@striae-org/striae 5.1.1 → 5.2.0

package/workers/user-worker/src/user-worker.example.ts

@@ -1,3 +1,11 @@
+import {
+  decryptJsonFromUserKv,
+  encryptJsonForUserKv,
+  tryParseEncryptedRecord,
+  type UserKvEncryptedRecord,
+  validateEncryptedRecord
+} from './encryption-utils';
+
 interface Env {
   USER_DB_AUTH: string;
   USER_DB: KVNamespace;
@@ -8,8 +16,25 @@ interface Env {
   PROJECT_ID: string;
   FIREBASE_SERVICE_ACCOUNT_EMAIL: string;
   FIREBASE_SERVICE_ACCOUNT_PRIVATE_KEY: string;
+  USER_KV_ENCRYPTION_PRIVATE_KEY: string;
+  USER_KV_ENCRYPTION_PUBLIC_KEY: string;
+  USER_KV_ENCRYPTION_KEY_ID: string;
+  USER_KV_ENCRYPTION_KEYS_JSON?: string;
+  USER_KV_ENCRYPTION_ACTIVE_KEY_ID?: string;
+}
+
+interface KeyRegistryPayload {
+  activeKeyId?: unknown;
+  keys?: unknown;
+}
+
+interface PrivateKeyRegistry {
+  activeKeyId: string | null;
+  keys: Record<string, string>;
 }
 
+type DecryptionTelemetryOutcome = 'primary-hit' | 'fallback-hit' | 'all-failed';
+
 interface UserData {
   uid: string;
   email: string;
@@ -24,6 +49,23 @@ interface UserData {
   updatedAt?: string;
 }
 
+function isLegacyUserData(value: unknown): value is UserData {
+  if (!value || typeof value !== 'object') {
+    return false;
+  }
+
+  const candidate = value as Partial<UserData>;
+  return (
+    typeof candidate.uid === 'string' &&
+    typeof candidate.email === 'string' &&
+    typeof candidate.firstName === 'string' &&
+    typeof candidate.lastName === 'string' &&
+    typeof candidate.company === 'string' &&
+    typeof candidate.permitted === 'boolean' &&
+    Array.isArray(candidate.cases)
+  );
+}
+
 interface CaseItem {
   caseNumber: string;
   caseName?: string;
@@ -128,6 +170,253 @@ function resolveImageWorkerBaseUrl(env: Env): string {
   return normalizeWorkerBaseUrl(DEFAULT_IMAGE_WORKER_BASE_URL);
 }
 
