@icure/api 8.0.64 → 8.0.66

package/icc-x-api/crypto/ExtendedApisUtilsImpl.js

@@ -11,7 +11,6 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExtendedApisUtilsImpl = void 0;
 const utils_1 = require("../utils");
-const collection_utils_1 = require("../utils/collection-utils");
 const SecurityMetadataDecryptor_1 = require("./SecurityMetadataDecryptor");
 const SecureDelegation_1 = require("../../icc-api/model/SecureDelegation");
 const EntityShareRequest_1 = require("../../icc-api/model/requests/EntityShareRequest");
@@ -26,49 +25,47 @@ var AccessLevelEnum = SecureDelegation_1.SecureDelegation.AccessLevelEnum;
  * Methods to support extended apis.
  */
 class ExtendedApisUtilsImpl {
-    constructor(primitives, dataOwnerApi, legacyDelMetadataDecryptor, secDelMetadataDecryptor, secureDelegationsManager, userApi, useParentKeys) {
+    constructor(primitives, dataOwnerApi, securityMetadataDecryptor, secureDelegationsManager, userApi, useParentKeys) {
         this.primitives = primitives;
         this.dataOwnerApi = dataOwnerApi;
-        this.legacyDelMetadataDecryptor = legacyDelMetadataDecryptor;
-        this.secDelMetadataDecryptor = secDelMetadataDecryptor;
+        this.securityMetadataDecryptor = securityMetadataDecryptor;
         this.secureDelegationsManager = secureDelegationsManager;
         this.userApi = userApi;
         this.useParentKeys = useParentKeys;
-        this.allSecurityMetadataDecryptor = new SecurityMetadataDecryptor_1.SecurityMetadataDecryptorChain([legacyDelMetadataDecryptor, secDelMetadataDecryptor]);
     }
     encryptionKeysOf(entity, dataOwnerId) {
         return __awaiter(this, void 0, void 0, function* () {
-            return yield this.decryptAndMergeHierarchy(entity, dataOwnerId, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf(entityWithType, hierarchy));
+            return yield this.decryptAndMergeHierarchy(dataOwnerId, (hierarchy) => this.securityMetadataDecryptor.decryptAll(entity.entity, hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.EncryptionKey));
         });
     }
     encryptionKeysForHcpHierarchyOf(entity) {
         return __awaiter(this, void 0, void 0, function* () {
-            return this.decryptHierarchy(entity, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf(entityWithType, hierarchy));
+            return this.decryptHierarchy((hierarchy) => this.securityMetadataDecryptor.decryptAll(entity.entity, hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.EncryptionKey));
         });
     }
     secretIdsOf(entity, dataOwnerId) {
         return __awaiter(this, void 0, void 0, function* () {
-            return yield this.decryptAndMergeHierarchy(entity, dataOwnerId, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptSecretIdsOf(entityWithType, hierarchy));
+            return yield this.decryptAndMergeHierarchy(dataOwnerId, (hierarchy) => this.securityMetadataDecryptor.decryptAll(entity.entity, hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.SecretId));
         });
     }
     secretIdsForHcpHierarchyOf(entity) {
         return __awaiter(this, void 0, void 0, function* () {
-            return this.decryptHierarchy(entity, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptSecretIdsOf(entityWithType, hierarchy));
+            return this.decryptHierarchy((hierarchy) => this.securityMetadataDecryptor.decryptAll(entity.entity, hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.SecretId));
         });
     }
     owningEntityIdsOf(entity, dataOwnerId) {
         return __awaiter(this, void 0, void 0, function* () {
-            return yield this.decryptAndMergeHierarchy(entity, dataOwnerId, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptOwningEntityIdsOf(entityWithType, hierarchy));
+            return yield this.decryptAndMergeHierarchy(dataOwnerId, (hierarchy) => this.securityMetadataDecryptor.decryptAll(entity.entity, hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.OwningEntityId));
         });
     }
     owningEntityIdsForHcpHierarchyOf(entity) {
         return __awaiter(this, void 0, void 0, function* () {
-            return this.decryptHierarchy(entity, (entityWithType, hierarchy) => this.allSecurityMetadataDecryptor.decryptOwningEntityIdsOf(entityWithType, hierarchy));
