@decocms/blocks 7.34.3 → 7.34.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.34.3",
+  "version": "7.34.4",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/sdk/crypto.test.ts

@@ -0,0 +1,65 @@
+/**
+ * Regression test for the CF Workers secret-decryption bug: in production/preview
+ * DECO_CRYPTO_KEY is neither in process.env nor in .dev.vars — it only reaches
+ * getEnvVar() via the `env` binding stashed in RequestContext (setRuntimeEnv).
+ * If getEnvVar() stops consulting getRuntimeEnv(), encrypted secrets silently
+ * decrypt to null in production and this test fails.
+ */
+
+import { webcrypto } from "node:crypto";
+import { beforeAll, describe, expect, it } from "vitest";
+import { resolveSecret } from "./crypto";
+import { setRuntimeEnv } from "./otelAdapters";
+import { RequestContext } from "./requestContext";
+
+// Ensure crypto.subtle exists in the Node test runtime.
+beforeAll(() => {
+  if (!globalThis.crypto?.subtle) {
+    (globalThis as { crypto: Crypto }).crypto = webcrypto as unknown as Crypto;
+  }
+});
+
+/** Build a DECO_CRYPTO_KEY value + an encrypted-hex ciphertext for `plaintext`. */
+async function makeKeyAndCiphertext(plaintext: string) {
+  const rawKey = webcrypto.getRandomValues(new Uint8Array(16));
+  const iv = webcrypto.getRandomValues(new Uint8Array(16));
+  const key = await webcrypto.subtle.importKey("raw", rawKey, "AES-CBC", false, [
+    "encrypt",
+  ]);
+  const ct = new Uint8Array(
+    await webcrypto.subtle.encrypt(
+      { name: "AES-CBC", iv },
+      key,
+      new TextEncoder().encode(plaintext),
+    ),
+  );
+  const encryptedHex = Array.from(ct)
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
+  const decoCryptoKey = btoa(
+    JSON.stringify({ key: Array.from(rawKey), iv: Array.from(iv) }),
+  );
+  return { decoCryptoKey, encryptedHex };
+}
+
+describe("resolveSecret in CF Workers (no process.env / no .dev.vars)", () => {
+  it("decrypts using DECO_CRYPTO_KEY from the RequestContext env binding", async () => {
+    // Use a unique plaintext so the module-level secretCache can't mask a
+    // regression with a value cached by another test/run.
+    const plaintext = `appToken-${Math.random().toString(36).slice(2)}`;
+    const { decoCryptoKey, encryptedHex } = await makeKeyAndCiphertext(plaintext);
+
+    // Guard: process.env must NOT carry the key, so the only source is the ALS.
+    expect(process.env.DECO_CRYPTO_KEY).toBeUndefined();
+
+    const resolved = await RequestContext.run(
+      new Request("https://site.example/"),
+      async () => {
+        setRuntimeEnv({ DECO_CRYPTO_KEY: decoCryptoKey });
+        return resolveSecret({ encrypted: encryptedHex });
+      },
+    );
+
+    expect(resolved).toBe(plaintext);
+  });
+});

package/src/sdk/crypto.ts

@@ -15,6 +15,8 @@
  *   const apiKey = await resolveSecret(block.apiKey, "RESEND_API_KEY");
  */
 
+import { getRuntimeEnv } from "./otelAdapters";
+
 const textDecoder = new TextDecoder();
 const textEncoder = new TextEncoder();
 
@@ -150,10 +152,13 @@ export async function resolveSecret(
 }
 
 /**
- * Get an environment variable, checking process.env first, then .dev.vars file.
+ * Get an environment variable, checking process.env first, then .dev.vars file,
+ * then the Cloudflare Workers `env` binding stashed in RequestContext.
  * Cloudflare Workers dev mode stores env vars in .dev.vars but they're only
  * accessible via the `env` binding inside request handlers. During setup.ts
- * (module-level init), we need to read the file directly.
+ * (module-level init), we need to read the file directly. In production/preview
+ * there is no .dev.vars and no process.env — the only source is the `env` object
+ * passed to the fetch handler, which workerEntry.ts stashes via setRuntimeEnv().
  */
 function getEnvVar(name: string): string | undefined {
 	// 1. process.env (works in Node, may work in Workers with nodejs_compat)
@@ -181,5 +186,14 @@ function getEnvVar(name: string): string | undefined {
 		// fs not available (e.g., pure Worker runtime) — ignore
 	}
 
+	// 3. CF Workers `env` binding, stashed per-request in RequestContext by
+	// workerEntry.ts's setRuntimeEnv(env). This is the ONLY source in a real
+	// Workers production/preview deploy (no process.env, no .dev.vars). Returns
+	// undefined at module-init time (no active request) — that's why apps are
+	// re-configured on the first request via reconfigureAppsOnce().
+	const runtimeEnv = getRuntimeEnv();
+	const v = runtimeEnv?.[name];
+	if (typeof v === "string" && v) return v;
+
 	return undefined;
 }