@azure/cosmos 4.3.0 → 4.4.0

package/dist/commonjs/encryption/EncryptionKeyWrapMetadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionKeyWrapMetadata.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptionKeyWrapMetadata.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1F;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,qCAAqC;IACrC,IAAI,EAAE,yBAAyB,CAAC;IAChC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,SAAS,EAAE,sBAAsB,CAAC;CACnC"}

package/dist/commonjs/encryption/EncryptionKeyWrapMetadata.js

@@ -0,0 +1,5 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=EncryptionKeyWrapMetadata.js.map

package/dist/commonjs/encryption/EncryptionKeyWrapMetadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionKeyWrapMetadata.js","sourceRoot":"","sources":["../../../src/encryption/EncryptionKeyWrapMetadata.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { EncryptionKeyResolverName, KeyEncryptionAlgorithm } from \"./enums/index.js\";\n\n/**\n * Metadata used to wrap/unwrap data encryption key using a customer managed key\n */\nexport interface EncryptionKeyWrapMetadata {\n  /** Identifier of the key resolver */\n  type: EncryptionKeyResolverName;\n  /** Identifier of customer managed key */\n  name: string;\n  /** Path to customer managed key. */\n  value: string;\n  /** Algorithm to be used for wrapping/unwrapping the data encryption key */\n  algorithm: KeyEncryptionAlgorithm;\n}\n"]}

package/dist/commonjs/encryption/EncryptionManager.d.ts

@@ -0,0 +1,24 @@
+import { ProtectedDataEncryptionKeyCache } from "./Cache/ProtectedDataEncryptionKeyCache.js";
+import { KeyEncryptionKeyCache } from "./Cache/KeyEncryptionKeyCache.js";
+import { EncryptionSettingsCache } from "./Cache/EncryptionSettingsCache.js";
+import { ClientEncryptionKeyPropertiesCache } from "./Cache/ClientEncryptionKeyPropertiesCache.js";
+import { EncryptionKeyStoreProvider } from "./EncryptionKeyStoreProvider.js";
+import type { EncryptionKeyResolver } from "./EncryptionKeyResolver/index.js";
+/**
+ * Cache manager for encryption related caches.
+ * @hidden
+ */
+export declare class EncryptionManager {
+    cacheTimeToLive: number;
+    encryptionKeyStoreProvider: EncryptionKeyStoreProvider;
+    protectedDataEncryptionKeyCache: ProtectedDataEncryptionKeyCache;
+    keyEncryptionKeyCache: KeyEncryptionKeyCache;
+    encryptionSettingsCache: EncryptionSettingsCache;
+    clientEncryptionKeyPropertiesCache: ClientEncryptionKeyPropertiesCache;
+    constructor(encryptionKeyResolver: EncryptionKeyResolver, cacheTimeToLive?: number);
+    /**
+     * Converts the EncryptionTimeToLive instance to a number (milliseconds).
+     */
+    private getCacheTTlInMs;
+}
+//# sourceMappingURL=EncryptionManager.d.ts.map

package/dist/commonjs/encryption/EncryptionManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionManager.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptionManager.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,+BAA+B,EAAE,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,kCAAkC,EAAE,MAAM,+CAA+C,CAAC;AACnG,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAE7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAC9E;;;GAGG;AACH,qBAAa,iBAAiB;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,0BAA0B,EAAE,0BAA0B,CAAC;IACvD,+BAA+B,EAAE,+BAA+B,CAAC;IACjE,qBAAqB,EAAE,qBAAqB,CAAC;IAC7C,uBAAuB,EAAE,uBAAuB,CAAC;IACjD,kCAAkC,EAAE,kCAAkC,CAAC;gBAElE,qBAAqB,EAAE,qBAAqB,EAAE,eAAe,CAAC,EAAE,MAAM;IAgBlF;;OAEG;IACH,OAAO,CAAC,eAAe;CAIxB"}

package/dist/commonjs/encryption/EncryptionManager.js

@@ -0,0 +1,38 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionManager = void 0;
+const ProtectedDataEncryptionKeyCache_js_1 = require("./Cache/ProtectedDataEncryptionKeyCache.js");
+const KeyEncryptionKeyCache_js_1 = require("./Cache/KeyEncryptionKeyCache.js");
+const EncryptionSettingsCache_js_1 = require("./Cache/EncryptionSettingsCache.js");
+const ClientEncryptionKeyPropertiesCache_js_1 = require("./Cache/ClientEncryptionKeyPropertiesCache.js");
+const EncryptionKeyStoreProvider_js_1 = require("./EncryptionKeyStoreProvider.js");
+const constants_js_1 = require("../common/constants.js");
+/**
+ * Cache manager for encryption related caches.
+ * @hidden
+ */
+class EncryptionManager {
+    constructor(encryptionKeyResolver, cacheTimeToLive) {
+        this.cacheTimeToLive =
+            cacheTimeToLive !== undefined
+                ? cacheTimeToLive
+                : constants_js_1.Constants.DefaultEncryptionCacheTimeToLiveInSeconds;
+        const cacheTtlInMs = this.getCacheTTlInMs();
+        this.encryptionKeyStoreProvider = new EncryptionKeyStoreProvider_js_1.EncryptionKeyStoreProvider(encryptionKeyResolver, cacheTtlInMs);
+        this.protectedDataEncryptionKeyCache = new ProtectedDataEncryptionKeyCache_js_1.ProtectedDataEncryptionKeyCache(cacheTtlInMs);
+        this.keyEncryptionKeyCache = new KeyEncryptionKeyCache_js_1.KeyEncryptionKeyCache();
+        this.encryptionSettingsCache = new EncryptionSettingsCache_js_1.EncryptionSettingsCache();
+        this.clientEncryptionKeyPropertiesCache = new ClientEncryptionKeyPropertiesCache_js_1.ClientEncryptionKeyPropertiesCache();
+    }
+    /**
+     * Converts the EncryptionTimeToLive instance to a number (milliseconds).
+     */
+    getCacheTTlInMs() {
+        const millisecondsPerSecond = 1000;
+        return Number(this.cacheTimeToLive * millisecondsPerSecond);
+    }
+}
+exports.EncryptionManager = EncryptionManager;
+//# sourceMappingURL=EncryptionManager.js.map