+function requireUserKvReadConfig(env: Env): void {
+  const hasLegacyPrivateKey = typeof env.USER_KV_ENCRYPTION_PRIVATE_KEY === 'string' && env.USER_KV_ENCRYPTION_PRIVATE_KEY.trim().length > 0;
+  const hasRegistryPrivateKeys = typeof env.USER_KV_ENCRYPTION_KEYS_JSON === 'string' && env.USER_KV_ENCRYPTION_KEYS_JSON.trim().length > 0;
+
+  if (!hasLegacyPrivateKey && !hasRegistryPrivateKeys) {
+    throw new Error('User KV encryption is not fully configured');
+  }
+}
+
+function requireUserKvWriteConfig(env: Env): void {
+  const hasLegacyPrivateKey = typeof env.USER_KV_ENCRYPTION_PRIVATE_KEY === 'string' && env.USER_KV_ENCRYPTION_PRIVATE_KEY.trim().length > 0;
+  const hasRegistryPrivateKeys = typeof env.USER_KV_ENCRYPTION_KEYS_JSON === 'string' && env.USER_KV_ENCRYPTION_KEYS_JSON.trim().length > 0;
+
+  if (
+    !env.USER_KV_ENCRYPTION_PUBLIC_KEY ||
+    !env.USER_KV_ENCRYPTION_KEY_ID ||
+    (!hasLegacyPrivateKey && !hasRegistryPrivateKeys)
+  ) {
+    throw new Error('User KV encryption is not fully configured');
+  }
+}
+
+function normalizePrivateKeyPem(rawValue: string): string {
+  return rawValue.trim().replace(/^['"]|['"]$/g, '').replace(/\\n/g, '\n');
+}
+
+function getNonEmptyString(value: unknown): string | null {
+  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null;
+}
+
+function parseUserKvPrivateKeyRegistry(env: Env): PrivateKeyRegistry {
+  const keys: Record<string, string> = {};
+  const configuredActiveKeyId = getNonEmptyString(env.USER_KV_ENCRYPTION_ACTIVE_KEY_ID);
+
+  if (getNonEmptyString(env.USER_KV_ENCRYPTION_KEYS_JSON)) {
+    let parsedRegistry: unknown;
+    try {
+      parsedRegistry = JSON.parse(env.USER_KV_ENCRYPTION_KEYS_JSON as string) as unknown;
+    } catch {
+      throw new Error('USER_KV_ENCRYPTION_KEYS_JSON is not valid JSON');
+    }
+
+    if (!parsedRegistry || typeof parsedRegistry !== 'object') {
+      throw new Error('USER_KV_ENCRYPTION_KEYS_JSON must be an object');
+    }
+
+    const payload = parsedRegistry as KeyRegistryPayload;
+    if (!payload.keys || typeof payload.keys !== 'object') {
+      throw new Error('USER_KV_ENCRYPTION_KEYS_JSON must include a keys object');
+    }
+
+    for (const [keyId, pemValue] of Object.entries(payload.keys as Record<string, unknown>)) {
+      const normalizedKeyId = getNonEmptyString(keyId);
+      const normalizedPem = getNonEmptyString(pemValue);
+      if (!normalizedKeyId || !normalizedPem) {
+        continue;
+      }
+
+      keys[normalizedKeyId] = normalizePrivateKeyPem(normalizedPem);
+    }
+
+    const payloadActiveKeyId = getNonEmptyString(payload.activeKeyId);
+    const activeKeyId = configuredActiveKeyId ?? payloadActiveKeyId;
+
+    if (Object.keys(keys).length === 0) {
+      throw new Error('USER_KV_ENCRYPTION_KEYS_JSON does not contain any usable keys');
+    }
+
+    if (activeKeyId && !keys[activeKeyId]) {
+      throw new Error('USER_KV active key ID is not present in USER_KV_ENCRYPTION_KEYS_JSON');
+    }
+
+    return {
+      activeKeyId: activeKeyId ?? null,
+      keys
+    };
+  }
+
+  const legacyKeyId = getNonEmptyString(env.USER_KV_ENCRYPTION_KEY_ID);
+  const legacyPrivateKey = getNonEmptyString(env.USER_KV_ENCRYPTION_PRIVATE_KEY);
+  if (!legacyKeyId || !legacyPrivateKey) {
+    throw new Error('User KV encryption private key registry is not configured');
+  }
+
+  keys[legacyKeyId] = normalizePrivateKeyPem(legacyPrivateKey);
+
+  return {
+    activeKeyId: configuredActiveKeyId ?? legacyKeyId,
+    keys
+  };
+}
+
+function buildPrivateKeyCandidates(
+  recordKeyId: string,
+  registry: PrivateKeyRegistry
+): Array<{ keyId: string; privateKeyPem: string }> {
+  const candidates: Array<{ keyId: string; privateKeyPem: string }> = [];
+  const seen = new Set<string>();
+
+  const appendCandidate = (candidateKeyId: string | null): void => {
+    if (!candidateKeyId || seen.has(candidateKeyId)) {
+      return;
+    }
+
+    const privateKeyPem = registry.keys[candidateKeyId];
+    if (!privateKeyPem) {
+      return;
+    }
+
+    seen.add(candidateKeyId);
+    candidates.push({ keyId: candidateKeyId, privateKeyPem });
+  };
+
+  appendCandidate(getNonEmptyString(recordKeyId));
+  appendCandidate(registry.activeKeyId);
+
+  for (const keyId of Object.keys(registry.keys)) {
