@workos-inc/node 7.49.0 → 7.50.0

package/lib/vault/cryptography/decrypt.d.ts

@@ -5,5 +5,5 @@ export interface Decoded {
     keys: string;
     ciphertext: Buffer;
 }
-export declare const decrypt: (payload: string | Decoded, dataKey: string) => string;
+export declare const decrypt: (payload: string | Decoded, dataKey: string, aad: string) => string;
 export declare const decode: (payload: string) => Decoded;

package/lib/vault/cryptography/decrypt.js

@@ -6,14 +6,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.decode = exports.decrypt = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 const leb_1 = require("leb");
-const decrypt = (payload, dataKey) => {
+const decrypt = (payload, dataKey, aad) => {
     if (typeof payload === 'string') {
         payload = (0, exports.decode)(payload);
     }
     const { iv, tag, ciphertext } = payload;
     const key = Buffer.from(dataKey, 'base64');
-    const decipher = crypto_1.default.createDecipheriv('aes-256-gcm', key, iv);
-    decipher.setAuthTag(tag);
+    const decipher = crypto_1.default
+        .createDecipheriv('aes-256-gcm', key, iv)
+        .setAAD(Buffer.from(aad))
+        .setAuthTag(tag);
     const decrypted = decipher.update(ciphertext, undefined, 'utf-8') + decipher.final('utf-8');
     return decrypted;
 };

package/lib/vault/cryptography/encrypt.d.ts

@@ -1 +1 @@
-export declare const encrypt: (data: string, dataKey: string, encryptedKeys: string) => string;
+export declare const encrypt: (data: string, dataKey: string, encryptedKeys: string, aad: string) => string;

package/lib/vault/cryptography/encrypt.js

@@ -6,13 +6,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.encrypt = void 0;
 const crypto_1 = __importDefault(require("crypto"));
 const leb_1 = require("leb");
-const encrypt = (data, dataKey, encryptedKeys) => {
+const encrypt = (data, dataKey, encryptedKeys, aad) => {
     // encrypt using the returned data key
     const key = Buffer.from(dataKey, 'base64');
     const keyBlob = Buffer.from(encryptedKeys, 'base64');
     const prefixLen = (0, leb_1.encodeUInt32)(keyBlob.length);
     const iv = crypto_1.default.randomBytes(32);
-    const cipher = crypto_1.default.createCipheriv('aes-256-gcm', key, iv);
+    const cipher = crypto_1.default
+        .createCipheriv('aes-256-gcm', key, iv)
+        .setAAD(Buffer.from(aad));
     const ciphertext = Buffer.concat([
         cipher.update(data, 'utf8'),
         cipher.final(),

package/lib/vault/vault-live-test.spec.js

@@ -241,5 +241,20 @@ describe.skip('Vault Live Test', () => {
             const decrypted = yield workos.vault.decrypt(encrypted);
             expect(decrypted).toBe(superObject);
         }));
+        it('authenticates additional data', () => __awaiter(void 0, void 0, void 0, function* () {
+            const data = 'hot water freezes faster than cold water';
+            const keyContext = { everything: 'everywhere' };
+            const aad = 'seq1';
+            const encrypted = yield workos.vault.encrypt(data, keyContext, aad);
+            const decrypted = yield workos.vault.decrypt(encrypted, aad);
+            expect(decrypted).toBe(data);
+        }));
+        it('fails with invalid AD', () => __awaiter(void 0, void 0, void 0, function* () {
+            const data = 'hot water freezes faster than cold water';
+            const keyContext = { everything: 'everywhere' };
+            const aad = 'seq1';
+            const encrypted = yield workos.vault.encrypt(data, keyContext, aad);
+            yield expect(() => workos.vault.decrypt(encrypted)).rejects.toThrow('unable to authenticate data');
+        }));
     });
 });

package/lib/vault/vault.d.ts

@@ -14,8 +14,8 @@ export declare class Vault {
     deleteObject(options: DeleteObjectOptions): Promise<void>;
     createDataKey(options: CreateDataKeyOptions): Promise<DataKeyPair>;
     decryptDataKey(options: DecryptDataKeyOptions): Promise<DataKey>;
-    encrypt(data: string, context: KeyContext): Promise<string>;
-    decrypt(encryptedData: string): Promise<string>;
+    encrypt(data: string, context: KeyContext, associatedData?: string): Promise<string>;
+    decrypt(encryptedData: string, associatedData?: string): Promise<string>;
     createSecret: (options: CreateObjectOptions) => Promise<ObjectMetadata>;
     listSecrets: (options?: PaginationOptions | undefined) => Promise<List<ObjectDigest>>;
     listSecretVersions: (options: ReadObjectOptions) => Promise<ObjectVersion[]>;

package/lib/vault/vault.js

@@ -106,19 +106,19 @@ class Vault {
             return (0, vault_key_serializer_1.deserializeDecryptDataKeyResponse)(data);
         });
     }
-    encrypt(data, context) {
+    encrypt(data, context, associatedData) {
         return __awaiter(this, void 0, void 0, function* () {
             const { dataKey, encryptedKeys } = yield this.createDataKey({
                 context,
             });
-            return (0, encrypt_1.encrypt)(data, dataKey.key, encryptedKeys);
+            return (0, encrypt_1.encrypt)(data, dataKey.key, encryptedKeys, associatedData || '');
         });
     }
-    decrypt(encryptedData) {
+    decrypt(encryptedData, associatedData) {
         return __awaiter(this, void 0, void 0, function* () {
             const decoded = (0, decrypt_1.decode)(encryptedData);
             const dataKey = yield this.decryptDataKey({ keys: decoded.keys });
-            return (0, decrypt_1.decrypt)(decoded, dataKey.key);
+            return (0, decrypt_1.decrypt)(decoded, dataKey.key, associatedData || '');
         });
     }
 }

package/lib/workos.js

@@ -31,7 +31,7 @@ const widgets_1 = require("./widgets/widgets");
 const actions_1 = require("./actions/actions");
 const vault_1 = require("./vault/vault");
 const conflict_exception_1 = require("./common/exceptions/conflict.exception");
-const VERSION = '7.49.0';
+const VERSION = '7.50.0';
 const DEFAULT_HOSTNAME = 'api.workos.com';
 const HEADER_AUTHORIZATION = 'Authorization';
 const HEADER_IDEMPOTENCY_KEY = 'Idempotency-Key';

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "7.49.0",
+  "version": "7.50.0",
   "name": "@workos-inc/node",
   "author": "WorkOS",
   "description": "A Node wrapper for the WorkOS API",