@memberjunction/encryption 5.15.0 → 5.16.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/EncryptionEngine.d.ts +48 -0
- package/dist/EncryptionEngine.d.ts.map +1 -1
- package/dist/EncryptionEngine.js +91 -2
- package/dist/EncryptionEngine.js.map +1 -1
- package/dist/EncryptionKeySourceBase.d.ts +33 -1
- package/dist/EncryptionKeySourceBase.d.ts.map +1 -1
- package/dist/EncryptionKeySourceBase.js.map +1 -1
- package/dist/EncryptionStartupValidator.d.ts +58 -0
- package/dist/EncryptionStartupValidator.d.ts.map +1 -0
- package/dist/EncryptionStartupValidator.js +185 -0
- package/dist/EncryptionStartupValidator.js.map +1 -0
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -1
- package/dist/interfaces.d.ts +23 -0
- package/dist/interfaces.d.ts.map +1 -1
- package/dist/providers/AWSKMSKeySource.d.ts +8 -0
- package/dist/providers/AWSKMSKeySource.d.ts.map +1 -1
- package/dist/providers/AWSKMSKeySource.js +76 -0
- package/dist/providers/AWSKMSKeySource.js.map +1 -1
- package/dist/providers/AzureKeyVaultKeySource.d.ts +8 -0
- package/dist/providers/AzureKeyVaultKeySource.d.ts.map +1 -1
- package/dist/providers/AzureKeyVaultKeySource.js +86 -2
- package/dist/providers/AzureKeyVaultKeySource.js.map +1 -1
- package/dist/providers/ConfigFileKeySource.d.ts +8 -0
- package/dist/providers/ConfigFileKeySource.d.ts.map +1 -1
- package/dist/providers/ConfigFileKeySource.js +65 -0
- package/dist/providers/ConfigFileKeySource.js.map +1 -1
- package/dist/providers/EnvVarKeySource.d.ts +8 -0
- package/dist/providers/EnvVarKeySource.d.ts.map +1 -1
- package/dist/providers/EnvVarKeySource.js +69 -0
- package/dist/providers/EnvVarKeySource.js.map +1 -1
- package/package.json +6 -6
package/dist/interfaces.d.ts
CHANGED
|
@@ -146,6 +146,29 @@ export interface KeyConfiguration {
|
|
|
146
146
|
lookupValue: string;
|
|
147
147
|
};
|
|
148
148
|
}
|
|
149
|
+
/**
|
|
150
|
+
* Result of validating whether a specific encryption key's material is accessible.
|
|
151
|
+
*
|
|
152
|
+
* Returned by {@link EncryptionKeySourceBase.ValidateKeyAccessibility}.
|
|
153
|
+
* Each key source provider generates source-specific error messages with
|
|
154
|
+
* actionable remediation steps, keeping that knowledge encapsulated
|
|
155
|
+
* within the provider rather than in the engine.
|
|
156
|
+
*/
|
|
157
|
+
export interface KeyValidationResult {
|
|
158
|
+
/** Whether the key material was successfully accessed and validated */
|
|
159
|
+
IsAccessible: boolean;
|
|
160
|
+
/**
|
|
161
|
+
* Human-readable error with source-specific remediation steps.
|
|
162
|
+
* Only present when IsAccessible is false.
|
|
163
|
+
*
|
|
164
|
+
* Examples:
|
|
165
|
+
* - EnvVar: 'Environment variable "MJ_BASE_ENCRYPTION_KEY" is not set. Set it with: export MJ_BASE_ENCRYPTION_KEY=$(openssl rand -base64 32)'
|
|
166
|
+
* - ConfigFile: 'Key "pii_master" not found in mj.config.cjs. Add it to the "encryptionKeys" section.'
|
|
167
|
+
* - AWS KMS: 'AWS KMS access denied. Ensure kms:Decrypt permission is granted.'
|
|
168
|
+
* - Azure: 'Azure Key Vault secret not accessible. Check vault URL and credentials.'
|
|
169
|
+
*/
|
|
170
|
+
Error?: string;
|
|
171
|
+
}
|
|
149
172
|
/**
|
|
150
173
|
* Result structure returned by key rotation operations.
|
|
151
174
|
*
|
package/dist/interfaces.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,yBAAyB;IACtC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC7B,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf,8BAA8B;IAC9B,SAAS,EAAE;QACP,0DAA0D;QAC1D,IAAI,EAAE,MAAM,CAAC;QAEb,uEAAuE;QACvE,cAAc,EAAE,MAAM,CAAC;QAEvB,0DAA0D;QAC1D,aAAa,EAAE,MAAM,CAAC;QAEtB,iEAAiE;QACjE,aAAa,EAAE,MAAM,CAAC;QAEtB;;;WAGG;QACH,MAAM,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF,2DAA2D;IAC3D,MAAM,EAAE;QACJ;;;WAGG;QACH,WAAW,EAAE,MAAM,CAAC;QAEpB;;;WAGG;QACH,WAAW,EAAE,MAAM,CAAC;KACvB,CAAC;CACL;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC5B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IAEjB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC5B,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IACxC,mDAAmD;IACnD,OAAO,EAAE,OAAO,CAAC;IAEjB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IAEzB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IAEvB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IACxC,yCAAyC;IACzC,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB"}
|
|
1
|
+
{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../src/interfaces.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,yBAAyB;IACtC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,mBAAmB;IAChC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,EAAE,EAAE,MAAM,CAAC;IAEX;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC7B,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf,8BAA8B;IAC9B,SAAS,EAAE;QACP,0DAA0D;QAC1D,IAAI,EAAE,MAAM,CAAC;QAEb,uEAAuE;QACvE,cAAc,EAAE,MAAM,CAAC;QAEvB,0DAA0D;QAC1D,aAAa,EAAE,MAAM,CAAC;QAEtB,iEAAiE;QACjE,aAAa,EAAE,MAAM,CAAC;QAEtB;;;WAGG;QACH,MAAM,EAAE,OAAO,CAAC;KACnB,CAAC;IAEF,2DAA2D;IAC3D,MAAM,EAAE;QACJ;;;WAGG;QACH,WAAW,EAAE,MAAM,CAAC;QAEpB;;;WAGG;QACH,WAAW,EAAE,MAAM,CAAC;KACvB,CAAC;CACL;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAChC,uEAAuE;IACvE,YAAY,EAAE,OAAO,CAAC;IAEtB;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC5B,kDAAkD;IAClD,OAAO,EAAE,OAAO,CAAC;IAEjB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;;OAGG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAE1B,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC5B,2CAA2C;IAC3C,eAAe,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IACxC,mDAAmD;IACnD,OAAO,EAAE,OAAO,CAAC;IAEjB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC;IAEzB,8DAA8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IAEvB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IACxC,yCAAyC;IACzC,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB"}
|
|
@@ -33,6 +33,7 @@
|
|
|
33
33
|
* @module @memberjunction/encryption
|
|
34
34
|
*/
|
|
35
35
|
import { EncryptionKeySourceBase } from '../EncryptionKeySourceBase.js';
|
|
36
|
+
import { KeyValidationResult } from '../interfaces.js';
|
|
36
37
|
/**
|
|
37
38
|
* AWS KMS key source provider.