+    appendCandidate(keyId);
+  }
+
+  return candidates;
+}
+
+function logUserKvDecryptionTelemetry(input: {
+  recordKeyId: string;
+  selectedKeyId: string | null;
+  attemptCount: number;
+  outcome: DecryptionTelemetryOutcome;
+  reason?: string;
+}): void {
+  const details = {
+    scope: 'user-kv',
+    recordKeyId: input.recordKeyId,
+    selectedKeyId: input.selectedKeyId,
+    attemptCount: input.attemptCount,
+    fallbackUsed: input.outcome === 'fallback-hit',
+    outcome: input.outcome,
+    reason: input.reason ?? null
+  };
+
+  if (input.outcome === 'all-failed') {
+    console.warn('Key registry decryption failed', details);
+    return;
+  }
+
+  console.info('Key registry decryption resolved', details);
+}
+
+async function decryptUserKvRecord(
+  encryptedRecord: UserKvEncryptedRecord,
+  registry: PrivateKeyRegistry
+): Promise<string> {
+  const candidates = buildPrivateKeyCandidates(encryptedRecord.keyId, registry);
+  const primaryKeyId = candidates[0]?.keyId ?? null;
+  let lastError: unknown;
+
+  for (let index = 0; index < candidates.length; index += 1) {
+    const candidate = candidates[index];
+    try {
+      const decryptedJson = await decryptJsonFromUserKv(encryptedRecord, candidate.privateKeyPem);
+      logUserKvDecryptionTelemetry({
+        recordKeyId: encryptedRecord.keyId,
+        selectedKeyId: candidate.keyId,
+        attemptCount: index + 1,
+        outcome: candidate.keyId === primaryKeyId ? 'primary-hit' : 'fallback-hit'
+      });
+      return decryptedJson;
+    } catch (error) {
+      lastError = error;
+    }
+  }
+
+  logUserKvDecryptionTelemetry({
+    recordKeyId: encryptedRecord.keyId,
+    selectedKeyId: null,
+    attemptCount: candidates.length,
+    outcome: 'all-failed',
+    reason: lastError instanceof Error ? lastError.message : 'unknown decryption error'
+  });
+
+  throw new Error(
+    `Failed to decrypt user KV record after ${candidates.length} key attempt(s): ${
+      lastError instanceof Error ? lastError.message : 'unknown decryption error'
+    }`
+  );
+}
+
+async function readUserRecord(env: Env, userUid: string): Promise<UserData | null> {
+  const storedValue = await env.USER_DB.get(userUid);
+  if (storedValue === null) {
+    return null;
+  }
+
+  const encryptedRecord = tryParseEncryptedRecord(storedValue);
+  if (encryptedRecord) {
+    validateEncryptedRecord(encryptedRecord);
+    const keyRegistry = parseUserKvPrivateKeyRegistry(env);
+    const decryptedJson = await decryptUserKvRecord(encryptedRecord, keyRegistry);
+    return JSON.parse(decryptedJson) as UserData;
+  }
+
+  // Legacy support: accept existing plaintext records and opportunistically
+  // rewrite them as encrypted records during the first successful read.
+  let parsedLegacyRecord: unknown;
+  try {
+    parsedLegacyRecord = JSON.parse(storedValue) as unknown;
+  } catch {
+    throw new Error('User KV record is not encrypted');
+  }
+
+  if (!isLegacyUserData(parsedLegacyRecord)) {
+    throw new Error('User KV record is not encrypted');
+  }
+
+  const legacyUserData = parsedLegacyRecord;
+
+  if (legacyUserData.uid !== userUid) {
+    throw new Error('User KV record UID mismatch');
+  }
+
+  try {
+    await writeUserRecord(env, userUid, legacyUserData);
+    console.info('Migrated plaintext USER_DB record to encrypted format', {
+      scope: 'user-kv',
+      uid: userUid
+    });
+  } catch (error) {
+    console.warn('Failed to migrate plaintext USER_DB record during read', {
+      scope: 'user-kv',
+      uid: userUid,
+      reason: error instanceof Error ? error.message : 'unknown migration error'
+    });
+  }
+
+  return legacyUserData;
+}
+
+async function writeUserRecord(env: Env, userUid: string, userData: UserData): Promise<void> {
+  const encryptedPayload = await encryptJsonForUserKv(
+    JSON.stringify(userData),
+    env.USER_KV_ENCRYPTION_PUBLIC_KEY,
+    env.USER_KV_ENCRYPTION_KEY_ID
+  );
+
+  await env.USER_DB.put(userUid, encryptedPayload);
+}
+
 function base64UrlEncode(value: string | Uint8Array): string {
   const bytes = typeof value === 'string' ? textEncoder.encode(value) : value;
   let binary = '';
@@ -266,21 +555,24 @@ async function deleteFirebaseAuthUser(env: Env, userUid: string): Promise<void>
 