package/dist/commonjs/encryption/EncryptionManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionManager.js","sourceRoot":"","sources":["../../../src/encryption/EncryptionManager.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAElC,mGAA6F;AAC7F,+EAAyE;AACzE,mFAA6E;AAC7E,yGAAmG;AACnG,mFAA6E;AAC7E,yDAAmD;AAEnD;;;GAGG;AACH,MAAa,iBAAiB;IAQ5B,YAAY,qBAA4C,EAAE,eAAwB;QAChF,IAAI,CAAC,eAAe;YAClB,eAAe,KAAK,SAAS;gBAC3B,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,wBAAS,CAAC,yCAAyC,CAAC;QAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC5C,IAAI,CAAC,0BAA0B,GAAG,IAAI,0DAA0B,CAC9D,qBAAqB,EACrB,YAAY,CACb,CAAC;QACF,IAAI,CAAC,+BAA+B,GAAG,IAAI,oEAA+B,CAAC,YAAY,CAAC,CAAC;QACzF,IAAI,CAAC,qBAAqB,GAAG,IAAI,gDAAqB,EAAE,CAAC;QACzD,IAAI,CAAC,uBAAuB,GAAG,IAAI,oDAAuB,EAAE,CAAC;QAC7D,IAAI,CAAC,kCAAkC,GAAG,IAAI,0EAAkC,EAAE,CAAC;IACrF,CAAC;IAED;;OAEG;IACK,eAAe;QACrB,MAAM,qBAAqB,GAAG,IAAI,CAAC;QACnC,OAAO,MAAM,CAAC,IAAI,CAAC,eAAe,GAAG,qBAAqB,CAAC,CAAC;IAC9D,CAAC;CACF;AA/BD,8CA+BC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport { ProtectedDataEncryptionKeyCache } from \"./Cache/ProtectedDataEncryptionKeyCache.js\";\nimport { KeyEncryptionKeyCache } from \"./Cache/KeyEncryptionKeyCache.js\";\nimport { EncryptionSettingsCache } from \"./Cache/EncryptionSettingsCache.js\";\nimport { ClientEncryptionKeyPropertiesCache } from \"./Cache/ClientEncryptionKeyPropertiesCache.js\";\nimport { EncryptionKeyStoreProvider } from \"./EncryptionKeyStoreProvider.js\";\nimport { Constants } from \"../common/constants.js\";\nimport type { EncryptionKeyResolver } from \"./EncryptionKeyResolver/index.js\";\n/**\n * Cache manager for encryption related caches.\n * @hidden\n */\nexport class EncryptionManager {\n  public cacheTimeToLive: number;\n  public encryptionKeyStoreProvider: EncryptionKeyStoreProvider;\n  public protectedDataEncryptionKeyCache: ProtectedDataEncryptionKeyCache;\n  public keyEncryptionKeyCache: KeyEncryptionKeyCache;\n  public encryptionSettingsCache: EncryptionSettingsCache;\n  public clientEncryptionKeyPropertiesCache: ClientEncryptionKeyPropertiesCache;\n\n  constructor(encryptionKeyResolver: EncryptionKeyResolver, cacheTimeToLive?: number) {\n    this.cacheTimeToLive =\n      cacheTimeToLive !== undefined\n        ? cacheTimeToLive\n        : Constants.DefaultEncryptionCacheTimeToLiveInSeconds;\n    const cacheTtlInMs = this.getCacheTTlInMs();\n    this.encryptionKeyStoreProvider = new EncryptionKeyStoreProvider(\n      encryptionKeyResolver,\n      cacheTtlInMs,\n    );\n    this.protectedDataEncryptionKeyCache = new ProtectedDataEncryptionKeyCache(cacheTtlInMs);\n    this.keyEncryptionKeyCache = new KeyEncryptionKeyCache();\n    this.encryptionSettingsCache = new EncryptionSettingsCache();\n    this.clientEncryptionKeyPropertiesCache = new ClientEncryptionKeyPropertiesCache();\n  }\n\n  /**\n   * Converts the EncryptionTimeToLive instance to a number (milliseconds).\n   */\n  private getCacheTTlInMs(): number {\n    const millisecondsPerSecond = 1000;\n    return Number(this.cacheTimeToLive * millisecondsPerSecond);\n  }\n}\n"]}

package/dist/commonjs/encryption/EncryptionProcessor.d.ts

@@ -0,0 +1,40 @@
+import type { EncryptionSettings } from "./EncryptionSettings.js";
+import type { Database, ItemDefinition } from "../client/index.js";
+import type { PartitionKeyInternal } from "../documents/index.js";
+import type { TypeMarker } from "./enums/TypeMarker.js";
+import type { ClientContext } from "../ClientContext.js";
+import type { EncryptionManager } from "./EncryptionManager.js";
+import type { JSONValue } from "../queryExecutionContext/index.js";
+export declare class EncryptionProcessor {
+    private readonly containerId;
+    containerRid: string;
+    private readonly database;
+    private readonly clientContext;
+    private encryptionManager;
+    constructor(containerId: string, containerRid: string, database: Database, clientContext: ClientContext, encryptionManager: EncryptionManager);
+    encrypt<T extends ItemDefinition>(body: T): Promise<{
+        body: T;
+        propertiesEncryptedCount: number;
+    }>;
+    isPathEncrypted(path: string): Promise<boolean>;
+    encryptProperty(path: string, value: JSONValue): Promise<any>;
+    getEncryptedPartitionKeyValue(partitionKeyList: PartitionKeyInternal): Promise<{
+        partitionKeyList: PartitionKeyInternal;
+        encryptedCount: number;
+    }>;
+    getEncryptedUrl(id: string): Promise<string>;
+    getEncryptedId(id: string): Promise<string>;
+    encryptQueryParameter(path: string, value: JSONValue, isValueId: boolean, type?: TypeMarker): Promise<JSONValue>;
+    private encryptToken;
+    private serializeAndEncryptValue;
+    decrypt<T extends ItemDefinition>(body: T): Promise<{
+        body: T;
+        propertiesDecryptedCount: number;
+    }>;
+    private decryptToken;
+    private deserializeAndDecryptValue;
+    getEncryptionSetting(forceRefresh?: boolean): Promise<EncryptionSettings>;
+    private buildEncryptionAlgorithm;
+    private fetchClientEncryptionKey;
+}
+//# sourceMappingURL=EncryptionProcessor.d.ts.map

package/dist/commonjs/encryption/EncryptionProcessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionProcessor.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptionProcessor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAGlE,OAAO,KAAK,EAAuB,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAezD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAEnE,qBAAa,mBAAmB;IAE5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IACrB,YAAY,EAAE,MAAM;IAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,iBAAiB;gBAJR,WAAW,EAAE,MAAM,EAC7B,YAAY,EAAE,MAAM,EACV,QAAQ,EAAE,QAAQ,EAClB,aAAa,EAAE,aAAa,EACrC,iBAAiB,EAAE,iBAAiB;IAGxC,OAAO,CAAC,CAAC,SAAS,cAAc,EACpC,IAAI,EAAE,CAAC,GACN,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAA;KAAE,CAAC;IA2BnD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ/C,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC;IAa7D,6BAA6B,CACjC,gBAAgB,EAAE,oBAAoB,GACrC,OAAO,CAAC;QAAE,gBAAgB,EAAE,oBAAoB,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IAqBxE,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ5C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU3C,qBAAqB,CACzB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,EAChB,SAAS,EAAE,OAAO,EAClB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,SAAS,CAAC;YAcP,YAAY;YAqCZ,wBAAwB;IA+BhC,OAAO,CAAC,CAAC,SAAS,cAAc,EACpC,IAAI,EAAE,CAAC,GACN,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAA;KAAE,CAAC;YA2B3C,YAAY;YA6BZ,0BAA0B;IA0BlC,oBAAoB,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAgCjE,wBAAwB;YAiDxB,wBAAwB;CA+CvC"}