|
|
38
39
|
*
|
|
@@ -101,6 +102,13 @@ export declare class AWSKMSKeySource extends EncryptionKeySourceBase {
|
|
|
101
102
|
* @throws Error if the key cannot be decrypted
|
|
102
103
|
*/
|
|
103
104
|
GetKey(lookupValue: string, _keyVersion?: string): Promise<Buffer>;
|
|
105
|
+
/**
|
|
106
|
+
* Validates that the AWS KMS key is accessible by attempting a decrypt operation.
|
|
107
|
+
*
|
|
108
|
+
* For envelope encryption, this decrypts the data key blob and validates its length.
|
|
109
|
+
* Key material is decoded internally for validation only — never returned to the caller.
|
|
110
|
+
*/
|
|
111
|
+
ValidateKeyAccessibility(lookupValue: string, _keyVersion?: string, expectedKeyLengthBytes?: number): Promise<KeyValidationResult>;
|
|
104
112
|
/**
|
|
105
113
|
* Cleans up the AWS KMS client.
|
|
106
114
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AWSKMSKeySource.d.ts","sourceRoot":"","sources":["../../src/providers/AWSKMSKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"AWSKMSKeySource.d.ts","sourceRoot":"","sources":["../../src/providers/AWSKMSKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAIH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAMpD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,eAAgB,SAAQ,uBAAuB;IACxD,OAAO,CAAC,OAAO,CAA6E;IAC5F,OAAO,CAAC,YAAY,CAAS;IAE7B;;OAEG;IACH,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;OAKG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BjC;;;;OAIG;IACH,qBAAqB,IAAI,OAAO;IAkBhC;;;;;;;;OAQG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAetD;;;;;;;;;;;;;;;;;OAiBG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAgExE;;;;;OAKG;IACG,wBAAwB,CAC1B,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,EACpB,sBAAsB,CAAC,EAAE,MAAM,GAChC,OAAO,CAAC,mBAAmB,CAAC;IA+E/B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAOjC"}
|
|
@@ -204,6 +204,82 @@ let AWSKMSKeySource = class AWSKMSKeySource extends EncryptionKeySourceBase {
|
|
|
204
204
|
throw new Error(`AWS KMS key retrieval failed: ${message}`);
|
|
205
205
|
}
|
|
206
206
|
}
|
|
207
|
+
/**
|
|
208
|
+
* Validates that the AWS KMS key is accessible by attempting a decrypt operation.
|
|
209
|
+
*
|
|
210
|
+
* For envelope encryption, this decrypts the data key blob and validates its length.
|
|
211
|
+
* Key material is decoded internally for validation only — never returned to the caller.
|
|
212
|
+
*/
|
|
213
|
+
async ValidateKeyAccessibility(lookupValue, _keyVersion, expectedKeyLengthBytes) {
|
|
214
|
+
try {
|
|
215
|
+
if (!this._initialized || !this._client) {
|
|
216
|
+
return {
|
|
217
|
+
IsAccessible: false,
|
|
218
|
+
Error: 'AWS KMS client not initialized. Ensure @aws-sdk/client-kms is installed ' +
|
|
219
|
+
'and AWS credentials are configured.'
|
|
220
|
+
};
|
|
221
|
+
}
|
|
222
|
+
const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION;
|
|
223
|
+
if (!region) {
|
|
224
|
+
return {
|
|
225
|
+
IsAccessible: false,
|
|
226
|
+
Error: 'No AWS region configured. Set AWS_REGION or AWS_DEFAULT_REGION environment variable.'
|
|
227
|
+
};
|
|
228
|
+
}
|
|
229
|
+
if (!lookupValue) {
|
|
230
|
+
return {
|
|
231
|
+
IsAccessible: false,
|
|
232
|
+
Error: 'AWS KMS lookup value is empty. Provide the base64-encoded encrypted data key (CiphertextBlob).'
|
|
233
|
+
};
|
|
234
|
+
}
|
|
235
|
+
// Attempt to decrypt the data key to verify accessibility
|
|
236
|
+
const ciphertextBlob = Buffer.from(lookupValue, 'base64');
|
|
237
|
+
const command = new DecryptCommand({
|
|
238
|
+
CiphertextBlob: Uint8Array.from(ciphertextBlob)
|
|
239
|
+
});
|
|
240
|
+
const response = await this._client.send(command);
|
|
241
|
+
if (!response.Plaintext) {
|
|
242
|
+
return {
|
|
243
|
+
IsAccessible: false,
|
|
244
|
+
Error: 'AWS KMS returned empty plaintext. The encrypted data key may be invalid.'
|
|
245
|
+
};
|
|
246
|
+
}
|
|
247
|
+
// Validate key length if expected length provided — key bytes stay local
|
|
248
|
+
if (expectedKeyLengthBytes !== undefined && response.Plaintext.length !== expectedKeyLengthBytes) {
|
|
249
|
+
return {
|
|
250
|
+
IsAccessible: false,
|
|
251
|
+
Error: `KMS data key is ${response.Plaintext.length} bytes but algorithm requires ${expectedKeyLengthBytes} bytes. ` +
|
|
252
|
+
`Regenerate the data key with the correct KeySpec.`
|
|
253
|
+
};
|
|
254
|
+
}
|
|
255
|
+
return { IsAccessible: true };
|
|
256
|
+
}
|
|
257
|
+
catch (err) {
|
|
258
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
259
|
+
if (message.includes('InvalidCiphertextException')) {
|
|
260
|
+
return {
|
|
261
|
+
IsAccessible: false,
|
|
262
|
+
Error: 'AWS KMS: Invalid ciphertext. Ensure the lookup value contains a valid base64-encoded encrypted data key.'
|
|
263
|
+
};
|
|
264
|
+
}
|
|
265
|
+
if (message.includes('AccessDeniedException')) {
|
|
266
|
+
return {
|
|
267
|
+
IsAccessible: false,
|
|
268
|
+
Error: 'AWS KMS: Access denied. Ensure the application has kms:Decrypt permission for the key.'
|
|
269
|
+
};
|
|
270
|
+
}
|
|
271
|
+
if (message.includes('NotFoundException')) {
|
|
272
|
+
return {
|
|
273
|
+
IsAccessible: false,
|
|
274
|
+
Error: 'AWS KMS: Key not found. Verify the key ARN/alias exists and is in the correct region.'
|
|
275
|
+
};
|
|
276
|
+
}
|
|
277
|
+
return {
|
|
278
|
+
IsAccessible: false,
|
|
279
|
+
Error: `AWS KMS key validation failed: ${message}`
|
|
280
|
+
};
|
|
281
|
+
}
|
|
282
|
+
}
|
|
207
283
|
/**
|
|
208
284
|
* Cleans up the AWS KMS client.