 async function handleGetUser(env: Env, userUid: string): Promise<Response> {
   try {
-    const value = await env.USER_DB.get(userUid);
-    if (value === null) {
+    const userData = await readUserRecord(env, userUid);
+    if (userData === null) {
       return new Response('User not found', { 
         status: 404, 
         headers: corsHeaders 
       });
     }
-    return new Response(value, { 
+    return new Response(JSON.stringify(userData), { 
       status: 200, 
       headers: corsHeaders 
     });
-  } catch {
-    return new Response('Failed to get user data', { 
-      status: 500, 
-      headers: corsHeaders 
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown user data read error';
+    console.error('Failed to get user data:', { uid: userUid, reason: errorMessage });
+
+    return new Response('Failed to get user data', {
+      status: 500,
+      headers: corsHeaders
     });
   }
 }
@@ -292,21 +584,20 @@ async function handleAddUser(request: Request, env: Env, userUid: string): Promi
     const normalizedBadgeId = typeof badgeId === 'string' ? badgeId.trim() : undefined;
     
     // Check for existing user
-    const value = await env.USER_DB.get(userUid);
+    const existingUser = await readUserRecord(env, userUid);
     
     let userData: UserData;
-    if (value !== null) {
+    if (existingUser !== null) {
       // Update existing user, preserving cases
-      const existing: UserData = JSON.parse(value);
       userData = {
-        ...existing,
+        ...existingUser,
         // Preserve all existing fields
-        email: email || existing.email,
-        firstName: firstName || existing.firstName,
-        lastName: lastName || existing.lastName,
-        company: company || existing.company,
-        badgeId: normalizedBadgeId !== undefined ? normalizedBadgeId : (existing.badgeId ?? ''),
-        permitted: permitted !== undefined ? permitted : existing.permitted,
+        email: email || existingUser.email,
+        firstName: firstName || existingUser.firstName,
+        lastName: lastName || existingUser.lastName,
+        company: company || existingUser.company,
+        badgeId: normalizedBadgeId !== undefined ? normalizedBadgeId : (existingUser.badgeId ?? ''),
+        permitted: permitted !== undefined ? permitted : existingUser.permitted,
         updatedAt: new Date().toISOString()
       };
       if (requestData.readOnlyCases !== undefined) {
@@ -331,10 +622,10 @@ async function handleAddUser(request: Request, env: Env, userUid: string): Promi
     }
 
     // Store value in KV
-    await env.USER_DB.put(userUid, JSON.stringify(userData));
+    await writeUserRecord(env, userUid, userData);
 
     return new Response(JSON.stringify(userData), {
-      status: value !== null ? 200 : 201,
+      status: existingUser !== null ? 200 : 201,
       headers: corsHeaders
     });
   } catch {
@@ -454,14 +745,13 @@ async function executeUserDeletion(
   userUid: string,
   reportProgress?: (progress: AccountDeletionProgressEvent) => void
 ): Promise<{ success: boolean; message: string; totalCases: number; completedCases: number }> {
-  const userData = await env.USER_DB.get(userUid);
+  const userData = await readUserRecord(env, userUid);
   if (userData === null) {
     throw new Error('User not found');
   }
 
