecret);
+                hashes.forEach((hash) => {
+                    caches.hashToId[hash] = exchangeData.id;
+                });
                 if (decrypted.verified) {
                     caches.delegateToVerifiedEncryptionDataId[exchangeData.delegate] = exchangeData.id;
                 }
@@ -275,7 +272,7 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
             if (!allData)
                 throw new Error('Impossible to use fully cached exchange data manager for current data owner.');
             const dataById = {};
-            const hashToId = new Map();
+            const hashToId = {};
             const delegateToVerifiedEncryptionDataId = {};
             for (const currData of allData) {
                 const currDecrypted = yield this.decryptData(currData);
@@ -283,6 +280,11 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
                 if (currDecrypted === null || currDecrypted === void 0 ? void 0 : currDecrypted.verified) {
                     delegateToVerifiedEncryptionDataId[currData.delegate] = currData.id;
                 }
+                if (currDecrypted === null || currDecrypted === void 0 ? void 0 : currDecrypted.accessControlSecret) {
+                    for (const h of yield this.accessControlSecret.allSecureDelegationKeysFor(currDecrypted.accessControlSecret)) {
+                        hashToId[h] = currData.id;
+                    }
+                }
             }
             const entityTypeToAccessControlKeysValue = {};
             return { dataById, hashToId, delegateToVerifiedEncryptionDataId, entityTypeToAccessControlKeysValue };
@@ -307,217 +309,190 @@ class FullyCachedExchangeDataManager extends AbstractExchangeDataManager {
             const res = [];
             for (const accessControlSecret of accessControlSecrets) {
                 // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact
-                res.push(yield this.accessControlSecret.secureDelegationKeyFor(accessControlSecret, entityType, undefined));
+                res.push(yield this.accessControlSecret.secureDelegationKeyFor(accessControlSecret, entityType));
             }
             return res;
         });
     }
 }
 class LimitedLruCacheExchangeDataManager extends AbstractExchangeDataManager {
-    constructor(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys, optionalParameters) {
+    constructor(base, encryptionKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys, optionalParameters) {
         var _a;
-        super(base, encryptionKeys, signatureKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys);
+        super(base, encryptionKeys, accessControlSecret, cryptoStrategies, dataOwnerApi, primitives, useParentKeys);
+        this.idToData = new simple_lru_cache_1.SimpleLruCache();
         this.hashToId = new Map();
         this.delegateToVerifiedEncryptionDataId = new Map();
-        this.idToDataCache = new lru_temporised_async_cache_1.LruTemporisedAsyncCache((_a = optionalParameters.lruCacheSize) !== null && _a !== void 0 ? _a : 2000, () => -1);
+        this.cacheMutex = new async_mutex_1.Mutex();
+        this.maxCachedExchangeData = (_a = optionalParameters.lruCacheSize) !== null && _a !== void 0 ? _a : 2000;
     }
     clearOrRepopulateCache() {
         return __awaiter(this, void 0, void 0, function* () {
-            this.idToDataCache.clear(false);
+            this.idToData.clear();
             this.hashToId.clear();
             this.delegateToVerifiedEncryptionDataId.clear();
         });
     }
-    getCachedDecryptionDataKeyByAccessControlHash(hashes, entityType, entitySecretForeignKeys) {
+    getCachedDecryptionDataKeyByAccessControlHash(hashes) {
         return __awaiter(this, void 0, void 0, function* () {
-            const res = {};
-            for (const hash of hashes) {
-                const dataId = this.hashToId.get(hash);
-                if (dataId) {
-                    const retrieved = yield this.idToDataCache.get(dataId, () => {
-                        throw new Error(`Data with id ${dataId} should have been already cached.`);
-                    });
-                    if (retrieved.decrypted) {
-                        res[hash] = {
-                            exchangeData: retrieved.exchangeData,
-                            exchangeKey: retrieved.decrypted.exchangeKey,
-                            accessControlSecret: retrieved.decrypted.accessControlSecret,
-                        };
+            const release = yield this.cacheMutex.acquire();
+            try {
+                const res = {};
+                for (const hash of hashes) {
+                    const dataId = this.hashToId.get(hash);
+                    if (dataId) {
+                        const retrieved = this.idToData.getCached(dataId);
+                        if (!retrieved)
+                            throw new Error(`Data with id ${dataId} should have been already cached.`);
+                        if (retrieved.decrypted) {
+                            res[hash] = {
+                                exchangeData: retrieved.exchangeData,
+                                exchangeKey: retrieved.decrypted.exchangeKey,
+                                accessControlSecret: retrieved.decrypted.accessControlSecret,
+                            };
+                        }
                     }
                 }
+                return res;
             }
-            return res;
-        });
-    }
-    secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(accessControlSecret, entityType, entitySecretForeignKeys) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const noSfkDelegationKeys = yield Promise.all([...EntityWithDelegationTypeName_1.entityWithDelegationTypeNames].map((t) => this.accessControlSecret.secureDelegationKeyFor(accessControlSecret, t, undefined)));