|
|
209
285
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AWSKMSKeySource.js","sourceRoot":"","sources":["../../src/providers/AWSKMSKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"AWSKMSKeySource.js","sourceRoot":"","sources":["../../src/providers/AWSKMSKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,wDAAwD;AACxD,IAAI,SAAS,GAA0D,IAAI,CAAC;AAC5E,IAAI,cAAc,GAA+D,IAAI,CAAC;AAEtF;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,uBAAuB;IAArD;;QACK,YAAO,GAAwE,IAAI,CAAC;QACpF,iBAAY,GAAG,KAAK,CAAC;IA+QjC,CAAC;IA7QG;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU;QACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,CAAC;YACD,oBAAoB;YACpB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACtD,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;YAChC,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC;YAE1C,8CAA8C;YAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAExE,IAAI,CAAC,OAAO,GAAG,IAAI,SAAS,CAAC;gBACzB,MAAM,EAAE,MAAM,IAAI,SAAS;aAC9B,CAAC,CAAC;YAEH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CACX,wCAAwC,OAAO,IAAI;gBACnD,0EAA0E,CAC7E,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,qBAAqB;QACjB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QACxE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,QAAQ,CACJ,gDAAgD;gBAChD,4DAA4D,CAC/D,CAAC;YACF,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,WAAmB;QAC/B,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,4CAA4C;QAC5C,6CAA6C;QAC7C,yDAAyD;QACzD,0BAA0B;QAC1B,MAAM,UAAU,GAAG,iDAAiD,CAAC;QACrE,MAAM,YAAY,GAAG,aAAa,CAAC;QAEnC,OAAO,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,WAAoB;QAClD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACX,8CAA8C;gBAC9C,iEAAiE,CACpE,CAAC;QACN,CAAC;QAED,IAAI,CAAC;YACD,gEAAgE;YAChE,kDAAkD;YAClD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAE1D,iCAAiC;YACjC,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC;gBAC/B,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;aAClD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAElD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,+BAA+B;YAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAE3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEjE,mDAAmD;YACnD,IAAI,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,KAAK,CACX,iDAAiD;oBACjD,6EAA6E,CAChF,CAAC;YACN,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CACX,yBAAyB;oBACzB,gEAAgE,CACnE,CAAC;YACN,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CACX,yBAAyB;oBACzB,+DAA+D,CAClE,CAAC;YACN,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB,CAC1B,WAAmB,EACnB,WAAoB,EACpB,sBAA+B;QAE/B,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACtC,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,0EAA0E;wBAC7E,qCAAqC;iBAC5C,CAAC;YACN,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACxE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,sFAAsF;iBAChG,CAAC;YACN,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,gGAAgG;iBAC1G,CAAC;YACN,CAAC;YAED,0DAA0D;YAC1D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,cAAe,CAAC;gBAChC,cAAc,EAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC;aAClD,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAElD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,0EAA0E;iBACpF,CAAC;YACN,CAAC;YAED,yEAAyE;YACzE,IAAI,sBAAsB,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;gBAC/F,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,mBAAmB,QAAQ,CAAC,SAAS,CAAC,MAAM,iCAAiC,sBAAsB,UAAU;wBAChH,mDAAmD;iBAC1D,CAAC;YACN,CAAC;YAED,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEjE,IAAI,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;gBACjD,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,0GAA0G;iBACpH,CAAC;YACN,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAC5C,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,wFAAwF;iBAClG,CAAC;YACN,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACxC,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,uFAAuF;iBACjG,CAAC;YACN,CAAC;YAED,OAAO;gBACH,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,kCAAkC,OAAO,EAAE;aACrD,CAAC;QACN,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACT,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;IAC9B,CAAC;CACJ,CAAA;AAjRY,eAAe;IAD3B,aAAa,CAAC,uBAAuB,EAAE,iBAAiB,CAAC;GAC7C,eAAe,CAiR3B"}
|
|
@@ -37,6 +37,7 @@
|
|
|
37
37
|
* @module @memberjunction/encryption
|
|
38
38
|
*/
|
|
39
39
|
import { EncryptionKeySourceBase } from '../EncryptionKeySourceBase.js';
|
|
40
|
+
import { KeyValidationResult } from '../interfaces.js';
|
|
40
41
|
/**
|
|
41
42
|
* Azure Key Vault key source provider.
|
|
42
43
|
*
|
|
@@ -94,6 +95,13 @@ export declare class AzureKeyVaultKeySource extends EncryptionKeySourceBase {
|
|
|
94
95
|
* @throws Error if the secret cannot be retrieved
|
|
95
96
|
*/
|
|
96
97
|
GetKey(lookupValue: string, keyVersion?: string): Promise<Buffer>;
|
|
98
|
+
/**
|
|
99
|
+
* Validates that the Azure Key Vault secret is accessible and usable.
|
|
100
|
+
*
|
|
101
|
+
* Attempts to retrieve the secret and validate its format and length.
|
|
102
|
+
* Key material is decoded internally for validation only — never returned to the caller.
|
|
103
|
+
*/
|
|
104
|
+
ValidateKeyAccessibility(lookupValue: string, keyVersion?: string, expectedKeyLengthBytes?: number): Promise<KeyValidationResult>;
|
|
97
105
|
/**
|
|
98
106
|
* Parses a lookup value into vault URL and secret name.
|
|
99
107
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AzureKeyVaultKeySource.d.ts","sourceRoot":"","sources":["../../src/providers/AzureKeyVaultKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"AzureKeyVaultKeySource.d.ts","sourceRoot":"","sources":["../../src/providers/AzureKeyVaultKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAMpD;;;;;;;;;;;;;;;;;;GAkBG;AACH,qBACa,sBAAuB,SAAQ,uBAAuB;IAC/D,OAAO,CAAC,QAAQ,CAA+F;IAC/G,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,gBAAgB,CAAuB;IAE/C;;OAEG;IACH,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;OAKG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IA2BjC;;;;OAIG;IACH,qBAAqB,IAAI,OAAO;IAShC;;;;;OAKG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAsBtD;;;;;;;;OAQG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6EvE;;;;;OAKG;IACG,wBAAwB,CAC1B,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,sBAAsB,CAAC,EAAE,MAAM,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAoF/B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAgCxB;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAIjC"}
|
|
@@ -205,6 +205,86 @@ let AzureKeyVaultKeySource = class AzureKeyVaultKeySource extends EncryptionKeyS
|
|
|
205
205
|
throw new Error(`Azure Key Vault key retrieval failed: ${message}`);
|
|
206
206
|
}
|
|
207
207
|
}
|
|
208
|
+
/**
|
|
209
|
+
* Validates that the Azure Key Vault secret is accessible and usable.
|
|
210
|
+
*
|
|
211
|
+
* Attempts to retrieve the secret and validate its format and length.
|
|
212
|
+
* Key material is decoded internally for validation only — never returned to the caller.
|
|
213
|
+
*/
|
|
214
|
+
async ValidateKeyAccessibility(lookupValue, keyVersion, expectedKeyLengthBytes) {
|
|
215
|
+
try {
|
|
216
|
+
if (!this._initialized || !SecretClient || !DefaultAzureCredential) {
|
|
217
|
+
return {
|
|
218
|
+
IsAccessible: false,
|
|
219
|
+
Error: 'Azure Key Vault client not initialized. Ensure @azure/keyvault-secrets and ' +
|
|
220
|
+
'@azure/identity are installed and Azure credentials are configured.'
|
|
221
|
+
};
|
|
222
|
+
}
|
|
223
|
+
if (!lookupValue) {
|
|
224
|
+
return {
|
|
225
|
+
IsAccessible: false,
|
|
226
|
+
Error: 'Azure Key Vault lookup value is empty. Provide the secret URL or name.'
