@open-mercato/shared 0.8.1-develop.7228.1.b7ea09d2d3 → 0.8.1-develop.7238.1.3abe669ea5

package/src/lib/db/__tests__/pg-errors.test.ts

@@ -1,4 +1,4 @@
-import { getForeignKeyViolationConstraint, isForeignKeyViolation, isTransientDbError, isUniqueViolation } from '../pg-errors'
+import { getForeignKeyViolationConstraint, isForeignKeyViolation, isTransientDbError, isUniqueViolation, readPgSqlState } from '../pg-errors'
 
 describe('isTransientDbError', () => {
   it('is true for the max_connections SQLSTATE', () => {
@@ -104,3 +104,33 @@ describe('getForeignKeyViolationConstraint', () => {
     expect(getForeignKeyViolationConstraint(null)).toBeNull()
   })
 })
+
+describe('readPgSqlState', () => {
+  it('reads a 5-character SQLSTATE off the top-level error', () => {
+    expect(readPgSqlState({ code: '42P01' })).toBe('42P01')
+  })
+
+  it('reads a SQLSTATE from a nested cause', () => {
+    expect(readPgSqlState({ message: 'wrapped', cause: { code: '23505' } })).toBe('23505')
+  })
+
+  it('is null for a Node system error code, which is not a 5-character SQLSTATE', () => {
+    expect(readPgSqlState({ code: 'ECONNREFUSED' })).toBeNull()
+  })
+
+  it('is null for a Node internal error code', () => {
+    expect(readPgSqlState({ code: 'ERR_INVALID_ARG_TYPE' })).toBeNull()
+  })
+
+  it('is null for five-letter Node errno codes, which are not a 5-character SQLSTATE', () => {
+    expect(readPgSqlState({ code: 'EPIPE' })).toBeNull()
+    expect(readPgSqlState({ code: 'EPERM' })).toBeNull()
+    expect(readPgSqlState({ code: 'EBUSY' })).toBeNull()
+  })
+
+  it('is null for non-DB and empty errors', () => {
+    expect(readPgSqlState(new Error('something unrelated broke'))).toBeNull()
+    expect(readPgSqlState(null)).toBeNull()
+    expect(readPgSqlState(undefined)).toBeNull()
+  })
+})

package/src/lib/db/pg-errors.ts

@@ -68,6 +68,29 @@ export function getForeignKeyViolationConstraint(err: unknown): string | null {
   return null
 }
 
+/**
+ * A Postgres SQLSTATE is always exactly 5 characters from `[0-9A-Z]`, and every
+ * class in the standard SQLSTATE table carries at least one digit. Node system
+ * errors (`ECONNREFUSED`), Node internal errors (`ERR_INVALID_ARG_TYPE`), and the
+ * five-letter Node errno codes (`EPIPE`, `EPERM`, `EBUSY`) would otherwise be
+ * misread as a SQLSTATE, since they also populate a string `code` field; the
+ * digit requirement rules those out without excluding any real SQLSTATE.
+ */
+const SQLSTATE_PATTERN = /^(?=.*[0-9])[0-9A-Z]{5}$/
+
+/**
+ * The Postgres SQLSTATE behind an error, read from the pg `code` field on any
+ * layer of the driver-error wrapper chain (see `pgErrorCandidates`). Returns
+ * `null` when no layer carries a `code` matching the SQLSTATE shape, which
+ * also covers non-Postgres errors whose `code` is a Node error code.
+ */
+export function readPgSqlState(err: unknown): string | null {
+  for (const candidate of pgErrorCandidates(err)) {
+    if (typeof candidate.code === 'string' && SQLSTATE_PATTERN.test(candidate.code)) return candidate.code
+  }
+  return null
+}
+
 /**
  * Postgres SQLSTATEs for transient connection / availability failures — the
  * database (or its connection pool) is temporarily unreachable and the request

package/src/lib/encryption/__tests__/tenantDataEncryptionService.test.ts

@@ -1,4 +1,11 @@
-import { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from '../aes'
+import {
+  TenantDataEncryptionError,
+  TenantDataEncryptionErrorCode,
+  decryptWithAesGcm,
+  encryptWithAesGcm,
+  hashForLookup,
+  isEncryptedPayloadShape,
+} from '../aes'
 import {
   TenantDataEncryptionService,
   parseDecryptedFieldValue,
@@ -129,6 +136,34 @@ describe('TenantDataEncryptionService.decryptFields (issue #1734)', () => {
   })
 })
 