-            if (entityType && (entitySecretForeignKeys === null || entitySecretForeignKeys === void 0 ? void 0 : entitySecretForeignKeys.length)) {
-                // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users and it has some performance impact
-                // `secureDelegationKeysFor` is currently ignoring the sfks
-                return [
-                    ...noSfkDelegationKeys,
-                    ...(yield this.accessControlSecret.secureDelegationKeysFor(accessControlSecret, entityType, entitySecretForeignKeys)),
-                ];
-            }
-            else {
-                return noSfkDelegationKeys;
+            finally {
+                release();
             }
         });
     }
-    getDecryptionDataKeyById(id, entityType, entitySecretForeignKeys, retrieveIfNotCached) {
+    getDecryptionDataKeyByIds(ids, retrieveIfNotCached) {
         var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            const cached = yield this.idToDataCache.getIfCachedJob(id);
-            if (cached) {
-                const updated = yield this.idToDataCache.get(id, (prevData) => __awaiter(this, void 0, void 0, function* () {
-                    const toUpdate = prevData !== null && prevData !== void 0 ? prevData : cached.item;
-                    if (toUpdate.decrypted) {
-                        // Usage of sfks in secure delegation key should be configurable: it is not necessary for all users, and it has some performance impact
-                        // `secureDelegationKeysFor` is currently ignoring the sfks
-                        if (entityType && entitySecretForeignKeys) {
-                            const hashes = yield this.accessControlSecret.secureDelegationKeysFor(toUpdate.decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
-                            hashes.forEach((hash) => {
-                                this.hashToId.set(hash, toUpdate.exchangeData.id);
-                            });
-                            toUpdate.hashes.push(...hashes);
-                        }
+            const release = yield this.cacheMutex.acquire();
+            try {
+                const res = {};
+                const uncached = [];
+                for (const id of ids) {
+                    const cached = this.idToData.getCached(id);
+                    if (cached) {
+                        res[id] = {
+                            exchangeKey: (_a = cached.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey,
+                            accessControlSecret: (_b = cached.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret,
+                            exchangeData: cached.exchangeData,
+                        };
                     }
-                    return { item: toUpdate, onEviction: (b) => this.doOnEvictionJob(b, toUpdate) };
-                }), () => true);
-                return {
-                    exchangeData: updated.exchangeData,
-                    exchangeKey: (_a = updated.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey,
-                    accessControlSecret: (_b = updated.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret,
-                };
-            }
-            else if (retrieveIfNotCached) {
-                return yield this.idToDataCache
-                    .get(id, () => __awaiter(this, void 0, void 0, function* () {
-                    return this.cacheJob(() => __awaiter(this, void 0, void 0, function* () {
-                        const data = yield this.base.getExchangeDataById(id);
-                        if (!data)
-                            throw new Error(`Could not find exchange data with id ${id}`);
+                    else if (retrieveIfNotCached) {
+                        uncached.push(id);
+                    }
+                }
+                if (uncached.length > 0) {
+                    const retrieved = yield this.base.getExchangeDataByIds(uncached);
+                    for (const data of retrieved) {
                         const decrypted = yield this.decryptData(data);
                         if (decrypted) {
-                            const hashes = yield this.secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
-                            return { exchangeData: data, hashes, decrypted, verified: decrypted.verified };
+                            const hashes = yield this.accessControlSecret.allSecureDelegationKeysFor(decrypted.accessControlSecret);
+                            this.addToCache({ exchangeData: data, hashes, decrypted });
                         }
                         else {
-                            return { exchangeData: data, hashes: [], verified: false };
+                            this.addToCache({ exchangeData: data, hashes: [] });
                         }
-                    }));
-                }))
-                    .then((x) => { var _a, _b; return ({ exchangeData: x.exchangeData, exchangeKey: (_a = x.decrypted) === null || _a === void 0 ? void 0 : _a.exchangeKey, accessControlSecret: (_b = x.decrypted) === null || _b === void 0 ? void 0 : _b.accessControlSecret }); });
+                        res[data.id] = {
+                            exchangeKey: decrypted === null || decrypted === void 0 ? void 0 : decrypted.exchangeKey,
+                            accessControlSecret: decrypted === null || decrypted === void 0 ? void 0 : decrypted.accessControlSecret,
+                            exchangeData: data,
+                        };
+                    }