|
|
227
|
+
};
|
|
228
|
+
}
|
|
229
|
+
// Parse and attempt to retrieve the secret
|
|
230
|
+
const { vaultUrl, secretName } = this.parseLookupValue(lookupValue);
|
|
231
|
+
let client = this._clients.get(vaultUrl);
|
|
232
|
+
if (!client) {
|
|
233
|
+
const credential = new DefaultAzureCredential();
|
|
234
|
+
client = new SecretClient(vaultUrl, credential);
|
|
235
|
+
this._clients.set(vaultUrl, client);
|
|
236
|
+
}
|
|
237
|
+
const options = keyVersion ? { version: keyVersion } : {};
|
|
238
|
+
const secret = await client.getSecret(secretName, options);
|
|
239
|
+
if (!secret.value) {
|
|
240
|
+
return {
|
|
241
|
+
IsAccessible: false,
|
|
242
|
+
Error: `Secret "${secretName}" in vault has no value. Store a base64-encoded encryption key.`
|
|
243
|
+
};
|
|
244
|
+
}
|
|
245
|
+
// Decode and validate — key bytes stay local, never returned
|
|
246
|
+
const keyBytes = Buffer.from(secret.value, 'base64');
|
|
247
|
+
if (keyBytes.length === 0) {
|
|
248
|
+
return {
|
|
249
|
+
IsAccessible: false,
|
|
250
|
+
Error: `Secret "${secretName}" is not valid base64. Store a base64-encoded key value.`
|
|
251
|
+
};
|
|
252
|
+
}
|
|
253
|
+
if (expectedKeyLengthBytes !== undefined && keyBytes.length !== expectedKeyLengthBytes) {
|
|
254
|
+
return {
|
|
255
|
+
IsAccessible: false,
|
|
256
|
+
Error: `Secret "${secretName}" is ${keyBytes.length} bytes but algorithm requires ${expectedKeyLengthBytes} bytes. ` +
|
|
257
|
+
`Store a correctly-sized key: openssl rand -base64 ${expectedKeyLengthBytes}`
|
|
258
|
+
};
|
|
259
|
+
}
|
|
260
|
+
return { IsAccessible: true };
|
|
261
|
+
}
|
|
262
|
+
catch (err) {
|
|
263
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
264
|
+
if (message.includes('SecretNotFound')) {
|
|
265
|
+
return {
|
|
266
|
+
IsAccessible: false,
|
|
267
|
+
Error: `Azure Key Vault secret not found: "${lookupValue}". Verify the secret exists in the vault.`
|
|
268
|
+
};
|
|
269
|
+
}
|
|
270
|
+
if (message.includes('Forbidden') || message.includes('AccessDenied')) {
|
|
271
|
+
return {
|
|
272
|
+
IsAccessible: false,
|
|
273
|
+
Error: `Azure Key Vault access denied for "${lookupValue}". Ensure the application has Secret Get permission.`
|
|
274
|
+
};
|
|
275
|
+
}
|
|
276
|
+
if (message.includes('AuthenticationError')) {
|
|
277
|
+
return {
|
|
278
|
+
IsAccessible: false,
|
|
279
|
+
Error: 'Azure authentication failed. Ensure credentials are configured (managed identity, service principal, or Azure CLI).'
|
|
280
|
+
};
|
|
281
|
+
}
|
|
282
|
+
return {
|
|
283
|
+
IsAccessible: false,
|
|
284
|
+
Error: `Azure Key Vault key validation failed: ${message}`
|
|
285
|
+
};
|
|
286
|
+
}
|
|
287
|
+
}
|
|
208
288
|
/**
|
|
209
289
|
* Parses a lookup value into vault URL and secret name.
|
|
210
290
|
*
|
|
@@ -220,7 +300,10 @@ let AzureKeyVaultKeySource = class AzureKeyVaultKeySource extends EncryptionKeyS
|
|
|
220
300
|
};
|
|
221
301
|
}
|
|
222
302
|
// Simple name format (requires AZURE_KEYVAULT_URL)
|
|
223
|
-
|
|
303
|
+
// Validate secret name matches Azure's allowed pattern to prevent
|
|
304
|
+
// path traversal or injection via crafted lookup values
|
|
305
|
+
const secretNamePattern = /^[a-zA-Z0-9-]+$/;
|
|
306
|
+
if (this._defaultVaultUrl && secretNamePattern.test(lookupValue)) {
|
|
224
307
|
return {
|
|
225
308
|
vaultUrl: this._defaultVaultUrl,
|
|
226
309
|
secretName: lookupValue
|
|
@@ -228,7 +311,8 @@ let AzureKeyVaultKeySource = class AzureKeyVaultKeySource extends EncryptionKeyS
|
|
|
228
311
|
}
|
|
229
312
|
throw new Error(`Invalid Key Vault lookup value: "${lookupValue}". ` +
|
|
230
313
|
`Expected format: https://vault-name.vault.azure.net/secrets/secret-name ` +
|
|
231
|
-
`or set AZURE_KEYVAULT_URL and provide
|
|
314
|
+
`or set AZURE_KEYVAULT_URL and provide a valid secret name ` +
|
|
315
|
+
`(alphanumeric characters and hyphens only).`);
|
|
232
316
|
}
|
|
233
317
|
/**
|
|
234
318
|
* Cleans up Azure Key Vault clients.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"AzureKeyVaultKeySource.js","sourceRoot":"","sources":["../../src/providers/AzureKeyVaultKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"AzureKeyVaultKeySource.js","sourceRoot":"","sources":["../../src/providers/AzureKeyVaultKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAGrE,0DAA0D;AAC1D,IAAI,YAAY,GAAiE,IAAI,CAAC;AACtF,IAAI,sBAAsB,GAAmE,IAAI,CAAC;AAElG;;;;;;;;;;;;;;;;;;GAkBG;AAEI,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,uBAAuB;IAA5D;;QACK,aAAQ,GAAqF,IAAI,GAAG,EAAE,CAAC;QACvG,iBAAY,GAAG,KAAK,CAAC;QACrB,qBAAgB,GAAkB,IAAI,CAAC;IAoTnD,CAAC;IAlTG;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,iBAAiB,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU;QACZ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO;QACX,CAAC;QAED,IAAI,CAAC;YACD,uBAAuB;YACvB,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YAC9D,MAAM,cAAc,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAEvD,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;YAC1C,sBAAsB,GAAG,cAAc,CAAC,sBAAsB,CAAC;YAE/D,sCAAsC;YACtC,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC;YAE/D,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CACX,gDAAgD,OAAO,IAAI;gBAC3D,oEAAoE;gBACpE,qDAAqD,CACxD,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,qBAAqB;QACjB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,sEAAsE;QACtE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,WAAmB;QAC/B,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,2BAA2B;QAC3B,mEAAmE;QACnE,iEAAiE;QACjE,MAAM,UAAU,GAAG,qEAAqE,CAAC;QACzF,MAAM,WAAW,GAAG,iBAAiB,CAAC;QAEtC,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,UAAmB;QACjD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAC5B,CAAC;QAED,IAAI,CAAC,YAAY,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACX,sDAAsD;gBACtD,iCAAiC,CACpC,CAAC;QACN,CAAC;QAED,IAAI,CAAC;YACD,0DAA0D;YAC1D,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEpE,sCAAsC;YACtC,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,MAAM,UAAU,GAAG,IAAI,sBAAsB,EAAE,CAAC;gBAChD,MAAM,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAED,uBAAuB;YACvB,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAE1D,iBAAiB;YACjB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAE3D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,WAAW,UAAU,gBAAgB,CAAC,CAAC;YAC3D,CAAC;YAED,qDAAqD;YACrD,IAAI,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACL,MAAM,IAAI,KAAK,CACX,WAAW,UAAU,yBAAyB;oBAC9C,wEAAwE,CAC3E,CAAC;YACN,CAAC;QAEL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEjE,mDAAmD;YACnD,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACX,qCAAqC,WAAW,IAAI;oBACpD,wCAAwC,CAC3C,CAAC;YACN,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACX,sCAAsC,WAAW,IAAI;oBACrD,mDAAmD,CACtD,CAAC;YACN,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACX,+BAA+B;oBAC/B,wFAAwF,CAC3F,CAAC;YACN,CAAC;YAED,MAAM,IAAI,KAAK,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB,CAC1B,WAAmB,EACnB,UAAmB,EACnB,sBAA+B;QAE/B,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACjE,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,6EAA6E;wBAChF,qEAAqE;iBAC5E,CAAC;YACN,CAAC;YAED,IAAI,CAAC,WAAW,EAAE,CAAC;gBACf,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,wEAAwE;iBAClF,CAAC;YACN,CAAC;YAED,2CAA2C;YAC3C,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAEpE,IAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,MAAM,UAAU,GAAG,IAAI,sBAAsB,EAAE,CAAC;gBAChD,MAAM,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAE3D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,WAAW,UAAU,iEAAiE;iBAChG,CAAC;YACN,CAAC;YAED,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,WAAW,UAAU,0DAA0D;iBACzF,CAAC;YACN,CAAC;YAED,IAAI,sBAAsB,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;gBACrF,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,WAAW,UAAU,QAAQ,QAAQ,CAAC,MAAM,iCAAiC,sBAAsB,UAAU;wBAChH,qDAAqD,sBAAsB,EAAE;iBACpF,CAAC;YACN,CAAC;YAED,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEjE,IAAI,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACrC,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,sCAAsC,WAAW,2CAA2C;iBACtG,CAAC;YACN,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBACpE,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,sCAAsC,WAAW,sDAAsD;iBACjH,CAAC;YACN,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC1C,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,qHAAqH;iBAC/H,CAAC;YACN,CAAC;YAED,OAAO;gBACH,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,0CAA0C,OAAO,EAAE;aAC7D,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,WAAmB;QACxC,oFAAoF;QACpF,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAC9B,yEAAyE,CAC5E,CAAC;QAEF,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO;gBACH,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACrB,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;aAC1B,CAAC;QACN,CAAC;QAED,mDAAmD;QACnD,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;QAC5C,IAAI,IAAI,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,OAAO;gBACH,QAAQ,EAAE,IAAI,CAAC,gBAAgB;gBAC/B,UAAU,EAAE,WAAW;aAC1B,CAAC;QACN,CAAC;QAED,MAAM,IAAI,KAAK,CACX,oCAAoC,WAAW,KAAK;YACpD,0EAA0E;YAC1E,4DAA4D;YAC5D,6CAA6C,CAChD,CAAC;IACN,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACT,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;IAC9B,CAAC;CACJ,CAAA;AAvTY,sBAAsB;IADlC,aAAa,CAAC,uBAAuB,EAAE,wBAAwB,CAAC;GACpD,sBAAsB,CAuTlC"}
|
|
@@ -48,6 +48,7 @@
|
|
|
48
48
|
* @module @memberjunction/encryption
|
|
49
49
|
*/
|
|
50
50
|
import { EncryptionKeySourceBase } from '../EncryptionKeySourceBase.js';
|
|
51
|
+
import { KeyValidationResult } from '../interfaces.js';
|
|
51
52
|
/**
|
|
52
53
|
* Encryption key source that retrieves keys from configuration files.
|
|
53
54
|
*
|
|
@@ -145,6 +146,13 @@ export declare class ConfigFileKeySource extends EncryptionKeySourceBase {
|
|
|
145
146
|
* ```
|
|
146
147
|
*/
|
|
147
148
|
GetKey(lookupValue: string, keyVersion?: string): Promise<Buffer>;
|
|
149
|
+
/**
|
|
150
|
+
* Validates that the encryption key in the config file is accessible and usable.
|
|
151
|
+
*
|
|
152
|
+
* Checks: config loaded, key exists, valid base64, and (if specified) correct length.
|
|
153
|
+
* Key material is decoded internally for validation only — never returned to the caller.
|
|
154
|
+
*/
|
|
155
|
+
ValidateKeyAccessibility(lookupValue: string, keyVersion?: string, expectedKeyLengthBytes?: number): Promise<KeyValidationResult>;
|
|
148
156
|
/**
|
|
149
157
|
* Cleans up resources (no-op for config file source).
|
|
150
158
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ConfigFileKeySource.d.ts","sourceRoot":"","sources":["../../src/providers/ConfigFileKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"ConfigFileKeySource.d.ts","sourceRoot":"","sources":["../../src/providers/ConfigFileKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAapD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,qBACa,mBAAoB,SAAQ,uBAAuB;IAC5D;;;;;OAKG;IACH,OAAO,CAAC,aAAa,CAAuC;IAE5D;;;;OAIG;IACH,OAAO,CAAC,eAAe,CAAuB;IAE9C;;OAEG;IACH,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;;;OAOG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAyCjC;;;;OAIG;IACH,qBAAqB,IAAI,OAAO;IAIhC;;;;;OAKG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBtD;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6EvE;;;;;OAKG;IACG,wBAAwB,CAC1B,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,sBAAsB,CAAC,EAAE,MAAM,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAkE/B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAK9B;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;IAUpB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;CAczB"}
|
|
@@ -256,6 +256,71 @@ let ConfigFileKeySource = class ConfigFileKeySource extends EncryptionKeySourceB
|
|
|
256
256
|
'Generate a valid key with: openssl rand -base64 32');
|
|
257
257
|
}
|
|
258
258
|
}
|
|
259
|
+
/**
|
|
260
|
+
* Validates that the encryption key in the config file is accessible and usable.
|
|
261
|
+
*
|
|
262
|
+
* Checks: config loaded, key exists, valid base64, and (if specified) correct length.
|
|
263
|
+
* Key material is decoded internally for validation only — never returned to the caller.