+            return this.decryptHierarchy((hierarchy) => this.securityMetadataDecryptor.decryptAll(entity.entity, hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.OwningEntityId));
         });
     }
     hasWriteAccess(entity) {
         return __awaiter(this, void 0, void 0, function* () {
-            return ((yield this.allSecurityMetadataDecryptor.getEntityAccessLevel(entity, yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())) ===
+            return ((yield this.securityMetadataDecryptor.getEntityAccessLevel(entity.entity, yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())) ===
                 AccessLevel.WRITE);
         });
     }
@@ -186,7 +183,7 @@ class ExtendedApisUtilsImpl {
                     }
                 }
                 if (Object.keys(currentRequests).length > 0) {
-                    const existingDelegationMembersDetails = yield this.secDelMetadataDecryptor.getDelegationMemberDetails(entityWithType);
+                    const existingDelegationMembersDetails = yield this.securityMetadataDecryptor.getDelegationMemberDetails(entityWithType);
                     const accessibleMembers = new Set(this.useParentKeys ? yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds() : [yield this.dataOwnerApi.getCurrentDataOwnerId()]);
                     const potentialParentDelegations = Object.entries(existingDelegationMembersDetails).flatMap(([k, members]) => {
                         if ((!!members.delegate && accessibleMembers.has(members.delegate)) || (!!members.delegator && accessibleMembers.has(members.delegator))) {
@@ -251,9 +248,9 @@ class ExtendedApisUtilsImpl {
             const hierarchy = this.useParentKeys
                 ? yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()
                 : [yield this.dataOwnerApi.getCurrentDataOwnerId()];
-            const legacySecretIds = yield (0, collection_utils_1.asyncGeneratorToArray)(this.legacyDelMetadataDecryptor.decryptSecretIdsOf(entity, hierarchy));
-            const legacyEncryptionKeys = yield (0, collection_utils_1.asyncGeneratorToArray)(this.legacyDelMetadataDecryptor.decryptEncryptionKeysOf(entity, hierarchy));
-            const legacyOwningEntityIds = yield (0, collection_utils_1.asyncGeneratorToArray)(this.legacyDelMetadataDecryptor.decryptOwningEntityIdsOf(entity, hierarchy));
+            const legacySecretIds = yield this.securityMetadataDecryptor.decryptAllLegacyDelegations(entity.entity, hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.SecretId);
+            const legacyEncryptionKeys = yield this.securityMetadataDecryptor.decryptAllLegacyDelegations(entity.entity, hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.EncryptionKey);
+            const legacyOwningEntityIds = yield this.securityMetadataDecryptor.decryptAllLegacyDelegations(entity.entity, hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.OwningEntityId);
             const res = {};
             const selfId = yield this.dataOwnerApi.getCurrentDataOwnerId();
             for (const hierarchyMember of hierarchy) {
@@ -273,7 +270,7 @@ class ExtendedApisUtilsImpl {
             const subHierarchySet = new Set(subHierarchy);
             const legacyAccess = selfId === entity.entity.id && currMemberId === selfId
                 ? AccessLevel.WRITE
-                : yield this.legacyDelMetadataDecryptor.getEntityAccessLevel(entity, subHierarchy);
+                : yield this.securityMetadataDecryptor.getEntityLegacyDelegationAccessLevel(entity.entity, subHierarchy);
             if (!legacyAccess)
                 return undefined;
             const selfLegacySecretIds = legacySecretIds.filter((x) => x.dataOwnersWithAccess.some((d) => subHierarchySet.has(d))).map((x) => x.decrypted);
@@ -287,18 +284,20 @@ class ExtendedApisUtilsImpl {
             let missingEncryptionKeys = [];
             let missingOwningEntityIds = [];
             if (selfLegacySecretIds.length > 0) {
-                const currentSecretIds = new Set((yield (0, collection_utils_1.asyncGeneratorToArray)(this.secDelMetadataDecryptor.decryptSecretIdsOf(entity, [currMemberId]))).map((x) => x.decrypted));
+                const currentSecretIds = new Set((yield this.securityMetadataDecryptor.decryptAllSecureDelegations(entity.entity, [currMemberId], SecurityMetadataDecryptor_1.SecurityMetadataType.SecretId)).map((x) => x.decrypted));