+                }
+                return res;
+            }
+            finally {
+                release();
             }
-            else
-                return undefined;
         });
     }
-    getOrCreateEncryptionDataTo(delegateId, entityType, entitySecretForeignKeys, allowCreationWithoutDelegateKey) {
+    getOrCreateEncryptionDataTo(delegateId, allowCreationWithoutDelegateKey) {
         return __awaiter(this, void 0, void 0, function* () {
-            let existingId = this.delegateToVerifiedEncryptionDataId.get(delegateId);
-            if (!existingId) {
-                yield this.populateCacheToDelegate(delegateId, entityType, entitySecretForeignKeys);
-                existingId = this.delegateToVerifiedEncryptionDataId.get(delegateId);
-            }
-            if (existingId) {
-                const cached = yield this.idToDataCache.getIfCachedJob(existingId);
-                if (!cached)
-                    throw new Error(`Illegal state: data with id ${existingId} should have been in cache`);
-                if (cached.item.decrypted) {
-                    return {
-                        exchangeData: cached.item.exchangeData,
-                        exchangeKey: cached.item.decrypted.exchangeKey,
-                        accessControlSecret: cached.item.decrypted.accessControlSecret,
-                    };
+            const release = yield this.cacheMutex.acquire();
+            try {
+                let existingId = this.delegateToVerifiedEncryptionDataId.get(delegateId);
+                if (!existingId) {
+                    yield this.populateCacheToDelegate(delegateId);
+                    existingId = this.delegateToVerifiedEncryptionDataId.get(delegateId);
                 }
-                else
-                    throw new Error(`Illegal state: cached verified data should be decrypted.`);
-            }
-            else {
-                const newDataId = this.primitives.randomUuid();
-                this.delegateToVerifiedEncryptionDataId.set(delegateId, newDataId);
-                const createdAndCachedData = yield this.idToDataCache.get(newDataId, () => this.cacheJob(() => __awaiter(this, void 0, void 0, function* () {
-                    try {
-                        const created = yield this.createNewExchangeData(delegateId, { newDataId, allowNoDelegateKeys: allowCreationWithoutDelegateKey });
-                        const hashes = yield this.secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(created.accessControlSecret, entityType, entitySecretForeignKeys);
+                if (existingId) {
+                    const cached = this.idToData.getCached(existingId);
+                    if (!cached)
+                        throw new Error(`Illegal state: data with id ${existingId} should have been in cache`);
+                    if (cached.decrypted) {
                         return {
-                            exchangeData: created.exchangeData,
-                            decrypted: {
-                                accessControlSecret: created.accessControlSecret,
-                                exchangeKey: created.exchangeKey,
-                                verified: true,
-                            },
-                            hashes,
+                            exchangeData: cached.exchangeData,
+                            exchangeKey: cached.decrypted.exchangeKey,
+                            accessControlSecret: cached.decrypted.accessControlSecret,
                         };
                     }
-                    catch (e) {
-                        this.delegateToVerifiedEncryptionDataId.delete(delegateId);
-                        throw e;
-                    }
-                })));
-                if (!createdAndCachedData)
-                    throw new Error('Data should have been successfully created');
-                return {
-                    exchangeData: createdAndCachedData.exchangeData,
-                    exchangeKey: createdAndCachedData.decrypted.exchangeKey,
-                    accessControlSecret: createdAndCachedData.decrypted.accessControlSecret,
-                };
+                    else
+                        throw new Error(`Illegal state: cached verified data should be decrypted.`);
+                }
+                else {
+                    const created = yield this.createNewExchangeData(delegateId, {
+                        allowNoDelegateKeys: allowCreationWithoutDelegateKey,
+                    });
+                    const hashes = yield this.accessControlSecret.allSecureDelegationKeysFor(created.accessControlSecret);
+                    const data = {
+                        exchangeData: created.exchangeData,
+                        decrypted: {
+                            accessControlSecret: created.accessControlSecret,
+                            exchangeKey: created.exchangeKey,
+                            verified: true,
+                        },
+                        hashes,
+                    };
+                    this.addToCache(data);
+                    return {
+                        exchangeData: data.exchangeData,
+                        exchangeKey: data.decrypted.exchangeKey,
+                        accessControlSecret: data.decrypted.accessControlSecret,
+                    };
+                }
+            }
+            finally {
+                release();
             }
         });
     }
     // Loads and adds to the cache all exchange data from the current data owner to the given delegate. Allows to check if there is already data from
     // the current data owner to the delegate which is good for encryption.
