@spotify-confidence/openfeature-server-provider-local 0.15.2 → 0.16.0

package/dist/index.node.d.ts

@@ -486,6 +486,8 @@ type FlagBundle$1 = FlagBundle;
 interface SnapshotConfig {}
 interface ProviderOptions {
   flagClientSecret: string;
+  /** Hex-encoded AES-256 encryption key for decrypting CDN state. */
+  encryptionKey?: string;
   initializeTimeout?: number;
   /** Interval in milliseconds between state polling updates. Defaults to 30000ms. */
   stateUpdateInterval?: number;

package/dist/index.node.js

@@ -1437,7 +1437,7 @@ function isObject(value) {
 function isSet$3(value) {
 	return value !== null && value !== void 0;
 }
-const VERSION = "0.15.2";
+const VERSION = "0.16.0";
 const NOOP_LOG_FN = Object.assign(() => {}, { enabled: false });
 const debugBackend = loadDebug();
 const logger$2 = new class LoggerImpl {
@@ -1589,6 +1589,12 @@ function base64FromBytes$1(arr) {
 		return globalThis.btoa(bin.join(""));
 	}
 }
+function hexToBytes(hex) {
+	if (hex.length % 2 !== 0) throw new Error("Hex string must have an even number of characters");
+	const bytes = new Uint8Array(hex.length / 2);
+	for (let i = 0; i < hex.length; i += 2) bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+	return bytes;
+}
 const logger$3 = logger$2.getLogger("fetch");
 let Fetch;
 (function(_Fetch) {
@@ -2882,6 +2888,7 @@ var ConfidenceServerProviderLocal = class ConfidenceServerProviderLocal {
 		else this.materializationStore = null;
 	}
 	async initialize(context) {
+		if (!this.options.encryptionKey) logger$1.warn("No encryptionKey provided. Falling back to unencrypted state. An encryption key will be required in an upcoming version.");
 		const signal = this.main.signal;
 		const initialUpdateSignal = AbortSignal.any([signal, timeoutSignal(this.options.initializeTimeout ?? DEFAULT_INITIALIZE_TIMEOUT)]);
 		try {
@@ -2994,7 +3001,9 @@ var ConfidenceServerProviderLocal = class ConfidenceServerProviderLocal {
 		}
 	}
 	async updateState(signal) {
-		const cdnUrl = `https://confidence-resolver-state-cdn.spotifycdn.com/${await sha256Hex(this.options.flagClientSecret)}`;
+		const hashHex = await sha256Hex(this.options.flagClientSecret);
+		const { encryptionKey } = this.options;
+		const cdnUrl = `https://confidence-resolver-state-cdn.spotifycdn.com/${encryptionKey ? `${hashHex}.enc` : hashHex}`;
 		const headers = new Headers();
 		if (this.stateEtag) headers.set("If-None-Match", this.stateEtag);
 		const resp = await this.fetch(cdnUrl, {
@@ -3005,11 +3014,16 @@ var ConfidenceServerProviderLocal = class ConfidenceServerProviderLocal {
 		if (!resp.ok) throw new Error(`Failed to fetch state: ${resp.status} ${resp.statusText}`);
 		this.stateEtag = resp.headers.get("etag");
 		const bytes = new Uint8Array(await resp.arrayBuffer());
-		const stateRequest = SetResolverStateRequest.decode(bytes);
-		stateRequest.sdk = {
+		const sdk = {
 			id: SdkId.SDK_ID_JS_LOCAL_SERVER_PROVIDER,
 			version: VERSION
 		};
+		try {
+			await this.flush(signal);
+		} catch {}
+		const plaintext = encryptionKey ? await decryptAesGcm(bytes, hexToBytes(encryptionKey)) : bytes;
+		const stateRequest = SetResolverStateRequest.decode(plaintext);
+		stateRequest.sdk = sdk;
 		this.resolver.setResolverState(stateRequest);
 	}
 	async flush(signal) {
@@ -3090,6 +3104,18 @@ var ConfidenceServerProviderLocal = class ConfidenceServerProviderLocal {
 		this.resolver.applyFlags(request);
 	}
 };
+async function decryptAesGcm(data, rawKey) {
+	const NONCE_LEN = 12;
+	if (data.length < NONCE_LEN) throw new Error("Encrypted state too short (missing nonce)");
+	const iv = data.buffer.slice(data.byteOffset, data.byteOffset + NONCE_LEN);
+	const ciphertext = data.buffer.slice(data.byteOffset + NONCE_LEN, data.byteOffset + data.byteLength);
+	const key = await crypto.subtle.importKey("raw", rawKey.buffer, "AES-GCM", false, ["decrypt"]);
+	const plaintext = await crypto.subtle.decrypt({
+		name: "AES-GCM",
+		iv
+	}, key, ciphertext);
+	return new Uint8Array(plaintext);
+}
 function reasonStringToEnum(reason) {
 	switch (reason) {
 		case "MATCH": return ResolveReason.RESOLVE_REASON_MATCH;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spotify-confidence/openfeature-server-provider-local",
-  "version": "0.15.2",
+  "version": "0.16.0",
   "description": "Spotify Confidence Open Feature provider",
   "type": "module",
   "files": [