authhero 8.2.1 → 8.3.0

package/dist/types/adapters/createEncryptedDataAdapter.d.ts

@@ -1,4 +1,19 @@
 import { DataAdapters } from "@authhero/adapter-interfaces";
+import { KeyRing } from "../utils/field-encryption";
+/**
+ * Resolves which key id (if any) a tenant's secrets are encrypted under.
+ * Returning `undefined` uses the ring's default key and produces legacy,
+ * untagged `enc:v1:` ciphertext — byte-compatible with the single-key adapter.
+ *
+ * The canonical use: tag rows owned by the control plane tenant with a
+ * control-plane-only key id, so the same database can hold a tenant's own
+ * secrets (default key) alongside inherited control plane secrets the tenant
+ * operator cannot decrypt.
+ */
+export type EncryptKeyIdResolver = (tenantId: string) => string | undefined;
+interface EncryptionOptions {
+    resolveEncryptKeyId?: EncryptKeyIdResolver;
+}
 /**
  * Wraps a DataAdapters instance so that sensitive credential fields are
  * transparently encrypted on write and decrypted on read. Only the adapters
@@ -16,3 +31,28 @@ import { DataAdapters } from "@authhero/adapter-interfaces";
  * Private keys (keys.pkcs7, dkim_private_key) are intentionally NOT covered.
  */
 export declare function createEncryptedDataAdapter(data: DataAdapters, key: CryptoKey): DataAdapters;
+/**
+ * Like {@link createEncryptedDataAdapter}, but encrypts each tenant's secrets
+ * under a key selected from a {@link KeyRing}. On read, the key is chosen from
+ * the id embedded in the ciphertext, so a single database can mix values
+ * encrypted under different keys.
+ *
+ * `options.resolveEncryptKeyId(tenantId)` decides which key id new ciphertext is
+ * tagged with. Return `undefined` for the ring's default key (legacy untagged
+ * form). The intended use is to tag control plane tenant rows with a
+ * control-plane-only key id so an inheriting tenant can hold the inherited
+ * secrets at rest without being able to decrypt them.
+ *
+ * @example
+ * ```typescript
+ * const adapters = createEncryptedDataAdapterWithKeyRing(base, {
+ *   default: tenantKey,
+ *   keys: { cp: controlPlaneKey },
+ * }, {
+ *   resolveEncryptKeyId: (tenantId) =>
+ *     tenantId === CONTROL_PLANE_TENANT_ID ? "cp" : undefined,
+ * });
+ * ```
+ */
+export declare function createEncryptedDataAdapterWithKeyRing(data: DataAdapters, ring: KeyRing, options?: EncryptionOptions): DataAdapters;
+export {};

package/dist/types/adapters/index.d.ts

@@ -1,3 +1,5 @@
 export * from "./cache";
-export { createEncryptedDataAdapter } from "./createEncryptedDataAdapter";
-export { loadEncryptionKey, encryptField, decryptField, isEncrypted, } from "../utils/field-encryption";
+export { createEncryptedDataAdapter, createEncryptedDataAdapterWithKeyRing, } from "./createEncryptedDataAdapter";
+export type { EncryptKeyIdResolver } from "./createEncryptedDataAdapter";
+export { loadEncryptionKey, encryptField, decryptField, encryptFieldWithRing, decryptFieldWithRing, parseKeyId, isEncrypted, } from "../utils/field-encryption";
+export type { KeyRing } from "../utils/field-encryption";