package/dist/commonjs/encryption/EncryptionProcessor.js

@@ -0,0 +1,300 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionProcessor = void 0;
+const index_js_1 = require("../common/index.js");
+const index_js_2 = require("../request/index.js");
+const diagnostics_js_1 = require("../utils/diagnostics.js");
+class EncryptionProcessor {
+    constructor(containerId, containerRid, database, clientContext, encryptionManager) {
+        this.containerId = containerId;
+        this.containerRid = containerRid;
+        this.database = database;
+        this.clientContext = clientContext;
+        this.encryptionManager = encryptionManager;
+    }
+    async encrypt(body) {
+        if (!body) {
+            throw new index_js_2.ErrorResponse("Input body is null or undefined.");
+        }
+        let propertiesEncryptedCount = 0;
+        const encryptionSettings = await this.getEncryptionSetting();
+        if (!encryptionSettings)
+            return { body, propertiesEncryptedCount };
+        for (const pathToEncrypt of encryptionSettings.pathsToEncrypt) {
+            const propertyName = pathToEncrypt.slice(1);
+            if (!Object.prototype.hasOwnProperty.call(body, propertyName)) {
+                continue;
+            }
+            const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(pathToEncrypt);
+            if (!settingForProperty) {
+                throw new index_js_2.ErrorResponse("Invalid Encryption Setting for the Property: " + propertyName);
+            }
+            body[propertyName] = await this.encryptToken(body[propertyName], settingForProperty, propertyName === "id");
+            propertiesEncryptedCount++;
+        }
+        return { body, propertiesEncryptedCount };
+    }
+    async isPathEncrypted(path) {
+        path = (0, index_js_1.extractPath)(path);
+        const encryptionSettings = await this.getEncryptionSetting();
+        const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(path);
+        if (!settingForProperty)
+            return false;
+        return true;
+    }
+    async encryptProperty(path, value) {
+        path = (0, index_js_1.extractPath)(path);
+        const encryptionSettings = await this.getEncryptionSetting();
+        if (!encryptionSettings)
+            return value;
+        const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(path);
+        if (!settingForProperty) {
+            return value;
+        }
+        value = await this.encryptToken(value, settingForProperty, path === "/id");
+        return value;
+    }
+    async getEncryptedPartitionKeyValue(partitionKeyList) {
+        const encryptionSettings = await this.getEncryptionSetting();
+        let encryptedCount = 0;
+        if (!encryptionSettings)
+            return { partitionKeyList, encryptedCount };
+        const partitionKeyPaths = encryptionSettings.partitionKeyPaths;
+        for (let i = 0; i < partitionKeyPaths.length; i++) {
+            const partitionKeyPath = (0, index_js_1.extractPath)(partitionKeyPaths[i]);
+            if (encryptionSettings.pathsToEncrypt.includes(partitionKeyPath)) {
+                const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(partitionKeyPath);
+                partitionKeyList[i] = await this.encryptToken(partitionKeyList[i], settingForProperty, partitionKeyPath === "/id");
+                encryptedCount++;
+            }
+        }
+        return { partitionKeyList, encryptedCount };
+    }
+    async getEncryptedUrl(id) {
+        const parts = id.split("/");
+        const lastPart = parts[parts.length - 1];
+        const encryptedLastPart = await this.getEncryptedId(lastPart);
+        parts[parts.length - 1] = encryptedLastPart;
+        return parts.join("/");
+    }
+    async getEncryptedId(id) {
+        const encryptionSettings = await this.getEncryptionSetting();
+        if (!encryptionSettings)
+            return id;
+        const settingForProperty = encryptionSettings.getEncryptionSettingForProperty("/id");
+        if (!settingForProperty)
+            return id;
+        id = await this.encryptToken(id, settingForProperty, true);
+        return id;
+    }
+    async encryptQueryParameter(path, value, isValueId, type) {
+        if (value === null) {
+            return value;
+        }
+        path = (0, index_js_1.extractPath)(path);
+        const encryptionSettings = await this.getEncryptionSetting();
+        if (!encryptionSettings)
+            return value;
+        const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(path);
+        if (!settingForProperty) {
+            return value;
+        }
+        return this.encryptToken(value, settingForProperty, isValueId, type);
+    }
+    async encryptToken(valueToEncrypt, propertySetting, isValueId, type) {
+        if (typeof valueToEncrypt === "object" && valueToEncrypt !== null) {
+            for (const key in valueToEncrypt) {
+                if (Object.prototype.hasOwnProperty.call(valueToEncrypt, key)) {
+                    valueToEncrypt[key] = await this.encryptToken(valueToEncrypt[key], propertySetting, isValueId, type);
+                }
+            }
+        }
+        else if (Array.isArray(type)) {
+            for (let i = 0; i < valueToEncrypt.length; i++) {
+                valueToEncrypt[i] = await this.encryptToken(valueToEncrypt[i], propertySetting, isValueId, type);
+            }
+        }
+        else {
+            valueToEncrypt = await this.serializeAndEncryptValue(valueToEncrypt, propertySetting, isValueId, type);
+        }
+        return valueToEncrypt;
+    }
+    async serializeAndEncryptValue(valueToEncrypt, propertySetting, isValueId, type) {
+        if (valueToEncrypt === null) {
+            return valueToEncrypt;
+        }
+        const [typeMarker, serializer] = (0, index_js_1.createSerializer)(valueToEncrypt, type);
+        const plainText = serializer.serialize(valueToEncrypt);
+        const encryptionAlgorithm = await this.buildEncryptionAlgorithm(propertySetting);
+        const cipherText = encryptionAlgorithm.encrypt(plainText);
+        if (isValueId) {
+            if (typeof valueToEncrypt !== "string") {
+                throw new index_js_2.ErrorResponse("The id should be of string type.");
+            }
+        }
+        const cipherTextWithTypeMarker = Buffer.alloc(cipherText.length + 1);
+        cipherTextWithTypeMarker[0] = typeMarker;
+        cipherText.forEach((value, index) => {
+            cipherTextWithTypeMarker[index + 1] = value;
+        });
+        let encryptedValue = Buffer.from(cipherTextWithTypeMarker).toString("base64");
+        if (isValueId) {
+            encryptedValue = encryptedValue.replace(/\//g, "_").replace(/\+/g, "-");
+        }
+        return encryptedValue;
+    }
+    async decrypt(body) {
+        let propertiesDecryptedCount = 0;
+        if (body == null) {
+            return { body, propertiesDecryptedCount };
+        }
+        const encryptionSettings = await this.getEncryptionSetting();
+        if (!encryptionSettings)
+            return { body, propertiesDecryptedCount };
+        for (const pathToEncrypt of encryptionSettings.pathsToEncrypt) {
+            const propertyName = pathToEncrypt.slice(1);
+            if (!Object.prototype.hasOwnProperty.call(body, propertyName)) {
+                continue;
+            }
+            const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(pathToEncrypt);
+            if (settingForProperty == null) {
+                throw new index_js_2.ErrorResponse("Invalid Encryption Setting for the Path: " + pathToEncrypt);
+            }