|
|
264
|
+
*/
|
|
265
|
+
async ValidateKeyAccessibility(lookupValue, keyVersion, expectedKeyLengthBytes) {
|
|
266
|
+
try {
|
|
267
|
+
if (!this._loadedConfig) {
|
|
268
|
+
const configPath = this._configFilePath || 'mj.config.cjs';
|
|
269
|
+
return {
|
|
270
|
+
IsAccessible: false,
|
|
271
|
+
Error: `Configuration file not loaded. Ensure ${configPath} exists with an "encryptionKeys" section.\n` +
|
|
272
|
+
` module.exports = { encryptionKeys: { "${lookupValue}": "<base64-key>" } };`
|
|
273
|
+
};
|
|
274
|
+
}
|
|
275
|
+
if (!lookupValue || !this.isValidKeyName(lookupValue)) {
|
|
276
|
+
return {
|
|
277
|
+
IsAccessible: false,
|
|
278
|
+
Error: `Invalid key name: "${lookupValue}". Key names must start with a letter or underscore.`
|
|
279
|
+
};
|
|
280
|
+
}
|
|
281
|
+
const keyName = this.buildKeyName(lookupValue, keyVersion);
|
|
282
|
+
const keyValue = this._loadedConfig[keyName];
|
|
283
|
+
if (keyValue === undefined || keyValue === null) {
|
|
284
|
+
return {
|
|
285
|
+
IsAccessible: false,
|
|
286
|
+
Error: `Key "${keyName}" not found in ${this._configFilePath || 'mj.config.cjs'}. ` +
|
|
287
|
+
`Add it to the "encryptionKeys" section:\n` +
|
|
288
|
+
` encryptionKeys: { "${keyName}": "$(openssl rand -base64 ${expectedKeyLengthBytes || 32})" }`
|
|
289
|
+
};
|
|
290
|
+
}
|
|
291
|
+
if (keyValue.trim() === '') {
|
|
292
|
+
return {
|
|
293
|
+
IsAccessible: false,
|
|
294
|
+
Error: `Key "${keyName}" in configuration file is empty. ` +
|
|
295
|
+
`Set it to a base64-encoded key: openssl rand -base64 ${expectedKeyLengthBytes || 32}`
|
|
296
|
+
};
|
|
297
|
+
}
|
|
298
|
+
// Decode and validate — key bytes stay local, never returned
|
|
299
|
+
const keyBytes = Buffer.from(keyValue, 'base64');
|
|
300
|
+
if (keyBytes.length === 0) {
|
|
301
|
+
return {
|
|
302
|
+
IsAccessible: false,
|
|
303
|
+
Error: `Key "${keyName}" in configuration file is not valid base64. ` +
|
|
304
|
+
`Generate a key with: openssl rand -base64 ${expectedKeyLengthBytes || 32}`
|
|
305
|
+
};
|
|
306
|
+
}
|
|
307
|
+
if (expectedKeyLengthBytes !== undefined && keyBytes.length !== expectedKeyLengthBytes) {
|
|
308
|
+
return {
|
|
309
|
+
IsAccessible: false,
|
|
310
|
+
Error: `Key "${keyName}" is ${keyBytes.length} bytes but algorithm requires ${expectedKeyLengthBytes} bytes. ` +
|
|
311
|
+
`Generate a correctly-sized key with: openssl rand -base64 ${expectedKeyLengthBytes}`
|
|
312
|
+
};
|
|
313
|
+
}
|
|
314
|
+
return { IsAccessible: true };
|
|
315
|
+
}
|
|
316
|
+
catch (err) {
|
|
317
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
318
|
+
return {
|
|
319
|
+
IsAccessible: false,
|
|
320
|
+
Error: `Failed to validate key "${lookupValue}" in configuration file: ${message}`
|
|
321
|
+
};
|
|
322
|
+
}
|
|
323
|
+
}
|
|
259
324
|
/**
|
|
260
325
|
* Cleans up resources (no-op for config file source).
|
|
261
326
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"ConfigFileKeySource.js","sourceRoot":"","sources":["../../src/providers/ConfigFileKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"ConfigFileKeySource.js","sourceRoot":"","sources":["../../src/providers/ConfigFileKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAY9C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,uBAAuB;IAAzD;;QACH;;;;;WAKG;QACK,kBAAa,GAAkC,IAAI,CAAC;QAE5D;;;;WAIG;QACK,oBAAe,GAAkB,IAAI,CAAC;IAgUlD,CAAC;IA9TG;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,oBAAoB,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU;QACZ,IAAI,CAAC;YACD,MAAM,QAAQ,GAAwB,eAAe,CAAC,IAAI,EAAE;gBACxD,cAAc,EAAE,QAAQ;aAC3B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YAEjC,IAAI,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;gBAE1C,+DAA+D;gBAC/D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBAC5C,MAAM,IAAI,KAAK,CACX,6EAA6E,CAChF,CAAC;gBACN,CAAC;gBAED,wBAAwB;gBACxB,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;oBAChF,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBAC/B,MAAM,IAAI,KAAK,CACX,gBAAgB,OAAO,uBAAuB;4BAC9C,+BAA+B,OAAO,QAAQ,EAAE,CACnD,CAAC;oBACN,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,aAAa,GAAG,IAA8B,CAAC;gBACpD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC3C,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,gEAAgE;YAChE,0DAA0D;YAC1D,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CACR,sDAAsD,OAAO,EAAE,CAClE,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,qBAAqB;QACjB,OAAO,IAAI,CAAC,aAAa,KAAK,IAAI,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,WAAmB;QAC/B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,UAAmB;QACjD,uBAAuB;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC;YAC3D,MAAM,IAAI,KAAK,CACX,oEAAoE;gBACpE,2BAA2B,UAAU,6CAA6C;gBAClF,YAAY;gBACZ,sBAAsB;gBACtB,uBAAuB;gBACvB,2CAA2C;gBAC3C,OAAO;gBACP,IAAI,CACP,CAAC;QACN,CAAC;QAED,wBAAwB;QACxB,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACX,8CAA8C;gBAC9C,uEAAuE,CAC1E,CAAC;QACN,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACX,sBAAsB,WAAW,KAAK;gBACtC,oEAAoE;gBACpE,oCAAoC,CACvC,CAAC;QACN,CAAC;QAED,uCAAuC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAE3D,qBAAqB;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAE7C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACX,mBAAmB,OAAO,qCAAqC;gBAC/D,6CAA6C,IAAI,CAAC,eAAe,IAAI,eAAe,IAAI;gBACxF,YAAY;gBACZ,qBAAqB;gBACrB,MAAM,OAAO,2BAA2B;gBACxC,OAAO;gBACP,8CAA8C,CACjD,CAAC;QACN,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACX,mBAAmB,OAAO,oCAAoC;gBAC9D,mDAAmD,CACtD,CAAC;QACN,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAEjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5C,CAAC;YAED,OAAO,QAAQ,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CACX,oCAAoC,OAAO,2BAA2B;gBACtE,2DAA2D,OAAO,IAAI;gBACtE,oDAAoD,CACvD,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB,CAC1B,WAAmB,EACnB,UAAmB,EACnB,sBAA+B;QAE/B,IAAI,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACtB,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC;gBAC3D,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,yCAAyC,UAAU,6CAA6C;wBACnG,2CAA2C,WAAW,wBAAwB;iBACrF,CAAC;YACN,CAAC;YAED,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpD,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,sBAAsB,WAAW,sDAAsD;iBACjG,CAAC;YACN,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAE7C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC9C,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,QAAQ,OAAO,kBAAkB,IAAI,CAAC,eAAe,IAAI,eAAe,IAAI;wBAC/E,2CAA2C;wBAC3C,wBAAwB,OAAO,8BAA8B,sBAAsB,IAAI,EAAE,MAAM;iBACtG,CAAC;YACN,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACzB,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,QAAQ,OAAO,oCAAoC;wBACtD,wDAAwD,sBAAsB,IAAI,EAAE,EAAE;iBAC7F,CAAC;YACN,CAAC;YAED,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,QAAQ,OAAO,+CAA+C;wBACjE,6CAA6C,sBAAsB,IAAI,EAAE,EAAE;iBAClF,CAAC;YACN,CAAC;YAED,IAAI,sBAAsB,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;gBACrF,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,QAAQ,OAAO,QAAQ,QAAQ,CAAC,MAAM,iCAAiC,sBAAsB,UAAU;wBAC1G,6DAA6D,sBAAsB,EAAE;iBAC5F,CAAC;YACN,CAAC;YAED,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO;gBACH,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,2BAA2B,WAAW,4BAA4B,OAAO,EAAE;aACrF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO;QACT,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAChC,CAAC;IAED;;;;;;;;OAQG;IACK,YAAY,CAAC,QAAgB,EAAE,UAAmB;QACtD,4CAA4C;QAC5C,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,sEAAsE;QACtE,OAAO,GAAG,QAAQ,KAAK,UAAU,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;OAOG;IACK,cAAc,CAAC,IAAY;QAC/B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,+CAA+C;QAC/C,uCAAuC;QACvC,MAAM,cAAc,GAAG,2BAA2B,CAAC;QACnD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACJ,CAAA;AA9UY,mBAAmB;IAD/B,aAAa,CAAC,uBAAuB,EAAE,qBAAqB,CAAC;GACjD,mBAAmB,CA8U/B"}
|
|
@@ -44,6 +44,7 @@
|
|
|
44
44
|
* @module @memberjunction/encryption
|
|
45
45
|
*/
|
|
46
46
|
import { EncryptionKeySourceBase } from '../EncryptionKeySourceBase.js';
|
|
47
|
+
import { KeyValidationResult } from '../interfaces.js';
|
|
47
48
|
/**
|
|
48
49
|
* Encryption key source that retrieves keys from environment variables.
