@dereekb/firebase-server 13.1.0 → 13.2.0

package/src/lib/firestore/snapshot/snapshot.field.d.ts

@@ -0,0 +1,80 @@
+import { type Maybe, type Getter, type GetterOrValue } from '@dereekb/util';
+import { type FirestoreModelFieldMapFunctionsConfig } from '@dereekb/firebase';
+/**
+ * The source for the encryption secret.
+ *
+ * - If a string, it is used directly as the hex-encoded key (64 hex chars = 32 bytes).
+ * - If a Getter, it is called each time to retrieve the key (useful for rotation or lazy loading).
+ * - If an object with `env`, the key is read from the specified environment variable.
+ */
+export type FirestoreEncryptedFieldSecretSource = string | Getter<string> | {
+    env: string;
+};
+/**
+ * Configuration for encrypted Firestore fields.
+ *
+ * @template T - The JSON-serializable value type stored in the model.
+ */
+export interface FirestoreEncryptedFieldConfig<T> {
+    /**
+     * The encryption secret source.
+     *
+     * Expects a 64-character hex string representing a 32-byte AES-256 key.
+     */
+    readonly secret: FirestoreEncryptedFieldSecretSource;
+    /**
+     * Default model value when the Firestore data is null/undefined.
+     */
+    readonly default?: GetterOrValue<T>;
+}
+/**
+ * Configuration for optional encrypted Firestore fields.
+ *
+ * @template T - The JSON-serializable value type stored in the model.
+ */
+export interface OptionalFirestoreEncryptedFieldConfig<T> {
+    /**
+     * The encryption secret source.
+     *
+     * Expects a 64-character hex string representing a 32-byte AES-256 key.
+     */
+    readonly secret: FirestoreEncryptedFieldSecretSource;
+}
+/**
+ * Creates a Firestore field mapping that encrypts/decrypts a JSON-serializable value
+ * using AES-256-GCM. The value is stored in Firestore as a base64-encoded string.
+ *
+ * The encryption key is resolved from the configured secret source on each read/write,
+ * allowing for key rotation via environment variable changes.
+ *
+ * @example
+ * ```typescript
+ * const jwksField = firestoreEncryptedField<JWKSet>({
+ *   secret: { env: 'FIRESTORE_ENCRYPTION_KEY' },
+ *   default: () => ({ keys: [] })
+ * });
+ * ```
+ *
+ * @template T - The JSON-serializable value type.
+ * @param config - Encryption field configuration.
+ * @returns A field mapping configuration for encrypted values.
+ */
+export declare function firestoreEncryptedField<T>(config: FirestoreEncryptedFieldConfig<T>): FirestoreModelFieldMapFunctionsConfig<T, string>;
+/**
+ * Creates a Firestore field mapping for an optional encrypted field.
+ *
+ * When the value is null/undefined, it is stored/read as null. When present, it is
+ * encrypted/decrypted using AES-256-GCM.
+ *
+ * @example
+ * ```typescript
+ * const optionalSecretField = optionalFirestoreEncryptedField<OAuthClientSecret>({
+ *   secret: { env: 'FIRESTORE_ENCRYPTION_KEY' }
+ * });
+ * ```
+ *
+ * @template T - The JSON-serializable value type.
+ * @param config - Encryption field configuration.
+ * @returns A field mapping configuration for optional encrypted values.
+ */
+export declare function optionalFirestoreEncryptedField<T>(config: OptionalFirestoreEncryptedFieldConfig<T>): FirestoreModelFieldMapFunctionsConfig<Maybe<T>, Maybe<string>>;

package/test/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/firebase-server/test",
-  "version": "13.1.0",
+  "version": "13.2.0",
   "peerDependencies": {
-    "@dereekb/date": "13.1.0",
-    "@dereekb/firebase": "13.1.0",
-    "@dereekb/firebase-server": "13.1.0",
-    "@dereekb/model": "13.1.0",
-    "@dereekb/nestjs": "13.1.0",
-    "@dereekb/rxjs": "13.1.0",
-    "@dereekb/util": "13.1.0",
+    "@dereekb/date": "13.2.0",
+    "@dereekb/firebase": "13.2.0",
+    "@dereekb/firebase-server": "13.2.0",
+    "@dereekb/model": "13.2.0",
+    "@dereekb/nestjs": "13.2.0",
+    "@dereekb/rxjs": "13.2.0",
+    "@dereekb/util": "13.2.0",
     "@google-cloud/firestore": "^7.11.6",
     "@google-cloud/storage": "^7.19.0",
     "@nestjs/common": "^11.0.0",

package/zoho/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@dereekb/firebase-server/zoho",
-  "version": "13.1.0",
+  "version": "13.2.0",
   "peerDependencies": {
-    "@dereekb/date": "13.1.0",
-    "@dereekb/model": "13.1.0",
-    "@dereekb/nestjs": "13.1.0",
-    "@dereekb/rxjs": "13.1.0",
-    "@dereekb/firebase": "13.1.0",
-    "@dereekb/util": "13.1.0",
-    "@dereekb/zoho": "13.1.0"
+    "@dereekb/date": "13.2.0",
+    "@dereekb/model": "13.2.0",
+    "@dereekb/nestjs": "13.2.0",
+    "@dereekb/rxjs": "13.2.0",
+    "@dereekb/firebase": "13.2.0",
+    "@dereekb/util": "13.2.0",
+    "@dereekb/zoho": "13.2.0"
   },
   "exports": {
     "./package.json": "./package.json",