                 missingSecretIds = selfLegacySecretIds.filter((x) => !currentSecretIds.has(x));
             }
             if (selfLegacyEncryptionKeys.length > 0) {
-                const currentEncryptionKeys = new Set((yield (0, collection_utils_1.asyncGeneratorToArray)(this.secDelMetadataDecryptor.decryptEncryptionKeysOf(entity, [currMemberId]))).map((x) => x.decrypted));
+                const currentEncryptionKeys = new Set((yield this.securityMetadataDecryptor.decryptAllSecureDelegations(entity.entity, [currMemberId], SecurityMetadataDecryptor_1.SecurityMetadataType.EncryptionKey)).map((x) => x.decrypted));
                 missingEncryptionKeys = selfLegacyEncryptionKeys.filter((x) => !currentEncryptionKeys.has(x));
             }
             if (selfLegacyOwningEntityIds.length > 0) {
-                const currentOwningEntityIds = new Set((yield (0, collection_utils_1.asyncGeneratorToArray)(this.secDelMetadataDecryptor.decryptOwningEntityIdsOf(entity, [currMemberId]))).map((x) => x.decrypted));
+                const currentOwningEntityIds = new Set((yield this.securityMetadataDecryptor.decryptAllSecureDelegations(entity.entity, [currMemberId], SecurityMetadataDecryptor_1.SecurityMetadataType.OwningEntityId)).map((x) => x.decrypted));
                 missingOwningEntityIds = selfLegacyOwningEntityIds.filter((x) => !currentOwningEntityIds.has(x));
             }
-            const mustCreateRootDelegation = selfId === entity.entity.id && currMemberId === selfId && !(yield this.secDelMetadataDecryptor.getEntityAccessLevel(entity, subHierarchy));
+            const mustCreateRootDelegation = selfId === entity.entity.id &&
+                currMemberId === selfId &&
+                !(yield this.securityMetadataDecryptor.getEntitySecureDelegationAccessLevel(entity.entity, subHierarchy));
             if (missingSecretIds.length > 0 || missingEncryptionKeys.length > 0 || missingOwningEntityIds.length > 0 || mustCreateRootDelegation) {
                 let requestedPermissions;
                 if (currMemberId === selfId) {
@@ -315,27 +314,29 @@ class ExtendedApisUtilsImpl {
     }
     tryDecryptDataOf(entity, content, validator) {
         return __awaiter(this, void 0, void 0, function* () {
-            const dataOwnerIds = this.useParentKeys
-                ? yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()
-                : [yield this.dataOwnerApi.getCurrentDataOwnerId()];
-            const decryptedKeys = this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf(entity, dataOwnerIds);
             const triedKeys = new Set();
-            let latest = yield decryptedKeys.next();
-            while (!latest.done) {
-                if (!triedKeys.has(latest.value.decrypted)) {
-                    triedKeys.add(latest.value.decrypted);
-                    try {
-                        const decrypted = yield this.primitives.AES.decryptWithRawKey(latest.value.decrypted, content);
-                        if (!validator || (yield validator(decrypted)))
-                            return { data: decrypted, wasDecrypted: true };
-                    }
-                    catch (e) {
-                        console.warn(`Error while decrypting with raw key ${latest.value}: ${e}`);
+            const result = yield this.doIncrementallyDecryptingKeys(entity.entity, entity.type, (e, t, keys) => __awaiter(this, void 0, void 0, function* () {
+                for (const k of keys) {
+                    if (!triedKeys.has(k.raw)) {
+                        triedKeys.add(k.raw);
+                        try {
+                            const decrypted = yield this.primitives.AES.decrypt(k.key, content);
+                            if (!validator || (yield validator(decrypted)))
+                                return { success: decrypted };
+                        }
+                        catch (e) {
+                            console.warn(`Error while attempting to decrypt attachment of ${entity.entity.id} with raw key ${k.raw}: ${e}`);
+                        }
                     }
                 }
-                latest = yield decryptedKeys.next();
+                return null;
+            }));
+            if (result != null) {