|
|
49
50
|
*
|
|
@@ -121,6 +122,13 @@ export declare class EnvVarKeySource extends EncryptionKeySourceBase {
|
|
|
121
122
|
* ```
|
|
122
123
|
*/
|
|
123
124
|
GetKey(lookupValue: string, keyVersion?: string): Promise<Buffer>;
|
|
125
|
+
/**
|
|
126
|
+
* Validates that the encryption key in the specified environment variable is accessible and usable.
|
|
127
|
+
*
|
|
128
|
+
* Checks: env var exists, is non-empty, contains valid base64, and (if specified) has correct length.
|
|
129
|
+
* Key material is decoded internally for validation only — never returned to the caller.
|
|
130
|
+
*/
|
|
131
|
+
ValidateKeyAccessibility(lookupValue: string, keyVersion?: string, expectedKeyLengthBytes?: number): Promise<KeyValidationResult>;
|
|
124
132
|
/**
|
|
125
133
|
* Builds the full environment variable name with optional version suffix.
|
|
126
134
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"EnvVarKeySource.d.ts","sourceRoot":"","sources":["../../src/providers/EnvVarKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"EnvVarKeySource.d.ts","sourceRoot":"","sources":["../../src/providers/EnvVarKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,qBACa,eAAgB,SAAQ,uBAAuB;IACxD;;OAEG;IACH,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;;;;OAQG;IACH,qBAAqB,IAAI,OAAO;IAMhC;;;;;OAKG;IACG,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAatD;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAsEvE;;;;;OAKG;IACG,wBAAwB,CAC1B,WAAW,EAAE,MAAM,EACnB,UAAU,CAAC,EAAE,MAAM,EACnB,sBAAsB,CAAC,EAAE,MAAM,GAChC,OAAO,CAAC,mBAAmB,CAAC;IAsE/B;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAUvB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;CAiB5B"}
|
|
@@ -193,6 +193,75 @@ let EnvVarKeySource = class EnvVarKeySource extends EncryptionKeySourceBase {
|
|
|
193
193
|
'Generate a valid key with: openssl rand -base64 32');
|
|
194
194
|
}
|
|
195
195
|
}
|
|
196
|
+
/**
|
|
197
|
+
* Validates that the encryption key in the specified environment variable is accessible and usable.
|
|
198
|
+
*
|
|
199
|
+
* Checks: env var exists, is non-empty, contains valid base64, and (if specified) has correct length.
|
|
200
|
+
* Key material is decoded internally for validation only — never returned to the caller.
|
|
201
|
+
*/
|
|
202
|
+
async ValidateKeyAccessibility(lookupValue, keyVersion, expectedKeyLengthBytes) {
|
|
203
|
+
try {
|
|
204
|
+
if (!lookupValue || !this.isValidEnvVarName(lookupValue)) {
|
|
205
|
+
return {
|
|
206
|
+
IsAccessible: false,
|
|
207
|
+
Error: `Invalid environment variable name: "${lookupValue}". ` +
|
|
208
|
+
'Names must start with a letter or underscore and contain only letters, numbers, and underscores.'
|
|
209
|
+
};
|
|
210
|
+
}
|
|
211
|
+
const envVarName = this.buildEnvVarName(lookupValue, keyVersion);
|
|
212
|
+
const keyValue = process.env[envVarName];
|
|
213
|
+
if (keyValue === undefined || keyValue === null) {
|
|
214
|
+
return {
|
|
215
|
+
IsAccessible: false,
|
|
216
|
+
Error: `Environment variable "${envVarName}" is not set. ` +
|
|
217
|
+
`Set it with a base64-encoded key value:\n` +
|
|
218
|
+
` export ${envVarName}=$(openssl rand -base64 ${expectedKeyLengthBytes || 32})`
|
|
219
|
+
};
|
|
220
|
+
}
|
|
221
|
+
if (keyValue.trim() === '') {
|
|
222
|
+
return {
|
|
223
|
+
IsAccessible: false,
|
|
224
|
+
Error: `Environment variable "${envVarName}" is empty. ` +
|
|
225
|
+
`Set it with: export ${envVarName}=$(openssl rand -base64 ${expectedKeyLengthBytes || 32})`
|
|
226
|
+
};
|
|
227
|
+
}
|
|
228
|
+
// Decode and validate — key bytes stay local, never returned
|
|
229
|
+
const keyBytes = Buffer.from(keyValue, 'base64');
|
|
230
|
+
if (keyBytes.length === 0) {
|
|
231
|
+
return {
|
|
232
|
+
IsAccessible: false,
|
|
233
|
+
Error: `Environment variable "${envVarName}" does not contain valid base64 data. ` +
|
|
234
|
+
`Generate a key with: openssl rand -base64 ${expectedKeyLengthBytes || 32}`
|
|
235
|
+
};
|
|
236
|
+
}
|
|
237
|
+
// Round-trip check: Node's Buffer.from(str,'base64') silently ignores
|
|
238
|
+
// non-base64 characters, so verify the value actually was valid base64
|
|
239
|
+
const roundTrip = keyBytes.toString('base64');
|
|
240
|
+
const normalized = keyValue.replace(/\s+/g, '');
|
|
241
|
+
if (roundTrip !== normalized && roundTrip + '=' !== normalized && roundTrip + '==' !== normalized) {
|
|
242
|
+
return {
|
|
243
|
+
IsAccessible: false,
|
|
244
|
+
Error: `Environment variable "${envVarName}" does not contain valid base64 encoding. ` +
|
|
245
|
+
`Generate a key with: openssl rand -base64 ${expectedKeyLengthBytes || 32}`
|
|
246
|
+
};
|
|
247
|
+
}
|
|
248
|
+
if (expectedKeyLengthBytes !== undefined && keyBytes.length !== expectedKeyLengthBytes) {
|
|
249
|
+
return {
|
|
250
|
+
IsAccessible: false,
|
|
251
|
+
Error: `Key in "${envVarName}" is ${keyBytes.length} bytes but algorithm requires ${expectedKeyLengthBytes} bytes. ` +
|
|
252
|
+
`Generate a correctly-sized key with: openssl rand -base64 ${expectedKeyLengthBytes}`
|
|
253
|
+
};
|
|
254
|
+
}
|
|
255
|
+
return { IsAccessible: true };
|
|
256
|
+
}
|
|
257
|
+
catch (err) {
|
|
258
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
259
|
+
return {
|
|
260
|
+
IsAccessible: false,
|
|
261
|
+
Error: `Failed to validate key in environment variable "${lookupValue}": ${message}`
|
|
262
|
+
};
|
|
263
|
+
}
|
|
264
|
+
}
|
|
196
265
|
/**
|
|
197
266
|
* Builds the full environment variable name with optional version suffix.