+            body[propertyName] = await this.decryptToken(body[propertyName], settingForProperty, propertyName === "id");
+            propertiesDecryptedCount++;
+        }
+        return { body, propertiesDecryptedCount };
+    }
+    async decryptToken(valueToDecrypt, propertySetting, isValueId) {
+        if (typeof valueToDecrypt === "object") {
+            for (const key in valueToDecrypt) {
+                if (Object.prototype.hasOwnProperty.call(valueToDecrypt, key)) {
+                    valueToDecrypt[key] = await this.decryptToken(valueToDecrypt[key], propertySetting, isValueId);
+                }
+            }
+        }
+        else if (Array.isArray(valueToDecrypt)) {
+            for (let i = 0; i < valueToDecrypt.length; i++) {
+                valueToDecrypt[i] = await this.decryptToken(valueToDecrypt[i], propertySetting, isValueId);
+            }
+        }
+        else {
+            valueToDecrypt = await this.deserializeAndDecryptValue(valueToDecrypt, propertySetting, isValueId);
+        }
+        return valueToDecrypt;
+    }
+    async deserializeAndDecryptValue(valueToDecrypt, propertySetting, isValueId) {
+        if (isValueId) {
+            valueToDecrypt = valueToDecrypt.replace(/_/g, "/").replace(/-/g, "+");
+        }
+        const cipherTextWithTypeMarker = Buffer.from(valueToDecrypt, "base64");
+        if (cipherTextWithTypeMarker === null) {
+            return null;
+        }
+        let cipherText = Buffer.alloc(cipherTextWithTypeMarker.length - 1);
+        cipherText = Buffer.from(cipherTextWithTypeMarker.slice(1));
+        const encryptionAlgorithm = await this.buildEncryptionAlgorithm(propertySetting);
+        const plainText = encryptionAlgorithm.decrypt(cipherText);
+        if (plainText === null) {
+            throw new index_js_2.ErrorResponse("returned null plain text");
+        }
+        const serializer = (0, index_js_1.createDeserializer)(cipherTextWithTypeMarker[0]);
+        return serializer.deserialize(plainText);
+    }
+    async getEncryptionSetting(forceRefresh) {
+        const key = this.database._rid + "/" + this.containerRid;
+        const encryptionSetting = this.encryptionManager.encryptionSettingsCache.get(key);
+        if (forceRefresh || !encryptionSetting) {
+            return (0, diagnostics_js_1.withDiagnostics)(async (diagnosticNode) => {
+                const path = `/dbs/${this.database.id}/colls/${this.containerId}`;
+                const id = `dbs/${this.database.id}/colls/${this.containerId}`;
+                const response = await this.clientContext.read({
+                    path,
+                    resourceType: index_js_1.ResourceType.container,
+                    resourceId: id,
+                    diagnosticNode,
+                });
+                if (!response || !response.result) {
+                    throw new index_js_2.ErrorResponse("Failed to fetch container definition");
+                }
+                const containerRid = response.result._rid;
+                const clientEncryptionPolicy = response.result.clientEncryptionPolicy;
+                const partitionKeyPaths = response.result.partitionKey.paths;
+                const updatedEncryptionSetting = await this.encryptionManager.encryptionSettingsCache.create(key, containerRid, partitionKeyPaths, clientEncryptionPolicy);
+                return updatedEncryptionSetting;
+            }, this.clientContext);
+        }
+        return encryptionSetting;
+    }
+    async buildEncryptionAlgorithm(propertySetting) {
+        const key = `${this.database._rid}/${propertySetting.encryptionKeyId}`;
+        let clientEncryptionKeyProperties = this.encryptionManager.clientEncryptionKeyPropertiesCache.get(key);
+        if (!clientEncryptionKeyProperties) {
+            clientEncryptionKeyProperties = await this.fetchClientEncryptionKey(propertySetting.encryptionKeyId);
+        }
+        try {
+            // the buildEncryptionAlgorithm will build ProtectedDEK which calls unwrapKey  using the masterKey configured in
+            // KeyEncryptionKey(created before creating Protected DEK)
+            // we get wrapped key and key wrap metadata info from clientEncryptionKeyProperties.
+            return await propertySetting.buildEncryptionAlgorithm(clientEncryptionKeyProperties, this.encryptionManager);
+        }
+        catch (err) {
+            if (err.statusCode !== index_js_1.StatusCodes.Forbidden)
+                throw err;
+            // if access to key is revoked, and in case there's stale value in cache
+            clientEncryptionKeyProperties = await this.fetchClientEncryptionKey(propertySetting.encryptionKeyId);
+            try {
+                // This will succeed after if client has rewrapped CEK and gateway cache has updated value.
+                return await propertySetting.buildEncryptionAlgorithm(clientEncryptionKeyProperties, this.encryptionManager, true);
+            }
+            catch (retryErr) {
+                if (retryErr.statusCode !== index_js_1.StatusCodes.Forbidden)
+                    throw retryErr;
+                // in case there's stale value in gateway cache. get fresh value from backend
+                clientEncryptionKeyProperties = await this.fetchClientEncryptionKey(propertySetting.encryptionKeyId, clientEncryptionKeyProperties.etag);
+                return propertySetting.buildEncryptionAlgorithm(clientEncryptionKeyProperties, this.encryptionManager);
+            }
+        }
+    }
+    async fetchClientEncryptionKey(cekId, cekEtag) {
+        return (0, diagnostics_js_1.withDiagnostics)(async (diagnosticNode) => {
+            const path = `/dbs/${this.database.id}/clientencryptionkeys/${cekId}`;
+            const id = `dbs/${this.database.id}/clientencryptionkeys/${cekId}`;
+            const options = {};
+            if (cekEtag) {
+                options.accessCondition = {
+                    type: index_js_1.Constants.HttpHeaders.IfNoneMatch,
+                    condition: cekEtag,
+                };
+            }
+            options.databaseRid = this.database._rid;
+            const response = await this.clientContext.read({
+                path: path,
+                resourceType: index_js_1.ResourceType.clientencryptionkey,
+                resourceId: id,
+                options: options,
+                diagnosticNode,
+            });
+            if (!response) {
+                throw new index_js_2.ErrorResponse(`Failed to fetch client encryption key ${cekId}`);
+            }
+            if (response.code === index_js_1.StatusCodes.NotModified) {
+                throw new index_js_2.ErrorResponse(`The Client Encryption Key with key id: ${cekId} on database: ${this.database.id} needs to be rewrapped with a valid Key Encryption Key using rewrapClientEncryptionKey. The Key Encryption Key used to wrap the Client Encryption Key has been revoked`);
+            }
+            const clientEncryptionKeyProperties = {
+                id: response.result.id,
+                encryptionAlgorithm: response.result.encryptionAlgorithm,
+                wrappedDataEncryptionKey: new Uint8Array(Buffer.from(response.result.wrappedDataEncryptionKey, "base64")),
+                encryptionKeyWrapMetadata: response.result.keyWrapMetadata,
+                etag: response.result._etag,
+            };
+            const key = this.database._rid + "/" + cekId;
+            this.encryptionManager.clientEncryptionKeyPropertiesCache.set(key, clientEncryptionKeyProperties);
+            return clientEncryptionKeyProperties;
+        }, this.clientContext);
+    }
+}
+exports.EncryptionProcessor = EncryptionProcessor;
+//# sourceMappingURL=EncryptionProcessor.js.map