+                return { data: result.success, wasDecrypted: true };
+            }
+            else {
+                return { data: content, wasDecrypted: false };
             }
-            return { data: content, wasDecrypted: false };
         });
     }
     encryptDataOf(entity, type, content, saveEntity) {
@@ -345,89 +346,131 @@ class ExtendedApisUtilsImpl {
             if (!!ensureInitialisedKeysResult) {
                 updatedEntity = yield saveEntity(ensureInitialisedKeysResult);
             }
-            const dataOwnerIds = this.useParentKeys
-                ? yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()
-                : [yield this.dataOwnerApi.getCurrentDataOwnerId()];
-            const decryptedKeys = this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf({ entity: updatedEntity !== null && updatedEntity !== void 0 ? updatedEntity : entity, type }, dataOwnerIds);
-            let latest = yield decryptedKeys.next();
-            while (!latest.done) {
-                try {
-                    return { encryptedData: yield this.primitives.AES.encryptWithRawKey(latest.value.decrypted, content), updatedEntity: updatedEntity };
-                }
-                catch (e) {
-                    console.warn(`Error while encrypting with raw key ${latest.value}: ${e}`);
+            const encrypted = yield this.doIncrementallyDecryptingKeys(entity, type, (e, t, keys) => __awaiter(this, void 0, void 0, function* () {
+                for (const k of keys) {
+                    try {
+                        return {
+                            success: {
+                                encryptedData: yield this.primitives.AES.encrypt(k.key, content),
+                                updatedEntity: updatedEntity,
+                            },
+                        };
+                    }
+                    catch (e) {
+                        console.warn(`Error while encrypting with raw key ${k.raw}: ${e}`);
+                    }
                 }
-                latest = yield decryptedKeys.next();
-            }
+                return null;
+            }));
+            if (encrypted != null)
+                return encrypted.success;
             throw new Error(`Could not extract any valid encryption keys for entity ${JSON.stringify(entity)}.`);
         });
     }
-    decryptEntity(entity, entityType, constructor) {
+    tryDecryptEntities(entities, entityType, constructor) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            if (!entity.encryptedSelf)
-                return { entity, decrypted: true };
-            const encryptionKeys = yield this.decryptAndImportAllDecryptionKeys({ entity: entity, type: entityType });
-            if (!encryptionKeys.length)
-                return { entity, decrypted: false };
-            return {
-                entity: constructor(yield (0, utils_1.decryptObject)(entity, (encrypted) => __awaiter(this, void 0, void 0, function* () {
-                    var _a;
-                    return (_a = (yield this.tryDecryptJson(encryptionKeys, encrypted, false))) !== null && _a !== void 0 ? _a : {};
-                }))),
-                decrypted: true,
-            };
+            const nothingToDecryptResults = new Map();
+            for (const entity of entities) {
+                const nothingToDecrypt = yield (0, utils_1.decryptObject)(entity, (encrypted) => __awaiter(this, void 0, void 0, function* () {
+                    return null;
+                }));
+                if (nothingToDecrypt != null) {
+                    nothingToDecryptResults.set(entity.id, constructor(nothingToDecrypt));
+                }
+            }
+            const actuallyDecryptedResults = yield this.doManyIncrementallyDecryptingKeys(entities.filter((e) => !nothingToDecryptResults.has(e.id)), entityType, (entity, t, keys) => __awaiter(this, void 0, void 0, function* () {
+                // The decrypt object will try all keys on each of the sub-objects; this is intentional because even though it
+                // shouldn't happen, but it is still possible that some entity could be accidentally merged badly and the merged
+                // entity has multiple encryptedSelf (on different sub-entities) that use different keys.