-  const userObject: UserData = JSON.parse(userData);
-  const ownedCases = (userObject.cases || []).map((caseItem) => caseItem.caseNumber);
-  const readOnlyCases = (userObject.readOnlyCases || []).map((caseItem) => caseItem.caseNumber);
+  const ownedCases = (userData.cases || []).map((caseItem) => caseItem.caseNumber);
+  const readOnlyCases = (userData.readOnlyCases || []).map((caseItem) => caseItem.caseNumber);
   const allCaseNumbers = Array.from(new Set([...ownedCases, ...readOnlyCases]));
   const totalCases = allCaseNumbers.length;
   let completedCases = 0;
@@ -604,8 +894,8 @@ async function handleAddCases(request: Request, env: Env, userUid: string): Prom
     const { cases = [] }: AddCasesRequest = await request.json();
     
     // Get current user data
-    const value = await env.USER_DB.get(userUid);
-    if (!value) {
+    const userData = await readUserRecord(env, userUid);
+    if (!userData) {
       return new Response('User not found', { 
         status: 404, 
         headers: corsHeaders 
@@ -613,7 +903,6 @@ async function handleAddCases(request: Request, env: Env, userUid: string): Prom
     }
 
     // Update cases
-    const userData: UserData = JSON.parse(value);
     const existingCases = userData.cases || [];
     
     // Filter out duplicates
@@ -628,7 +917,7 @@ async function handleAddCases(request: Request, env: Env, userUid: string): Prom
     userData.updatedAt = new Date().toISOString();
 
     // Save to KV
-    await env.USER_DB.put(userUid, JSON.stringify(userData));
+    await writeUserRecord(env, userUid, userData);
 
     return new Response(JSON.stringify(userData), {
       status: 200,
@@ -647,8 +936,8 @@ async function handleDeleteCases(request: Request, env: Env, userUid: string): P
     const { casesToDelete }: DeleteCasesRequest = await request.json();
     
     // Get current user data
-    const value = await env.USER_DB.get(userUid);
-    if (!value) {
+    const userData = await readUserRecord(env, userUid);
+    if (!userData) {
       return new Response('User not found', { 
         status: 404, 
         headers: corsHeaders 
@@ -656,14 +945,13 @@ async function handleDeleteCases(request: Request, env: Env, userUid: string): P
     }
 
     // Update user data
-    const userData: UserData = JSON.parse(value);
     userData.cases = userData.cases.filter(c => 
       !casesToDelete.includes(c.caseNumber)
     );
     userData.updatedAt = new Date().toISOString();
 
     // Save to KV
-    await env.USER_DB.put(userUid, JSON.stringify(userData));
+    await writeUserRecord(env, userUid, userData);
 
     return new Response(JSON.stringify(userData), {
       status: 200,
@@ -685,6 +973,13 @@ export default {
 
     try {
       await authenticate(request, env);
+
+      // DELETE can mutate user KV data (for example /:uid/cases), so non-GET methods require write config.
+      if (request.method === 'GET') {
+        requireUserKvReadConfig(env);
+      } else {
+        requireUserKvWriteConfig(env);
+      }
       
       const url = new URL(request.url);
       const parts = url.pathname.split('/');
@@ -728,6 +1023,13 @@ export default {
           headers: corsHeaders 
         });
       }
+
+      if (errorMessage === 'User KV encryption is not fully configured') {
+        return new Response(errorMessage, {
+          status: 500,
+          headers: corsHeaders
+        });
+      }
       
       return new Response('Internal Server Error', { 
         status: 500, 

package/workers/user-worker/wrangler.jsonc.example

@@ -2,7 +2,7 @@
   "name": "USER_WORKER_NAME",
   "account_id": "ACCOUNT_ID",
   "main": "src/user-worker.ts",
-  "compatibility_date": "2026-03-24",
+  "compatibility_date": "2026-03-25",
   "compatibility_flags": [
     "nodejs_compat"
   ], 

package/wrangler.toml.example

@@ -1,6 +1,6 @@
 #:schema node_modules/wrangler/config-schema.json
 name = "PAGES_PROJECT_NAME"
-compatibility_date = "2026-03-24"
+compatibility_date = "2026-03-25"
 compatibility_flags = ["nodejs_compat"]
 pages_build_output_dir = "./build/client"