package/dist/commonjs/encryption/EncryptionProcessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionProcessor.js","sourceRoot":"","sources":["../../../src/encryption/EncryptionProcessor.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAYlC,iDAO4B;AAE5B,kDAAoD;AACpD,4DAA0D;AAI1D,MAAa,mBAAmB;IAC9B,YACmB,WAAmB,EAC7B,YAAoB,EACV,QAAkB,EAClB,aAA4B,EACrC,iBAAoC;QAJ3B,gBAAW,GAAX,WAAW,CAAQ;QAC7B,iBAAY,GAAZ,YAAY,CAAQ;QACV,aAAQ,GAAR,QAAQ,CAAU;QAClB,kBAAa,GAAb,aAAa,CAAe;QACrC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAC3C,CAAC;IAEJ,KAAK,CAAC,OAAO,CACX,IAAO;QAEP,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,wBAAa,CAAC,kCAAkC,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,wBAAwB,GAAG,CAAC,CAAC;QACjC,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7D,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;QACnE,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,cAAc,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC9D,SAAS;YACX,CAAC;YAED,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,+BAA+B,CAAC,aAAa,CAAC,CAAC;YAC7F,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,MAAM,IAAI,wBAAa,CAAC,+CAA+C,GAAG,YAAY,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,YAAuB,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CACrD,IAAI,CAAC,YAAY,CAAC,EAClB,kBAAkB,EAClB,YAAY,KAAK,IAAI,CACtB,CAAC;YACF,wBAAwB,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,IAAI,GAAG,IAAA,sBAAW,EAAC,IAAI,CAAC,CAAC;QACzB,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7D,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,CAAC,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,KAAgB;QAClD,IAAI,GAAG,IAAA,sBAAW,EAAC,IAAI,CAAC,CAAC;QACzB,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7D,IAAI,CAAC,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,kBAAkB,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,6BAA6B,CACjC,gBAAsC;QAEtC,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7D,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;QACrE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,iBAAiB,CAAC;QAC/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,gBAAgB,GAAG,IAAA,sBAAW,EAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACjE,MAAM,kBAAkB,GACtB,kBAAkB,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,CAAC;gBACvE,gBAAgB,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAC3C,gBAAgB,CAAC,CAAC,CAAC,EACnB,kBAAkB,EAClB,gBAAgB,KAAK,KAAK,CAC3B,CAAC;gBACF,cAAc,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC9D,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,iBAAiB,CAAC;QAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7D,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,+BAA+B,CAAC,KAAK,CAAC,CAAC;QAErF,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,CAAC;QACnC,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,IAAY,EACZ,KAAgB,EAChB,SAAkB,EAClB,IAAiB;QAEjB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,GAAG,IAAA,sBAAW,EAAC,IAAI,CAAC,CAAC;QACzB,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7D,IAAI,CAAC,kBAAkB;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;QACpF,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,cAAmB,EACnB,eAA6C,EAC7C,SAAkB,EAClB,IAAiB;QAEjB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAClE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC9D,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAC3C,cAAc,CAAC,GAAG,CAAC,EACnB,eAAe,EACf,SAAS,EACT,IAAI,CACL,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,cAAc,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CACzC,cAAc,CAAC,CAAC,CAAC,EACjB,eAAe,EACf,SAAS,EACT,IAAI,CACL,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAClD,cAAc,EACd,eAAe,EACf,SAAS,EACT,IAAI,CACL,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,cAAmB,EACnB,eAA6C,EAC7C,SAAkB,EAClB,IAAiB;QAEjB,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,IAAA,2BAAgB,EAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC;QACjF,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;gBACvC,MAAM,IAAI,wBAAa,CAAC,kCAAkC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;QAED,MAAM,wBAAwB,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,wBAAwB,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QACzC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAClC,wBAAwB,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,IAAI,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9E,IAAI,SAAS,EAAE,CAAC;YACd,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAO;QAEP,IAAI,wBAAwB,GAAG,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC7D,IAAI,CAAC,kBAAkB;YAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;QACnE,KAAK,MAAM,aAAa,IAAI,kBAAkB,CAAC,cAAc,EAAE,CAAC;YAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,+BAA+B,CAAC,aAAa,CAAC,CAAC;YAC7F,IAAI,kBAAkB,IAAI,IAAI,EAAE,CAAC;gBAC/B,MAAM,IAAI,wBAAa,CAAC,2CAA2C,GAAG,aAAa,CAAC,CAAC;YACvF,CAAC;YAED,IAAI,CAAC,YAAuB,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CACrD,IAAI,CAAC,YAAY,CAAC,EAClB,kBAAkB,EAClB,YAAY,KAAK,IAAI,CACtB,CAAC;YACF,wBAAwB,EAAE,CAAC;QAC7B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,cAAmB,EACnB,eAA6C,EAC7C,SAAkB;QAElB,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;gBACjC,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,EAAE,CAAC;oBAC9D,cAAc,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAC3C,cAAc,CAAC,GAAG,CAAC,EACnB,eAAe,EACf,SAAS,CACV,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,cAAc,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,MAAM,IAAI,CAAC,0BAA0B,CACpD,cAAc,EACd,eAAe,EACf,SAAS,CACV,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,0BAA0B,CACtC,cAAsB,EACtB,eAA6C,EAC7C,SAAkB;QAElB,IAAI,SAAS,EAAE,CAAC;YACd,cAAc,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACvE,IAAI,wBAAwB,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAE5D,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,wBAAa,CAAC,0BAA0B,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,6BAAkB,EAAC,wBAAwB,CAAC,CAAC,CAAe,CAAC,CAAC;QACjF,OAAO,UAAU,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,YAAsB;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;QACzD,MAAM,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClF,IAAI,YAAY,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvC,OAAO,IAAA,gCAAe,EAAC,KAAK,EAAE,cAAsC,EAAE,EAAE;gBACtE,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClE,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAsB;oBAClE,IAAI;oBACJ,YAAY,EAAE,uBAAY,CAAC,SAAS;oBACpC,UAAU,EAAE,EAAE;oBACd,cAAc;iBACf,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAClC,MAAM,IAAI,wBAAa,CAAC,sCAAsC,CAAC,CAAC;gBAClE,CAAC;gBACD,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC1C,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC;gBACtE,MAAM,iBAAiB,GAAG,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC;gBAC7D,MAAM,wBAAwB,GAC5B,MAAM,IAAI,CAAC,iBAAiB,CAAC,uBAAuB,CAAC,MAAM,CACzD,GAAG,EACH,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,CACvB,CAAC;gBACJ,OAAO,wBAAwB,CAAC;YAClC,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,eAA6C;QAE7C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,eAAe,CAAC,eAAe,EAAE,CAAC;QACvE,IAAI,6BAA6B,GAC/B,IAAI,CAAC,iBAAiB,CAAC,kCAAkC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,6BAA6B,EAAE,CAAC;YACnC,6BAA6B,GAAG,MAAM,IAAI,CAAC,wBAAwB,CACjE,eAAe,CAAC,eAAe,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,gHAAgH;YAChH,0DAA0D;YAC1D,oFAAoF;YACpF,OAAO,MAAM,eAAe,CAAC,wBAAwB,CACnD,6BAA6B,EAC7B,IAAI,CAAC,iBAAiB,CACvB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,UAAU,KAAK,sBAAW,CAAC,SAAS;gBAAE,MAAM,GAAG,CAAC;YACxD,wEAAwE;YACxE,6BAA6B,GAAG,MAAM,IAAI,CAAC,wBAAwB,CACjE,eAAe,CAAC,eAAe,CAChC,CAAC;YAEF,IAAI,CAAC;gBACH,2FAA2F;gBAC3F,OAAO,MAAM,eAAe,CAAC,wBAAwB,CACnD,6BAA6B,EAC7B,IAAI,CAAC,iBAAiB,EACtB,IAAI,CACL,CAAC;YACJ,CAAC;YAAC,OAAO,QAAQ,EAAE,CAAC;gBAClB,IAAI,QAAQ,CAAC,UAAU,KAAK,sBAAW,CAAC,SAAS;oBAAE,MAAM,QAAQ,CAAC;gBAElE,6EAA6E;gBAC7E,6BAA6B,GAAG,MAAM,IAAI,CAAC,wBAAwB,CACjE,eAAe,CAAC,eAAe,EAC/B,6BAA6B,CAAC,IAAI,CACnC,CAAC;gBACF,OAAO,eAAe,CAAC,wBAAwB,CAC7C,6BAA6B,EAC7B,IAAI,CAAC,iBAAiB,CACvB,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,KAAa,EACb,OAAgB;QAEhB,OAAO,IAAA,gCAAe,EAAC,KAAK,EAAE,cAAsC,EAAE,EAAE;YACtE,MAAM,IAAI,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,yBAAyB,KAAK,EAAE,CAAC;YACtE,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,yBAAyB,KAAK,EAAE,CAAC;YACnE,MAAM,OAAO,GAAmB,EAAE,CAAC;YACnC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,eAAe,GAAG;oBACxB,IAAI,EAAE,oBAAS,CAAC,WAAW,CAAC,WAAW;oBACvC,SAAS,EAAE,OAAO;iBACnB,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAA6B;gBACzE,IAAI,EAAE,IAAI;gBACV,YAAY,EAAE,uBAAY,CAAC,mBAAmB;gBAC9C,UAAU,EAAE,EAAE;gBACd,OAAO,EAAE,OAAO;gBAChB,cAAc;aACf,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,wBAAa,CAAC,yCAAyC,KAAK,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,sBAAW,CAAC,WAAW,EAAE,CAAC;gBAC9C,MAAM,IAAI,wBAAa,CACrB,0CAA0C,KAAK,iBAAiB,IAAI,CAAC,QAAQ,CAAC,EAAE,wKAAwK,CACzP,CAAC;YACJ,CAAC;YACD,MAAM,6BAA6B,GAAkC;gBACnE,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE;gBACtB,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,mBAAmB;gBACxD,wBAAwB,EAAE,IAAI,UAAU,CACtC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,wBAAwB,EAAE,QAAQ,CAAC,CAChE;gBACD,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe;gBAC1D,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK;aAC5B,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,GAAG,KAAK,CAAC;YAC7C,IAAI,CAAC,iBAAiB,CAAC,kCAAkC,CAAC,GAAG,CAC3D,GAAG,EACH,6BAA6B,CAC9B,CAAC;YACF,OAAO,6BAA6B,CAAC;QACvC,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IACzB,CAAC;CACF;AA/YD,kDA+YC","sourcesContent":["// Copyright (c) Microsoft Corporation.