+                const decrypted = yield (0, utils_1.decryptObject)(entity, (encrypted) => this.tryDecryptJson(keys, encrypted, false));
+                if (decrypted != null) {
+                    return { success: constructor(decrypted) };
+                }
+                else {
+                    return null;
+                }
+            }));
+            const res = [];
+            for (const entity of entities) {
+                const decrypted = (_a = actuallyDecryptedResults.get(entity.id)) !== null && _a !== void 0 ? _a : nothingToDecryptResults.get(entity.id);
+                if (!decrypted) {
+                    res.push({ entity: entity, decrypted: false });
+                }
+                else {
+                    res.push({ entity: decrypted, decrypted: true });
+                }
+            }
+            return res;
         });
     }
     tryDecryptJson(potentialKeys, encrypted, truncateTrailingDecryptedNulls) {
-        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             for (const key of potentialKeys) {
                 try {
-                    const decrypted = (_a = (yield this.primitives.AES.decrypt(key.key, encrypted, key.raw))) !== null && _a !== void 0 ? _a : encrypted;
+                    const decrypted = yield this.primitives.AES.decrypt(key.key, encrypted, key.raw);
                     return JSON.parse((0, utils_1.ua2utf8)(truncateTrailingDecryptedNulls ? (0, utils_1.truncateTrailingNulls)(new Uint8Array(decrypted)) : decrypted));
                 }
                 catch (e) { }
             }
-            return undefined;
+            return null;
         });
     }
-    tryEncryptEntity(entity, entityType, fieldsToEncrypt, encodeBinaryData, requireEncryption, constructor) {
+    tryEncryptEntities(entities, entityType, fieldsToEncrypt, encodeBinaryData, requireEncryption, constructor) {
+        var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            const entityWithInitialisedEncryptionKeys = yield this.ensureEncryptionKeysInitialised(entity, entityType);
-            const updatedEntity = entityWithInitialisedEncryptionKeys ? entityWithInitialisedEncryptionKeys : entity;
-            const encryptionKey = yield this.tryImportFirstValidKey({ entity, type: entityType });
-            if (!!encryptionKey) {
-                return constructor(yield (0, utils_1.encryptObject)(updatedEntity, (obj) => {
-                    // TODO should encoding of binary data should probably be applied to everything?
-                    const json = encodeBinaryData
-                        ? JSON.stringify(obj, (k, v) => {
-                            return v instanceof ArrayBuffer || ArrayBuffer.isView(v)
-                                ? (0, utils_1.b2a)(new Uint8Array(v).reduce((d, b) => d + String.fromCharCode(b), ''))
-                                : v;
-                        })
-                        : JSON.stringify(obj);
-                    return this.primitives.AES.encrypt(encryptionKey.key, (0, utils_1.utf8_2ua)(json), encryptionKey.raw);
-                }, fieldsToEncrypt, entityType));
+            const entitiesWithInitialisedEncryptionKeys = [];
+            for (const entity of entities) {
+                entitiesWithInitialisedEncryptionKeys.push((_a = (yield this.ensureEncryptionKeysInitialised(entity, entityType))) !== null && _a !== void 0 ? _a : entity);
             }
-            else if (requireEncryption) {
-                throw new Error(`No key found for encryption of entity ${entity}`);
-            }
-            else {
-                yield (0, utils_1.encryptObject)(entity, (obj) => __awaiter(this, void 0, void 0, function* () {
-                    const hasNonEmptyValues = Object.values(obj).some((v) => v !== undefined && (typeof v !== 'object' || (Array.isArray(v) && v.length > 0) || Object.keys(v).length > 0));
-                    if (hasNonEmptyValues) {
-                        throw new Error(`Impossible to modify encrypted content of an entity if no encryption key is known.\nEntity: ${JSON.stringify(entity)}\nTo encrypt: ${JSON.stringify(obj)}`);
+            const results = yield this.doManyIncrementallyDecryptingKeys(entitiesWithInitialisedEncryptionKeys, entityType, (e, t, keys) => __awaiter(this, void 0, void 0, function* () {
+                for (const k of keys) {
+                    try {
+                        const encrypted = yield (0, utils_1.encryptObject)(e, (obj) => {
+                            // TODO encoding of binary data should probably be applied to everything?
