@absolutejs/auth 0.55.8 → 0.55.9

package/dist/compliance/cipher.d.ts

@@ -1,5 +1,11 @@
 export type SecretCipher = {
     decrypt: (ciphertext: string) => Promise<string>;
     encrypt: (plaintext: string) => Promise<string>;
+    needsReencryption?: (ciphertext: string) => boolean;
 };
 export declare const createSecretCipher: (keyMaterial: string) => SecretCipher;
+export declare const createVersionedSecretCipher: ({ currentVersion, keys, legacyKey }: {
+    currentVersion: number;
+    keys: Readonly<Record<number, string>>;
+    legacyKey?: string;
+}) => SecretCipher;

package/dist/index.js

@@ -12214,6 +12214,44 @@ var createSecretCipher = (keyMaterial) => ({
   decrypt: (ciphertext) => decryptSecret(ciphertext, keyMaterial),
   encrypt: (plaintext) => encryptSecret(plaintext, keyMaterial)
 });
+var VERSIONED_CIPHERTEXT_PREFIX = "absolute-vault";
+var VERSIONED_CIPHERTEXT_SEGMENTS = 3;
+var parseVersionedCiphertext = (value) => {
+  const [prefix, encodedVersion, ciphertext] = value.split(":", VERSIONED_CIPHERTEXT_SEGMENTS);
+  if (prefix !== VERSIONED_CIPHERTEXT_PREFIX || !encodedVersion || !ciphertext)
+    return null;
+  const version = Number(encodedVersion);
+  if (!Number.isSafeInteger(version) || version < 1)
+    return null;
+  return { ciphertext, version };
+};
+var createVersionedSecretCipher = ({
+  currentVersion,
+  keys,
+  legacyKey
+}) => {
+  if (!Number.isSafeInteger(currentVersion) || currentVersion < 1)
+    throw new Error("Vault key version must be a positive integer");
+  const currentKey = keys[currentVersion];
+  if (!currentKey)
+    throw new Error(`Vault key version ${currentVersion} is unavailable`);
+  return {
+    decrypt: async (value) => {
+      const envelope = parseVersionedCiphertext(value);
+      if (!envelope) {
+        if (!legacyKey)
+          throw new Error("Legacy vault ciphertext key is unavailable");
+        return decryptSecret(value, legacyKey);
+      }
+      const key = keys[envelope.version];
+      if (!key)
+        throw new Error(`Vault key version ${envelope.version} is unavailable`);
+      return decryptSecret(envelope.ciphertext, key);
+    },
+    encrypt: async (plaintext) => `${VERSIONED_CIPHERTEXT_PREFIX}:${currentVersion}:${await encryptSecret(plaintext, currentKey)}`,
+    needsReencryption: (value) => parseVersionedCiphertext(value)?.version !== currentVersion
+  };
+};
 
 // src/vault/config.ts
 var createVault = ({
@@ -12225,7 +12263,15 @@ var createVault = ({
     const entry = await store.getEntry(ownerId, name);
     if (entry === undefined)
       return;
-    return cipher.decrypt(entry.encryptedValue);
+    const plaintext = await cipher.decrypt(entry.encryptedValue);
+    if (cipher.needsReencryption?.(entry.encryptedValue)) {
+      await store.saveEntry({
+        ...entry,
+        encryptedValue: await cipher.encrypt(plaintext),
+        updatedAt: Date.now()
+      });
+    }
+    return plaintext;
   },
   list: async (ownerId) => (await store.listEntries(ownerId)).map((entry) => entry.name),
   put: async (ownerId, name, value) => {
@@ -12249,11 +12295,12 @@ var rotateVaultKey = async ({
   const newCipher = createSecretCipher(newKey);
   const entries = await store.listAllEntries();
   const now = Date.now();
-  for (const entry of entries) {
+  await entries.reduce(async (pending, entry) => {
+    await pending;
     const plaintext = await oldCipher.decrypt(entry.encryptedValue);
     const encryptedValue = await newCipher.encrypt(plaintext);
     await store.saveEntry({ ...entry, encryptedValue, updatedAt: now });
-  }
+  }, Promise.resolve());
   return { rotated: entries.length };
 };
 // src/vault/inMemoryVaultStore.ts
@@ -30084,5 +30131,5 @@ export {
   AGENT_CLAIM_GRANT_TYPE
 };
 
-//# debugId=DCA509B790E265BD64756E2164756E21
+//# debugId=A4FF719AF12981EA64756E2164756E21
 //# sourceMappingURL=index.js.map