-    populateCacheToDelegate(delegateId, entityType, entitySecretForeignKeys) {
+    populateCacheToDelegate(delegateId) {
         return __awaiter(this, void 0, void 0, function* () {
             const dataToDelegate = yield this.base.getExchangeDataByDelegatorDelegatePair(yield this.dataOwnerApi.getCurrentDataOwnerId(), delegateId);
-            yield Promise.all(dataToDelegate.map((data) => __awaiter(this, void 0, void 0, function* () {
-                yield this.idToDataCache.get(data.id, () => this.cacheJob(() => __awaiter(this, void 0, void 0, function* () {
-                    const decrypted = yield this.decryptData(data);
-                    if (decrypted) {
-                        const hashes = yield this.secureDelegationKeysForAllEntitiesNoSfkAndSpecificEntitySfksPairs(decrypted.accessControlSecret, entityType, entitySecretForeignKeys);
-                        return { exchangeData: data, hashes, decrypted };
-                    }
-                    else {
-                        return { exchangeData: data, hashes: [] };
-                    }
-                })));
-            })));
+            for (const data of dataToDelegate) {
+                const decrypted = yield this.decryptData(data);
+                if (decrypted) {
+                    const hashes = yield this.accessControlSecret.allSecureDelegationKeysFor(decrypted.accessControlSecret);
+                    this.addToCache({ exchangeData: data, hashes, decrypted });
+                }
+                else {
+                    this.addToCache({ exchangeData: data, hashes: [] });
+                }
+            }
         });
     }
-    cacheJob(retrieveDecryptedDataInfo) {
+    addToCache(data) {
         var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const info = yield retrieveDecryptedDataInfo();
-            info.hashes.forEach((hash) => this.hashToId.set(hash, info === null || info === void 0 ? void 0 : info.exchangeData.id));
-            if ((_a = info.decrypted) === null || _a === void 0 ? void 0 : _a.verified)
-                this.delegateToVerifiedEncryptionDataId.set(info.exchangeData.delegate, info.exchangeData.id);
-            const item = {
-                exchangeData: info.exchangeData,
-                hashes: info.hashes,
-                decrypted: info.decrypted,
-            };
-            return {
-                item,
-                onEviction: (b) => this.doOnEvictionJob(b, item),
-            };
-        });
+        if (this.idToData.size >= this.maxCachedExchangeData) {
+            this.evictOneEntry();
+        }
+        data.hashes.forEach((hash) => this.hashToId.set(hash, data.exchangeData.id));
+        if (((_a = data.decrypted) === null || _a === void 0 ? void 0 : _a.verified) && !this.delegateToVerifiedEncryptionDataId.has(data.exchangeData.delegate)) {
+            this.delegateToVerifiedEncryptionDataId.set(data.exchangeData.delegate, data.exchangeData.id);
+        }
+        this.idToData.set(data.exchangeData.id, data);
     }
-    doOnEvictionJob(isReplacement, item) {
-        return __awaiter(this, void 0, void 0, function* () {
-            if (!isReplacement) {
-                item.hashes.forEach((hash) => this.hashToId.delete(hash));
-                if (this.delegateToVerifiedEncryptionDataId.get(item.exchangeData.delegate) === item.exchangeData.id) {
-                    this.delegateToVerifiedEncryptionDataId.delete(item.exchangeData.delegate);
-                }
-            }
-        });
+    evictOneEntry() {
+        const evicted = this.idToData.evictLeastRecentlyUsed();
+        evicted.hashes.forEach((hash) => this.hashToId.delete(hash));
+        if (this.delegateToVerifiedEncryptionDataId.get(evicted.exchangeData.delegate) === evicted.exchangeData.id) {
+            this.delegateToVerifiedEncryptionDataId.delete(evicted.exchangeData.delegate);
+        }
     }
-    getAccessControlKeysValue(entityType) {
+    getAccessControlKeysValue() {
         return Promise.resolve(undefined);
     }
-    getAllDelegationKeys(entityType) {
+    getAllDelegationKeys() {
         return Promise.resolve(undefined);
     }
 }