+                            const json = encodeBinaryData
+                                ? JSON.stringify(obj, (k, v) => {
+                                    return v instanceof ArrayBuffer || ArrayBuffer.isView(v)
+                                        ? (0, utils_1.b2a)(new Uint8Array(v).reduce((d, b) => d + String.fromCharCode(b), ''))
+                                        : v;
+                                })
+                                : JSON.stringify(obj);
+                            return this.primitives.AES.encrypt(k.key, (0, utils_1.utf8_2ua)(json), k.raw);
+                        }, fieldsToEncrypt, entityType);
+                        return { success: constructor(encrypted) };
                     }
-                    return Promise.resolve(new ArrayBuffer(1));
-                }), fieldsToEncrypt, 'entity');
-                return entity;
+                    catch (e) {
+                        console.warn(`Error while encrypting with raw key ${k.raw}: ${e}`);
+                    }
+                }
+                return null;
+            }));
+            if (results.size != entitiesWithInitialisedEncryptionKeys.length) {
+                if (requireEncryption) {
+                    throw new Error(`Could not encrypt entities ${entitiesWithInitialisedEncryptionKeys.flatMap((e) => (results.has(e.id) ? [] : [e.id]))}`);
+                }
+                else {
+                    for (const e of entitiesWithInitialisedEncryptionKeys) {
+                        if (!results.has(e.id)) {
+                            yield (0, utils_1.encryptObject)(e, (obj) => __awaiter(this, void 0, void 0, function* () {
+                                const hasNonEmptyValues = Object.values(obj).some((v) => v !== undefined && (typeof v !== 'object' || (Array.isArray(v) && v.length > 0) || Object.keys(v).length > 0));
+                                if (hasNonEmptyValues) {
+                                    throw new Error(`Impossible to modify encrypted content of an entity if no encryption key is known.\nEntity: ${JSON.stringify(e)}\nTo encrypt: ${JSON.stringify(obj)}`);
+                                }
+                                return Promise.resolve(new ArrayBuffer(1));
+                            }), fieldsToEncrypt, 'entity');
+                            results.set(e.id, e);
+                        }
+                    }
+                }
             }
+            return entitiesWithInitialisedEncryptionKeys.map((e) => results.get(e.id));
         });
     }
     ensureEncryptionKeysInitialised(entity, entityType) {
         var _a, _b, _c;
         return __awaiter(this, void 0, void 0, function* () {
-            if (this.allSecurityMetadataDecryptor.hasAnyEncryptionKeys(entity))
+            if (this.securityMetadataDecryptor.hasAnyEncryptionKeys(entity))
                 return undefined;
             if (!entity.rev) {
                 throw new Error('New encrypted entity is lacking encryption metadata. ' +
@@ -445,27 +488,24 @@ class ExtendedApisUtilsImpl {
             return yield this.secureDelegationsManager.entityWithInitialisedEncryptedMetadata(Object.assign(Object.assign({}, entity), { secretForeignKeys: (_c = entity.secretForeignKeys) !== null && _c !== void 0 ? _c : [] }), entityType, [], [], [yield this.primitives.AES.generateCryptoKey(true)], usersWithAccessToNewKey);
         });
     }
-    decryptHierarchy(entity, decryptedDataGeneratorProvider) {
+    decryptHierarchy(decryptedDataProvider) {
         return __awaiter(this, void 0, void 0, function* () {
             const canDecryptOwnerIds = this.useParentKeys
                 ? yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()
                 : [yield this.dataOwnerApi.getCurrentDataOwnerId()];
-            const decryptedData = yield (0, collection_utils_1.asyncGeneratorToArray)(decryptedDataGeneratorProvider(entity, canDecryptOwnerIds));
-            return canDecryptOwnerIds.map((ownerId) => {
-                const extracted = this.deduplicate(decryptedData.filter((x) => x.dataOwnersWithAccess.some((o) => o === ownerId)).map((x) => x.decrypted));
