@opengeni/db 0.28.1 → 0.31.1

package/src/environment-crypto.ts

@@ -1,35 +1,44 @@
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 
-const VERSION_PREFIX = "v1";
+const CURRENT_VERSION_PREFIX = "v2";
+const LEGACY_VERSION_PREFIX = "v1";
 const IV_BYTES = 12;
 const GCM_TAG_BYTES = 16;
 const KEY_BYTES = 32;
 
 /**
  * Encrypts one workspace environment variable value with AES-256-GCM under an
- * operator key held outside Postgres. Output format: `v1:<b64 iv>:<b64 ciphertext||tag>`.
+ * operator key held outside Postgres. v2 encodes the JavaScript string as
+ * UTF-16LE before encryption so every code unit (including NUL and lone
+ * surrogates) round-trips exactly. Output format:
+ * `v2:<b64 iv>:<b64 ciphertext||tag>`.
  */
 export function encryptEnvironmentValue(key: Uint8Array, plaintext: string): string {
   assertKey(key);
   const iv = randomBytes(IV_BYTES);
   const cipher = createCipheriv("aes-256-gcm", key, iv);
   const ciphertext = Buffer.concat([
-    cipher.update(plaintext, "utf8"),
+    cipher.update(Buffer.from(plaintext, "utf16le")),
     cipher.final(),
     cipher.getAuthTag(),
   ]);
-  return `${VERSION_PREFIX}:${iv.toString("base64")}:${ciphertext.toString("base64")}`;
+  return `${CURRENT_VERSION_PREFIX}:${iv.toString("base64")}:${ciphertext.toString("base64")}`;
 }
 
 /**
- * Decrypts a stored `v1:` value. Error messages never echo plaintext or
- * ciphertext: unknown versions throw "unsupported environment value format",
- * auth-tag mismatches throw "environment value decryption failed".
+ * Decrypts current lossless v2 values and historical UTF-8 v1 values. Error
+ * messages never echo plaintext or ciphertext: unknown versions throw
+ * "unsupported environment value format", auth-tag mismatches throw
+ * "environment value decryption failed".
  */
 export function decryptEnvironmentValue(key: Uint8Array, stored: string): string {
   assertKey(key);
   const parts = stored.split(":");
-  if (parts.length !== 3 || parts[0] !== VERSION_PREFIX) {
+  const version = parts[0];
+  if (
+    parts.length !== 3 ||
+    (version !== CURRENT_VERSION_PREFIX && version !== LEGACY_VERSION_PREFIX)
+  ) {
     throw new Error("unsupported environment value format");
   }
   const iv = Buffer.from(parts[1]!, "base64");
@@ -42,7 +51,11 @@ export function decryptEnvironmentValue(key: Uint8Array, stored: string): string
   const decipher = createDecipheriv("aes-256-gcm", key, iv);
   decipher.setAuthTag(tag);
   try {
-    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
+    const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    if (version === CURRENT_VERSION_PREFIX && plaintext.length % 2 !== 0) {
+      throw new Error("invalid lossless environment value length");
+    }
+    return plaintext.toString(version === CURRENT_VERSION_PREFIX ? "utf16le" : "utf8");
   } catch {
     throw new Error("environment value decryption failed");
   }