+describe('isEncryptedPayloadShape (issue #5951)', () => {
+  it('accepts a real AES-GCM envelope regardless of which key sealed it', () => {
+    const otherKey = Buffer.alloc(32, 7).toString('base64')
+    expect(isEncryptedPayloadShape(encryptWithAesGcm('x', fixedKey).value)).toBe(true)
+    expect(isEncryptedPayloadShape(encryptWithAesGcm('x', otherKey).value)).toBe(true)
+  })
+
+  it('rejects the loose four-segment shapes a length-blind check would accept', () => {
+    // The IV and tag decode to 3 and 3 bytes, not 12 and 16 — no AES-GCM payload looks like this.
+    expect(isEncryptedPayloadShape('aaaa:bbbb:cccc:v1')).toBe(false)
+    expect(isEncryptedPayloadShape('user:supplied:colon:v1')).toBe(false)
+  })
+
+  it('rejects plaintext, non-strings, and wrong-version payloads', () => {
+    expect(isEncryptedPayloadShape('mail@example.com')).toBe(false)
+    expect(isEncryptedPayloadShape('')).toBe(false)
+    expect(isEncryptedPayloadShape(null)).toBe(false)
+    expect(isEncryptedPayloadShape(42)).toBe(false)
+    expect(isEncryptedPayloadShape((encryptWithAesGcm('x', fixedKey).value as string).replace(/:v1$/, ':v2'))).toBe(false)
+  })
+
+  it('rejects an envelope whose ciphertext segment is empty', () => {
+    const real = encryptWithAesGcm('x', fixedKey).value as string
+    const [iv, , tag] = real.split(':')
+    expect(isEncryptedPayloadShape(`${iv}::${tag}:v1`)).toBe(false)
+  })
+})
+
 describe('TenantDataEncryptionService.encryptFields (issue #2720)', () => {
   function makeService() {
     type Anything = Record<string, unknown>
@@ -169,17 +204,70 @@ describe('TenantDataEncryptionService.encryptFields (issue #2720)', () => {
     expect(out.email).toBe(real)
   })
 
-  it('encrypts a structurally-valid payload that was sealed with a different key', () => {
+  // Superseded by issue #5951: this case used to assert that a payload sealed under another
+  // key gets encrypted again. That is what produced the undetectable nested envelope — the
+  // value is real ciphertext (the previous DEK mid-rotation, or the derived key the KMS falls
+  // back to during a Vault outage), not a forgery, and wrapping it destroys it. The write now
+  // fails closed. #2720 is unaffected: nothing is stored verbatim on this path either way.
+  it('refuses to re-encrypt a payload that was sealed with a different key', () => {
     const service = makeService()
     const otherKey = Buffer.alloc(32, 2).toString('base64')
     const sealedElsewhere = encryptWithAesGcm('secret', otherKey).value as string
-    const out = service.encryptFields(
-      { email: sealedElsewhere },
-      [{ field: 'email' }],
-      { key: fixedKey } as never,
-    )
-    expect(out.email).not.toBe(sealedElsewhere)
-    expect(decryptWithAesGcm(out.email as string, fixedKey)).toBe(sealedElsewhere)
+    expect(() =>
+      service.encryptFields(
+        { email: sealedElsewhere },
+        [{ field: 'email' }],
+        { key: fixedKey } as never,
+      ),
+    ).toThrow(TenantDataEncryptionError)
+  })
+
+  it('reports the wrong-key case with a distinct error code and leaves the value out of the message', () => {
+    const service = makeService()
+    const otherKey = Buffer.alloc(32, 2).toString('base64')
+    const sealedElsewhere = encryptWithAesGcm('secret@example.com', otherKey).value as string
+    try {
+      service.encryptFields(
+        { email: sealedElsewhere },
+        [{ field: 'email' }],
+        { key: fixedKey } as never,
+      )
+      throw new Error('[internal] expected encryptFields to throw')
+    } catch (err) {
+      expect(err).toBeInstanceOf(TenantDataEncryptionError)
+      expect((err as TenantDataEncryptionError).code).toBe(TenantDataEncryptionErrorCode.WRONG_KEY)
+      // The ciphertext must never be echoed back into an error surfaced to a caller.
+      expect((err as TenantDataEncryptionError).message).not.toContain(sealedElsewhere)
+      expect((err as TenantDataEncryptionError).message).toContain('email')
+    }
+  })
+
+  it('never emits a nested envelope or a hash of ciphertext when the DEK changed', () => {
+    const service = makeService()
+    const previousDek = Buffer.alloc(32, 2).toString('base64')
+    const sealedUnderPreviousDek = encryptWithAesGcm('mail@example.com', previousDek).value as string
+    const input = { email: sealedUnderPreviousDek, email_hash: hashForLookup('mail@example.com') }
+    const inputSnapshot = { ...input }
+
+    // encryptFields must reject the call outright rather than return a payload — a toBeNull()
+    // check on a try/catch result would also pass if it threw for an unrelated reason, so assert
+    // the throw directly.
+    expect(() =>
+      service.encryptFields(
+        input,
+        [{ field: 'email', hashField: 'email_hash' }],
+        { key: fixedKey } as never,
+      ),
+    ).toThrow(TenantDataEncryptionError)
+
+    // encryptFields clones before mutating, so a rejected call must leave the caller's object
+    // untouched — no nested envelope, no hash overwritten with one computed over ciphertext.
+    expect(input).toEqual(inputSnapshot)
+
+    // Illustrative only (not an assertion on the code under test): before the fix, the case
+    // above returned a writable payload containing one more AES-GCM layer whose plaintext was
+    // the previous envelope, plus a lookup hash computed over ciphertext instead of over the
+    // email — neither of which any read path could undo.
   })
 