-                return { ownerId, extracted };
-            });
+            return yield decryptedDataProvider(canDecryptOwnerIds);
         });
     }
-    decryptAndMergeHierarchy(entity, dataOwnerId, decryptedDataGeneratorProvider) {
+    decryptAndMergeHierarchy(dataOwnerId, decryptedDataProvider) {
         return __awaiter(this, void 0, void 0, function* () {
             const hierarchy = this.useParentKeys
                 ? dataOwnerId
                     ? yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIdsFrom(dataOwnerId)
                     : yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()
                 : [dataOwnerId !== null && dataOwnerId !== void 0 ? dataOwnerId : (yield this.dataOwnerApi.getCurrentDataOwnerId())];
-            const decryptedData = yield (0, collection_utils_1.asyncGeneratorToArray)(decryptedDataGeneratorProvider(entity, hierarchy));
-            return this.deduplicate(decryptedData.map((x) => x.decrypted));
+            const decryptedData = yield decryptedDataProvider(hierarchy);
+            const merged = decryptedData.flatMap((x) => x.extracted);
+            return this.deduplicate(merged);
         });
     }
     tryImportKey(key) {
@@ -481,42 +521,81 @@ class ExtendedApisUtilsImpl {
             }
         });
     }
-    decryptAndImportAllDecryptionKeys(entity) {
+    doIncrementallyDecryptingKeys(entity, entityType, action) {
         return __awaiter(this, void 0, void 0, function* () {
-            const keys = this.allSecurityMetadataDecryptor.hasAnyEncryptionKeys(entity.entity)
-                ? yield this.encryptionKeysOf(entity)
-                : this.deduplicate(yield (0, collection_utils_1.asyncGeneratorToArray)(this.legacyDelMetadataDecryptor.decryptSecretIdsOf(entity, yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())).then((secretIdsInfo) => secretIdsInfo.map(({ decrypted }) => decrypted)));
-            const res = [];
-            for (const key of keys) {
-                const imported = yield this.tryImportKey(key);
-                if (imported)
-                    res.push({ key: imported, raw: key });
+            const res = yield this.doManyIncrementallyDecryptingKeys([entity], entityType, (e, t, ks) => action(e, t, ks));
+            if (res.has(entity.id)) {
+                return { success: res.get(entity.id) };
+            }
+            else {
+                return null;
             }
-            return res;
-        });
-    }
-    decryptAndImportAnyEncryptionKey(entity) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const res = yield this.tryImportFirstValidKey(entity);
-            if (!res)
-                throw new Error(`Could not find any valid key for entity ${entity.entity.id} (${entity.type}).`);
-            return res;
         });
     }
-    tryImportFirstValidKey(entity) {
+    doManyIncrementallyDecryptingKeys(entities, entitiesType, action) {
         return __awaiter(this, void 0, void 0, function* () {
-            const dataOwnerIds = this.useParentKeys
-                ? yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds()
-                : [yield this.dataOwnerApi.getCurrentDataOwnerId()];
-            const generator = this.allSecurityMetadataDecryptor.decryptEncryptionKeysOf(entity, dataOwnerIds);
-            let latest = yield generator.next();
-            while (!latest.done) {
-                const imported = yield this.tryImportKey(latest.value.decrypted);
-                if (imported)
-                    return { key: imported, raw: latest.value.decrypted };
-                latest = yield generator.next();
+            if (entities.length == 0)
+                return new Map();
+            if (new Set(entities.map((e) => e.id)).size != entities.length) {
+                throw new Error(`Duplicate entries in entities ${entities.map((x) => x.id)}`);
+            }
+            const hierarchy = yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds();
+            const allExtractedKeysForEntities = Object.fromEntries(entities.map((x) => [x.id, new Set()]));
+            const newlyExtractedKeysForEntities = Object.fromEntries(entities.map((x) => [x.id, new Set()]));