\n// Licensed under the MIT License.\n\nimport type { EncryptionSettings } from \"./EncryptionSettings.js\";\nimport type { EncryptionSettingForProperty } from \"./EncryptionSettingForProperty.js\";\nimport type { AeadAes256CbcHmacSha256Algorithm } from \"./AeadAes256CbcHmacSha256Algorithm/index.js\";\nimport type { ContainerDefinition, Database, ItemDefinition } from \"../client/index.js\";\nimport type { PartitionKeyInternal } from \"../documents/index.js\";\nimport type { TypeMarker } from \"./enums/TypeMarker.js\";\nimport type { ClientContext } from \"../ClientContext.js\";\nimport type { ClientEncryptionKeyRequest } from \"./ClientEncryptionKey/index.js\";\nimport type { ClientEncryptionKeyProperties } from \"./ClientEncryptionKey/index.js\";\nimport type { DiagnosticNodeInternal } from \"../diagnostics/DiagnosticNodeInternal.js\";\nimport {\n  Constants,\n  ResourceType,\n  StatusCodes,\n  createDeserializer,\n  createSerializer,\n  extractPath,\n} from \"../common/index.js\";\nimport type { RequestOptions } from \"../request/index.js\";\nimport { ErrorResponse } from \"../request/index.js\";\nimport { withDiagnostics } from \"../utils/diagnostics.js\";\nimport type { EncryptionManager } from \"./EncryptionManager.js\";\nimport type { JSONValue } from \"../queryExecutionContext/index.js\";\n\nexport class EncryptionProcessor {\n  constructor(\n    private readonly containerId: string,\n    public containerRid: string,\n    private readonly database: Database,\n    private readonly clientContext: ClientContext,\n    private encryptionManager: EncryptionManager,\n  ) {}\n\n  async encrypt<T extends ItemDefinition>(\n    body: T,\n  ): Promise<{ body: T; propertiesEncryptedCount: number }> {\n    if (!body) {\n      throw new ErrorResponse(\"Input body is null or undefined.\");\n    }\n    let propertiesEncryptedCount = 0;\n    const encryptionSettings = await this.getEncryptionSetting();\n    if (!encryptionSettings) return { body, propertiesEncryptedCount };\n    for (const pathToEncrypt of encryptionSettings.pathsToEncrypt) {\n      const propertyName = pathToEncrypt.slice(1);\n      if (!Object.prototype.hasOwnProperty.call(body, propertyName)) {\n        continue;\n      }\n\n      const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(pathToEncrypt);\n      if (!settingForProperty) {\n        throw new ErrorResponse(\"Invalid Encryption Setting for the Property: \" + propertyName);\n      }\n      body[propertyName as keyof T] = await this.encryptToken(\n        body[propertyName],\n        settingForProperty,\n        propertyName === \"id\",\n      );\n      propertiesEncryptedCount++;\n    }\n    return { body, propertiesEncryptedCount };\n  }\n\n  async isPathEncrypted(path: string): Promise<boolean> {\n    path = extractPath(path);\n    const encryptionSettings = await this.getEncryptionSetting();\n    const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(path);\n    if (!settingForProperty) return false;\n    return true;\n  }\n\n  async encryptProperty(path: string, value: JSONValue): Promise<any> {\n    path = extractPath(path);\n    const encryptionSettings = await this.getEncryptionSetting();\n    if (!encryptionSettings) return value;\n    const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(path);\n    if (!settingForProperty) {\n      return value;\n    }\n\n    value = await this.encryptToken(value, settingForProperty, path === \"/id\");\n    return value;\n  }\n\n  async getEncryptedPartitionKeyValue(\n    partitionKeyList: PartitionKeyInternal,\n  ): Promise<{ partitionKeyList: PartitionKeyInternal; encryptedCount: number }> {\n    const encryptionSettings = await this.getEncryptionSetting();\n    let encryptedCount = 0;\n    if (!encryptionSettings) return { partitionKeyList, encryptedCount };\n    const partitionKeyPaths = encryptionSettings.partitionKeyPaths;\n    for (let i = 0; i < partitionKeyPaths.length; i++) {\n      const partitionKeyPath = extractPath(partitionKeyPaths[i]);\n      if (encryptionSettings.pathsToEncrypt.includes(partitionKeyPath)) {\n        const settingForProperty =\n          encryptionSettings.getEncryptionSettingForProperty(partitionKeyPath);\n        partitionKeyList[i] = await this.encryptToken(\n          partitionKeyList[i],\n          settingForProperty,\n          partitionKeyPath === \"/id\",\n        );\n        encryptedCount++;\n      }\n    }\n    return { partitionKeyList, encryptedCount };\n  }\n\n  async getEncryptedUrl(id: string): Promise<string> {\n    const parts = id.split(\"/\");\n    const lastPart = parts[parts.length - 1];\n    const encryptedLastPart = await this.getEncryptedId(lastPart);\n    parts[parts.length - 1] = encryptedLastPart;\n    return parts.join(\"/\");\n  }\n\n  async getEncryptedId(id: string): Promise<string> {\n    const encryptionSettings = await this.getEncryptionSetting();\n    if (!encryptionSettings) return id;\n    const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(\"/id\");\n\n    if (!settingForProperty) return id;\n    id = await this.encryptToken(id, settingForProperty, true);\n    return id;\n  }\n\n  async encryptQueryParameter(\n    path: string,\n    value: JSONValue,\n    isValueId: boolean,\n    type?: TypeMarker,\n  ): Promise<JSONValue> {\n    if (value === null) {\n      return value;\n    }\n    path = extractPath(path);\n    const encryptionSettings = await this.getEncryptionSetting();\n    if (!encryptionSettings) return value;\n    const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(path);\n    if (!settingForProperty) {\n      return value;\n    }\n    return this.encryptToken(value, settingForProperty, isValueId, type);\n  }\n\n  private async encryptToken(\n    valueToEncrypt: any,\n    propertySetting: EncryptionSettingForProperty,\n    isValueId: boolean,\n    type?: TypeMarker,\n  ): Promise<any> {\n    if (typeof valueToEncrypt === \"object\" && valueToEncrypt !== null) {\n      for (const key in valueToEncrypt) {\n        if (Object.prototype.hasOwnProperty.call(valueToEncrypt, key)) {\n          valueToEncrypt[key] = await this.encryptToken(\n            valueToEncrypt[key],\n            propertySetting,\n            isValueId,\n            type,\n          );\n        }\n      }\n    } else if (Array.isArray(type)) {\n      for (let i = 0; i < valueToEncrypt.length; i++) {\n        valueToEncrypt[i] = await this.encryptToken(\n          valueToEncrypt[i],\n          propertySetting,\n          isValueId,\n          type,\n        );\n      }\n    } else {\n      valueToEncrypt = await this.serializeAndEncryptValue(\n        valueToEncrypt,\n        propertySetting,\n        isValueId,\n        type,\n      );\n    }\n    return valueToEncrypt;\n  }\n\n  private async serializeAndEncryptValue(\n    valueToEncrypt: any,\n    propertySetting: EncryptionSettingForProperty,\n    isValueId: boolean,\n    type?: TypeMarker,\n  ): Promise<string> {\n    if (valueToEncrypt === null) {\n      return valueToEncrypt;\n    }\n    const [typeMarker, serializer] = createSerializer(valueToEncrypt, type);\n    const plainText = serializer.serialize(valueToEncrypt);\n    const encryptionAlgorithm = await this.buildEncryptionAlgorithm(propertySetting);\n    const cipherText = encryptionAlgorithm.encrypt(plainText);\n    if (isValueId) {\n      if (typeof valueToEncrypt !== \"string\") {\n        throw new ErrorResponse(\"The id should be of string type.