   it('encrypts plaintext that happens to look like a v1 payload', () => {

package/src/lib/encryption/aes.ts

@@ -45,6 +45,11 @@ const BASE64_PART = /^[A-Za-z0-9+/]+={0,2}$/
  * attacker-supplied input while a DEK is reachable, where `isEncryptedWithDek` is the test to use.
  * Callers that must run it over user-controlled data are responsible for confirming first that no
  * DEK is reachable, which is what makes forgery pointless: there is nothing to impersonate.
+ *
+ * See also {@link isEncryptedPayloadShape}, which answers the stricter "would the decrypt path
+ * accept this?" question by decoded byte length instead of encoded character length. The two
+ * agree on anything the server actually wrote; use this one for offline detection with no DEK
+ * reachable, and that one to predict whether a decrypt attempt will succeed.
  */
 export function looksLikeEncryptedPayload(value: unknown): boolean {
   if (typeof value !== 'string') return false
@@ -88,6 +93,44 @@ export function encryptWithAesGcm(value: string, dekBase64: string): EncryptionP
   return { value: payload, raw: payload, version: 'v1' }
 }
 
+const AES_GCM_IV_BYTES = 12
+const AES_GCM_TAG_BYTES = 16
+
+/**
+ * Reports whether a value is a **structurally** well-formed `<iv>:<ct>:<tag>:v1` envelope —
+ * the same shape validation {@link decryptWithAesGcmStrict} performs before it attempts a
+ * decrypt, without needing a key.
+ *
+ * This is deliberately NOT an "is this encrypted" oracle: the shape is forgeable, so a caller
+ * deciding whether a value is already sealed MUST still bind that decision to a successful
+ * authenticated decrypt (issue #2720). Its purpose is to separate "ciphertext we cannot open
+ * with the key we hold" from "plaintext that happens to contain colons", so a write path can
+ * fail loudly on the former instead of silently wrapping it a second time (issue #5951).
+ *
+ * The byte-length checks matter: `Buffer.from(value, 'base64')` is lenient, so a loose
+ * four-segment check matches strings like `aaaa:bbbb:cccc:v1` that no AES-GCM payload could be.
+ *
+ * See also {@link looksLikeEncryptedPayload}, the pre-existing looser check by encoded character
+ * length. Use that one when no DEK is reachable at all (it needs none); use this one whenever the
+ * question is "will the encrypt/decrypt path accept this?", since it matches the same byte-length
+ * validation {@link decryptWithAesGcmStrict} performs.
+ */
+export function isEncryptedPayloadShape(value: unknown): value is string {
+  if (typeof value !== 'string') return false
+  const parts = value.split(':')
+  if (parts.length !== 4 || parts[3] !== 'v1') return false
+  const [ivB64, ciphertextB64, tagB64] = parts as [string, string, string, string]
+  try {
+    return (
+      Buffer.from(ivB64, 'base64').length === AES_GCM_IV_BYTES
+      && Buffer.from(tagB64, 'base64').length === AES_GCM_TAG_BYTES
+      && Buffer.from(ciphertextB64, 'base64').length > 0
+    )
+  } catch {
+    return false
+  }
+}
+
 function runAesGcmDecrypt(dek: Buffer, iv: Buffer, ciphertext: Buffer, tag: Buffer): string {
   const decipher = crypto.createDecipheriv('aes-256-gcm', dek, iv)
   decipher.setAuthTag(tag)