+            const results = new Map();
+            const remainingEntitiesById = Object.fromEntries(entities.map((x) => [x.id, x]));
+            const importedKeysByRaw = new Map();
+            const primitives = this.primitives;
+            function updateExtractedKeysAndDoActionIfNecessary(newKeys, forceUpdateOnEntitiesWithNewExtractedKeys) {
+                return __awaiter(this, void 0, void 0, function* () {
+                    for (const [entityId, keys] of Object.entries(newKeys)) {
+                        const newlyExtractedSet = newlyExtractedKeysForEntities[entityId];
+                        const alreadyExtractedSet = allExtractedKeysForEntities[entityId];
+                        for (const k of keys) {
+                            if (!alreadyExtractedSet.has(k)) {
+                                newlyExtractedSet.add(k);
+                                if (!importedKeysByRaw.has(k)) {
+                                    importedKeysByRaw.set(k, yield primitives.AES.importKey('raw', (0, utils_1.hex2ua)(k)));
+                                }
+                            }
+                        }
+                    }
+                    if (forceUpdateOnEntitiesWithNewExtractedKeys ||
+                        Object.keys(remainingEntitiesById).every((eId) => newlyExtractedKeysForEntities[eId].size > 0)) {
+                        for (const entity of Object.values(remainingEntitiesById)) {
+                            const currId = entity.id;
+                            const currNewlyExtracted = newlyExtractedKeysForEntities[currId];
+                            if (currNewlyExtracted.size > 0) {
+                                const currAllExtracted = allExtractedKeysForEntities[currId];
+                                currNewlyExtracted.forEach((k) => currAllExtracted.add(k));
+                                currNewlyExtracted.clear();
+                                const actionResult = yield action(entity, entitiesType, [...currAllExtracted].map((raw) => ({
+                                    raw: raw,
+                                    key: importedKeysByRaw.get(raw),
+                                })));
+                                if (actionResult != null) {
+                                    delete remainingEntitiesById[currId];
+                                    results.set(currId, actionResult.success);
+                                }
+                            }
+                        }
+                    }
+                });
             }
-            return undefined;
+            yield updateExtractedKeysAndDoActionIfNecessary(yield this.securityMetadataDecryptor.decryptLegacyDelegations(Object.values(remainingEntitiesById), hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.EncryptionKey), false);
+            if (Object.keys(remainingEntitiesById).length == 0)
+                return results;
+            yield updateExtractedKeysAndDoActionIfNecessary(yield this.securityMetadataDecryptor.decryptSecureDelegationsUsingCache(Object.values(remainingEntitiesById), hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.EncryptionKey), false);
+            if (Object.keys(remainingEntitiesById).length == 0)
+                return results;
+            yield updateExtractedKeysAndDoActionIfNecessary(yield this.securityMetadataDecryptor.decryptSecureDelegationsUsingKnownExchangeData(Object.values(remainingEntitiesById), hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.EncryptionKey), false);
+            if (Object.keys(remainingEntitiesById).length == 0)
+                return results;
+            yield updateExtractedKeysAndDoActionIfNecessary(yield this.securityMetadataDecryptor.decryptSecureDelegationsUsingExchangeDataMap(Object.values(remainingEntitiesById), hierarchy, SecurityMetadataDecryptor_1.SecurityMetadataType.EncryptionKey), false);
+            if (Object.keys(remainingEntitiesById).length == 0)
+                return results;
+            yield updateExtractedKeysAndDoActionIfNecessary({}, true);
+            return results;
         });
     }
     deduplicate(values) {