|
|
198
267
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"EnvVarKeySource.js","sourceRoot":"","sources":["../../src/providers/EnvVarKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;
|
|
1
|
+
{"version":3,"file":"EnvVarKeySource.js","sourceRoot":"","sources":["../../src/providers/EnvVarKeySource.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;;;;;;;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAGrE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,uBAAuB;IACxD;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,sBAAsB,CAAC;IAClC,CAAC;IAED;;;;;;;;OAQG;IACH,qBAAqB;QACjB,8CAA8C;QAC9C,4DAA4D;QAC5D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,SAAS,CAAC,WAAmB;QAC/B,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,CAAC;IAClD,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,KAAK,CAAC,MAAM,CAAC,WAAmB,EAAE,UAAmB;QACjD,wBAAwB;QACxB,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACX,+DAA+D;gBAC/D,iFAAiF,CACpF,CAAC;QACN,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACX,uCAAuC,WAAW,KAAK;gBACvD,gEAAgE;gBAChE,oCAAoC,CACvC,CAAC;QACN,CAAC;QAED,2CAA2C;QAC3C,kDAAkD;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAEjE,qBAAqB;QACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACX,sDAAsD,UAAU,KAAK;gBACrE,0EAA0E;gBAC1E,8CAA8C,CACjD,CAAC;QACN,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACX,2CAA2C,UAAU,cAAc;gBACnE,iEAAiE,CACpE,CAAC;QACN,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAEjD,kDAAkD;YAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5C,CAAC;YAED,wCAAwC;YACxC,6BAA6B;YAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,SAAS,KAAK,UAAU,IAAI,SAAS,GAAG,GAAG,KAAK,UAAU,IAAI,SAAS,GAAG,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChG,qDAAqD;gBACrD,qCAAqC;gBACrC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACzE,CAAC;YAED,OAAO,QAAQ,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CACX,kDAAkD,UAAU,KAAK;gBACjE,2DAA2D,OAAO,IAAI;gBACtE,oDAAoD,CACvD,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,wBAAwB,CAC1B,WAAmB,EACnB,UAAmB,EACnB,sBAA+B;QAE/B,IAAI,CAAC;YACD,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACvD,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,uCAAuC,WAAW,KAAK;wBAC1D,kGAAkG;iBACzG,CAAC;YACN,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAEzC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC9C,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,yBAAyB,UAAU,gBAAgB;wBACtD,2CAA2C;wBAC3C,YAAY,UAAU,2BAA2B,sBAAsB,IAAI,EAAE,GAAG;iBACvF,CAAC;YACN,CAAC;YAED,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACzB,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,yBAAyB,UAAU,cAAc;wBACpD,uBAAuB,UAAU,2BAA2B,sBAAsB,IAAI,EAAE,GAAG;iBAClG,CAAC;YACN,CAAC;YAED,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,yBAAyB,UAAU,wCAAwC;wBAC9E,6CAA6C,sBAAsB,IAAI,EAAE,EAAE;iBAClF,CAAC;YACN,CAAC;YAED,sEAAsE;YACtE,uEAAuE;YACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,SAAS,KAAK,UAAU,IAAI,SAAS,GAAG,GAAG,KAAK,UAAU,IAAI,SAAS,GAAG,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChG,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,yBAAyB,UAAU,4CAA4C;wBAClF,6CAA6C,sBAAsB,IAAI,EAAE,EAAE;iBAClF,CAAC;YACN,CAAC;YAED,IAAI,sBAAsB,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,sBAAsB,EAAE,CAAC;gBACrF,OAAO;oBACH,YAAY,EAAE,KAAK;oBACnB,KAAK,EAAE,WAAW,UAAU,QAAQ,QAAQ,CAAC,MAAM,iCAAiC,sBAAsB,UAAU;wBAChH,6DAA6D,sBAAsB,EAAE;iBAC5F,CAAC;YACN,CAAC;YAED,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO;gBACH,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,mDAAmD,WAAW,MAAM,OAAO,EAAE;aACvF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACK,eAAe,CAAC,QAAgB,EAAE,UAAmB;QACzD,4CAA4C;QAC5C,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,yCAAyC;QACzC,OAAO,GAAG,QAAQ,KAAK,UAAU,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,iBAAiB,CAAC,IAAY;QAClC,oBAAoB;QACpB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,2CAA2C;QAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,6CAA6C;QAC7C,uCAAuC;QACvC,4CAA4C;QAC5C,MAAM,aAAa,GAAG,0BAA0B,CAAC;QACjD,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACJ,CAAA;AA9QY,eAAe;IAD3B,aAAa,CAAC,uBAAuB,EAAE,iBAAiB,CAAC;GAC7C,eAAe,CA8Q3B"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@memberjunction/encryption",
|
|
3
3
|
"type": "module",
|
|
4
|
-
"version": "5.
|
|
4
|
+
"version": "5.16.0",
|
|
5
5
|
"description": "MemberJunction: Field-level encryption engine with pluggable key sources. Server-side only - provides AES-256-GCM/CBC encryption with environment variable, config file, AWS KMS, and Azure Key Vault key sources.",
|
|
6
6
|
"main": "dist/index.js",
|
|
7
7
|
"types": "dist/index.d.ts",
|
|
@@ -22,11 +22,11 @@
|
|
|
22
22
|
"vitest": "^4.0.18"
|
|
23
23
|
},
|
|
24
24
|
"dependencies": {
|
|
25
|
-
"@memberjunction/global": "5.
|
|
26
|
-
"@memberjunction/core": "5.
|
|
27
|
-
"@memberjunction/core-entities": "5.
|
|
28
|
-
"@memberjunction/credentials": "5.
|
|
29
|
-
"@memberjunction/actions-base": "5.
|
|
25
|
+
"@memberjunction/global": "5.16.0",
|
|
26
|
+
"@memberjunction/core": "5.16.0",
|
|
27
|
+
"@memberjunction/core-entities": "5.16.0",
|
|
28
|
+
"@memberjunction/credentials": "5.16.0",
|
|
29
|
+
"@memberjunction/actions-base": "5.16.0",
|
|
30
30
|
"cosmiconfig": "^9.0.0"
|
|
31
31
|
},
|
|
32
32
|
"optionalDependencies": {
|