\");\n      }\n    }\n\n    const cipherTextWithTypeMarker = Buffer.alloc(cipherText.length + 1);\n    cipherTextWithTypeMarker[0] = typeMarker;\n    cipherText.forEach((value, index) => {\n      cipherTextWithTypeMarker[index + 1] = value;\n    });\n    let encryptedValue = Buffer.from(cipherTextWithTypeMarker).toString(\"base64\");\n    if (isValueId) {\n      encryptedValue = encryptedValue.replace(/\\//g, \"_\").replace(/\\+/g, \"-\");\n    }\n    return encryptedValue;\n  }\n\n  async decrypt<T extends ItemDefinition>(\n    body: T,\n  ): Promise<{ body: T; propertiesDecryptedCount: number }> {\n    let propertiesDecryptedCount = 0;\n    if (body == null) {\n      return { body, propertiesDecryptedCount };\n    }\n    const encryptionSettings = await this.getEncryptionSetting();\n    if (!encryptionSettings) return { body, propertiesDecryptedCount };\n    for (const pathToEncrypt of encryptionSettings.pathsToEncrypt) {\n      const propertyName = pathToEncrypt.slice(1);\n      if (!Object.prototype.hasOwnProperty.call(body, propertyName)) {\n        continue;\n      }\n      const settingForProperty = encryptionSettings.getEncryptionSettingForProperty(pathToEncrypt);\n      if (settingForProperty == null) {\n        throw new ErrorResponse(\"Invalid Encryption Setting for the Path: \" + pathToEncrypt);\n      }\n\n      body[propertyName as keyof T] = await this.decryptToken(\n        body[propertyName],\n        settingForProperty,\n        propertyName === \"id\",\n      );\n      propertiesDecryptedCount++;\n    }\n    return { body, propertiesDecryptedCount };\n  }\n\n  private async decryptToken(\n    valueToDecrypt: any,\n    propertySetting: EncryptionSettingForProperty,\n    isValueId: boolean,\n  ): Promise<any> {\n    if (typeof valueToDecrypt === \"object\") {\n      for (const key in valueToDecrypt) {\n        if (Object.prototype.hasOwnProperty.call(valueToDecrypt, key)) {\n          valueToDecrypt[key] = await this.decryptToken(\n            valueToDecrypt[key],\n            propertySetting,\n            isValueId,\n          );\n        }\n      }\n    } else if (Array.isArray(valueToDecrypt)) {\n      for (let i = 0; i < valueToDecrypt.length; i++) {\n        valueToDecrypt[i] = await this.decryptToken(valueToDecrypt[i], propertySetting, isValueId);\n      }\n    } else {\n      valueToDecrypt = await this.deserializeAndDecryptValue(\n        valueToDecrypt,\n        propertySetting,\n        isValueId,\n      );\n    }\n    return valueToDecrypt;\n  }\n\n  private async deserializeAndDecryptValue(\n    valueToDecrypt: string,\n    propertySetting: EncryptionSettingForProperty,\n    isValueId: boolean,\n  ): Promise<any> {\n    if (isValueId) {\n      valueToDecrypt = valueToDecrypt.replace(/_/g, \"/\").replace(/-/g, \"+\");\n    }\n    const cipherTextWithTypeMarker = Buffer.from(valueToDecrypt, \"base64\");\n    if (cipherTextWithTypeMarker === null) {\n      return null;\n    }\n\n    let cipherText = Buffer.alloc(cipherTextWithTypeMarker.length - 1);\n    cipherText = Buffer.from(cipherTextWithTypeMarker.slice(1));\n\n    const encryptionAlgorithm = await this.buildEncryptionAlgorithm(propertySetting);\n    const plainText = encryptionAlgorithm.decrypt(cipherText);\n    if (plainText === null) {\n      throw new ErrorResponse(\"returned null plain text\");\n    }\n\n    const serializer = createDeserializer(cipherTextWithTypeMarker[0] as TypeMarker);\n    return serializer.deserialize(plainText);\n  }\n\n  async getEncryptionSetting(forceRefresh?: boolean): Promise<EncryptionSettings> {\n    const key = this.database._rid + \"/\" + this.containerRid;\n    const encryptionSetting = this.encryptionManager.encryptionSettingsCache.get(key);\n    if (forceRefresh || !encryptionSetting) {\n      return withDiagnostics(async (diagnosticNode: DiagnosticNodeInternal) => {\n        const path = `/dbs/${this.database.id}/colls/${this.containerId}`;\n        const id = `dbs/${this.database.id}/colls/${this.containerId}`;\n        const response = await this.clientContext.read<ContainerDefinition>({\n          path,\n          resourceType: ResourceType.container,\n          resourceId: id,\n          diagnosticNode,\n        });\n        if (!response || !response.result) {\n          throw new ErrorResponse(\"Failed to fetch container definition\");\n        }\n        const containerRid = response.result._rid;\n        const clientEncryptionPolicy = response.result.clientEncryptionPolicy;\n        const partitionKeyPaths = response.result.partitionKey.paths;\n        const updatedEncryptionSetting =\n          await this.encryptionManager.encryptionSettingsCache.create(\n            key,\n            containerRid,\n            partitionKeyPaths,\n            clientEncryptionPolicy,\n          );\n        return updatedEncryptionSetting;\n      }, this.clientContext);\n    }\n    return encryptionSetting;\n  }\n\n  private async buildEncryptionAlgorithm(\n    propertySetting: EncryptionSettingForProperty,\n  ): Promise<AeadAes256CbcHmacSha256Algorithm> {\n    const key = `${this.database._rid}/${propertySetting.encryptionKeyId}`;\n    let clientEncryptionKeyProperties =\n      this.encryptionManager.clientEncryptionKeyPropertiesCache.get(key);\n    if (!clientEncryptionKeyProperties) {\n      clientEncryptionKeyProperties = await this.fetchClientEncryptionKey(\n        propertySetting.encryptionKeyId,\n      );\n    }\n    try {\n      // the buildEncryptionAlgorithm will build ProtectedDEK which calls unwrapKey  using the masterKey configured in\n      // KeyEncryptionKey(created before creating Protected DEK)\n      // we get wrapped key and key wrap metadata info from clientEncryptionKeyProperties.\n      return await propertySetting.buildEncryptionAlgorithm(\n        clientEncryptionKeyProperties,\n        this.encryptionManager,\n      );\n    } catch (err) {\n      if (err.statusCode !== StatusCodes.Forbidden) throw err;\n      // if access to key is revoked, and in case there's stale value in cache\n      clientEncryptionKeyProperties = await this.fetchClientEncryptionKey(\n        propertySetting.encryptionKeyId,\n      );\n\n      try {\n        // This will succeed after if client has rewrapped CEK and gateway cache has updated value.\n        return await propertySetting.buildEncryptionAlgorithm(\n          clientEncryptionKeyProperties,\n          this.encryptionManager,\n          true,\n        );\n      } catch (retryErr) {\n        if (retryErr.statusCode !== StatusCodes.Forbidden) throw retryErr;\n\n        // in case there's stale value in gateway cache. get fresh value from backend\n        clientEncryptionKeyProperties = await this.fetchClientEncryptionKey(\n          propertySetting.encryptionKeyId,\n          clientEncryptionKeyProperties.etag,\n        );\n        return propertySetting.buildEncryptionAlgorithm(\n          clientEncryptionKeyProperties,\n          this.encryptionManager,\n        );\n      }\n    }\n  }\n\n  private async fetchClientEncryptionKey(\n    cekId: string,\n    cekEtag?: string,\n  ): Promise<ClientEncryptionKeyProperties> {\n    return withDiagnostics(async (diagnosticNode: DiagnosticNodeInternal) => {\n      const path = `/dbs/${this.database.id}/clientencryptionkeys/${cekId}`;\n      const id = `dbs/${this.database.id}/clientencryptionkeys/${cekId}`;\n      const options: RequestOptions = {};\n      if (cekEtag) {\n        options.accessCondition = {\n          type: Constants.HttpHeaders.IfNoneMatch,\n          condition: cekEtag,\n        };\n      }\n      options.databaseRid = this.database._rid;\n      const response = await this.clientContext.read<ClientEncryptionKeyRequest>({\n        path: path,\n        resourceType: ResourceType.clientencryptionkey,\n        resourceId: id,\n        options: options,\n        diagnosticNode,\n      });\n      if (!response) {\n        throw new ErrorResponse(`Failed to fetch client encryption key ${cekId}`);\n      }\n      if (response.code === StatusCodes.NotModified) {\n        throw new ErrorResponse(\n          `The Client Encryption Key with key id: ${cekId} on database: ${this.database.id} needs to be rewrapped with a valid Key Encryption Key using rewrapClientEncryptionKey. The Key Encryption Key used to wrap the Client Encryption Key has been revoked`,\n        );\n      }\n      const clientEncryptionKeyProperties: ClientEncryptionKeyProperties = {\n        id: response.result.id,\n        encryptionAlgorithm: response.result.encryptionAlgorithm,\n        wrappedDataEncryptionKey: new Uint8Array(\n          Buffer.from(response.result.wrappedDataEncryptionKey, \"base64\"),\n        ),\n        encryptionKeyWrapMetadata: response.result.keyWrapMetadata,\n        etag: response.result._etag,\n      };\n      const key = this.database._rid + \"/\" + cekId;\n      this.encryptionManager.clientEncryptionKeyPropertiesCache.set(\n        key,\n        clientEncryptionKeyProperties,\n      );\n      return clientEncryptionKeyProperties;\n    }, this.clientContext);\n  }\n}\n"]}