package/src/lib/encryption/tenantDataEncryptionService.ts

@@ -1,6 +1,13 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CacheStrategy } from '@open-mercato/cache'
-import { decryptWithAesGcm, encryptWithAesGcm, hashForLookup } from './aes'
+import {
+  TenantDataEncryptionError,
+  TenantDataEncryptionErrorCode,
+  decryptWithAesGcm,
+  encryptWithAesGcm,
+  hashForLookup,
+  isEncryptedPayloadShape,
+} from './aes'
 import { createKmsService, type KmsService, type TenantDek } from './kms'
 import { isTenantDataEncryptionEnabled, isEncryptionDebugEnabled } from './toggles'
 import { createLogger } from '../logger'
@@ -124,6 +131,32 @@ function isEncryptedWithDek(value: unknown, dek: TenantDek): boolean {
   return decryptWithAesGcm(value, dek.key) !== null
 }
 
+/**
+ * Guard the encrypt path against re-wrapping ciphertext this process cannot open.
+ *
+ * Called only after {@link isEncryptedWithDek} has already said "not sealed under the
+ * current DEK". At that point a structurally well-formed envelope means one of two things:
+ * genuine ciphertext under some other key, or a length-valid forgery — the shape check is
+ * length-based, not content-based, so any length-correct string qualifies, not just a
+ * byte-exact match against something real. Both must stop the write — the first because
+ * nesting envelopes silently destroys recoverable data, the second because rejecting it is
+ * strictly safer than persisting attacker-chosen bytes.
+ *
+ * The field name is safe to report (it comes from the encryption map, not user input); the
+ * value never is, so it stays out of both the error message and the log.
+ */
+function assertNotSealedUnderAnotherKey(value: unknown, field: string): void {
+  if (!isEncryptedPayloadShape(value)) return
+  logger.error('Refusing to re-encrypt a value sealed under a different key', { field })
+  throw new TenantDataEncryptionError(
+    TenantDataEncryptionErrorCode.WRONG_KEY,
+    `[internal] Field "${field}" already holds an encrypted payload that does not decrypt under the current tenant DEK. `
+      + 'Encrypting it again would produce an unreadable nested envelope. '
+      + 'Complete the key rotation for this tenant (mercato entities rotate-encryption-key --old-key …) '
+      + 'or restore the DEK that sealed it before writing this record again.',
+  )
+}
+
 function normalizeEncryptedFieldRules(
   fields: readonly { field?: unknown; hashField?: unknown }[] | null | undefined,
 ): EncryptedFieldRule[] {
@@ -564,6 +597,16 @@ export class TenantDataEncryptionService {
       // A forged ciphertext-shaped string fails this check and is encrypted as
       // plaintext, closing the encryption-at-rest bypass (issue #2720).
       if (isEncryptedWithDek(value, dek)) continue
+      // Failing that check does not prove the value is plaintext. A well-formed
+      // envelope sealed under a *different* key — the previous DEK mid-rotation, or
+      // the derived key the KMS falls back to during a Vault outage — lands here too,
+      // and encrypting it again would nest one envelope inside another: unreadable by
+      // any normal decrypt, indistinguishable from correct ciphertext by inspection,
+      // and it would overwrite the lookup hash with a hash of ciphertext (issue #5951).
+      // Fail the write closed instead. Nothing is ever stored verbatim, so #2720 stays
+      // shut: a forgery whose shape is not length-valid still gets encrypted as plaintext
+      // above, and a length-valid one is rejected rather than persisted.
+      assertNotSealedUnderAnotherKey(value, rule.field)
       const serialized = typeof value === 'string' ? value : JSON.stringify(value)
       const payload = encryptWithAesGcm(serialized, dek.key)
       clone[key] = payload.value