package/dist/commonjs/encryption/EncryptionQueryBuilder.d.ts

@@ -0,0 +1,22 @@
+import { SqlParameter, JSONArray, JSONObject, JSONValue } from "../queryExecutionContext/index.js";
+import { TypeMarker } from "./enums/TypeMarker.js";
+import { CosmosEncryptedNumber } from "./CosmosEncryptedNumber.js";
+export interface EncryptionSqlParameter extends SqlParameter {
+    type?: TypeMarker;
+    path: string;
+}
+/**
+ * Represents a builder class for building encrypted parameters in parametrized query.
+ */
+export declare class EncryptionQueryBuilder {
+    private query;
+    private parameters?;
+    constructor(query: string);
+    /**
+     * Adds parameter to query
+     */
+    addParameter(name: string, value: boolean | string | null | JSONArray | JSONObject | Date | CosmosEncryptedNumber, path: string): void;
+    /** Adds unencrypted parameter to query */
+    addUnencryptedParameter(name: string, value: JSONValue, path: string): void;
+}
+//# sourceMappingURL=EncryptionQueryBuilder.d.ts.map

package/dist/commonjs/encryption/EncryptionQueryBuilder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EncryptionQueryBuilder.d.ts","sourceRoot":"","sources":["../../../src/encryption/EncryptionQueryBuilder.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,YAAY,EACZ,SAAS,EACT,UAAU,EACV,SAAS,EACV,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAA6B,MAAM,4BAA4B,CAAC;AAE9F,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC1D,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAAC,CAA2B;gBAElC,KAAK,EAAE,MAAM;IAIzB;;OAEG;IACI,YAAY,CACjB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,IAAI,GAAG,qBAAqB,EACtF,IAAI,EAAE,MAAM,GACX,IAAI;IA8DP,0CAA0C;IACnC,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;CAanF"}

package/dist/commonjs/encryption/EncryptionQueryBuilder.js

@@ -0,0 +1,104 @@
+"use strict";
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionQueryBuilder = void 0;
+const TypeMarker_js_1 = require("./enums/TypeMarker.js");
+const CosmosEncryptedNumber_js_1 = require("./CosmosEncryptedNumber.js");
+/**
+ * Represents a builder class for building encrypted parameters in parametrized query.
+ */
+class EncryptionQueryBuilder {
+    constructor(query) {
+        this.query = query;
+        this.parameters = [];
+    }
+    /**
+     * Adds parameter to query
+     */
+    addParameter(name, value, path) {
+        if (value === null) {
+            this.parameters.push({ name: name, value: null, path: path });
+            return;
+        }
+        switch (true) {
+            case typeof value === "boolean":
+                this.parameters.push({
+                    name,
+                    value,
+                    type: TypeMarker_js_1.TypeMarker.Boolean,
+                    path,
+                });
+                break;
+            case typeof value === "string":
+                this.parameters.push({
+                    name,
+                    value,
+                    type: TypeMarker_js_1.TypeMarker.String,
+                    path,
+                });
+                break;
+            case value instanceof Date: {
+                const date = value.toISOString();
+                this.parameters.push({
+                    name: name,
+                    value: date,
+                    type: TypeMarker_js_1.TypeMarker.String,
+                    path: path,
+                });
+                break;
+            }
+            case isCosmosEncryptedNumber(value): {
+                const num = value.value;
+                if (value.numberType === CosmosEncryptedNumber_js_1.CosmosEncryptedNumberType.Integer) {
+                    this.parameters.push({
+                        name,
+                        value: num,
+                        type: TypeMarker_js_1.TypeMarker.Long,
+                        path,
+                    });
+                }
+                else if (value.numberType === CosmosEncryptedNumber_js_1.CosmosEncryptedNumberType.Float) {
+                    this.parameters.push({
+                        name,
+                        value: num,
+                        type: TypeMarker_js_1.TypeMarker.Double,
+                        path,
+                    });
+                }
+                break;
+            }
+            case Array.isArray(value):
+                this.parameters.push({ name, value, path });
+                break;
+            case typeof value === "object":
+                this.parameters.push({ name, value, path });
+                break;
+            default:
+                throw new Error(`Unsupported parameter type for parameter "${name}": ${typeof value}`);
+        }
+    }
+    /** Adds unencrypted parameter to query */
+    addUnencryptedParameter(name, value, path) {
+        this.parameters.push({ name: name, value: value, path: path });
+    }
+    /*
+     * @internal
+     */
+    toEncryptionSqlQuerySpec() {
+        return {
+            query: this.query,
+            parameters: this.parameters,
+        };
+    }
+}
+exports.EncryptionQueryBuilder = EncryptionQueryBuilder;
+function isCosmosEncryptedNumber(val) {
+    return (val !== null &&
+        typeof val === "object" &&
+        typeof val.value === "number" &&
+        typeof val.numberType === "string" &&
+        (val.numberType === CosmosEncryptedNumber_js_1.CosmosEncryptedNumberType.Integer ||
+            val.numberType === CosmosEncryptedNumber_js_1.CosmosEncryptedNumberType.Float));
+}
+//# sourceMappingURL=EncryptionQueryBuilder.js.map