zibri 2.3.0 → 2.4.1

package/dist/cjs/auth/encryption/encryption.service.d.ts

@@ -0,0 +1,71 @@
+import { EncryptionKeyCreateData, EncryptionKey } from './encryption-key.model';
+import { type EncryptionMasterOptions } from './encryption-master-options.model';
+import { type DeleteEncryptionKeyOptions, EncryptionServiceInterface, EncryptOptions } from './encryption-service.interface';
+import { type EncryptionString } from './encryption.utilities';
+import { EncryptionStrategyEntity, type EncryptionStrategyEntityCreateData } from './strategies/encryption-strategy-entity.model';
+import { BaseEncryptOptions, EncryptionStrategyInterface } from './strategies/encryption-strategy.interface';
+import { WriteThroughReadThroughCache } from '../../caching/cache/read-through/write-through-read-through.cache';
+import { type CacheServiceInterface } from '../../caching/cache-service.interface';
+import { type BaseRepositoryOptions } from '../../data-source/models/options/base-repository-options.model';
+import { Where } from '../../data-source/models/where/where-filter.model';
+import { Repository } from '../../data-source/repository';
+import { AnyObject } from '../../entity/any-object.model';
+import { OnAppInit } from '../../global/on-app-init.interface';
+import { type LoggerInterface } from '../../logging/logger.interface';
+import { type MetricsServiceInterface } from '../../metrics/metrics-service.interface';
+import { type Newable } from '../../types/newable.type';
+import { type OmitStrict } from '../../types/omit-strict.type';
+export declare class EncryptionKeyCache extends WriteThroughReadThroughCache<string, EncryptionKey, 'EncryptionKeyCache'> {
+    protected get logger(): LoggerInterface;
+    protected get cacheService(): CacheServiceInterface;
+    protected get metricsService(): MetricsServiceInterface;
+    constructor();
+}
+/**
+ * Default encryption service implementation of Zibri.
+ */
+export declare class EncryptionService implements EncryptionServiceInterface, OnAppInit {
+    private readonly strategyRepository;
+    private readonly keyRepository;
+    private readonly strategyClasses;
+    private hasCreatedInitialDefaultStrategy;
+    private readonly strategies;
+    private readonly strategyEntities;
+    private readonly options;
+    constructor(strategyRepository: Repository<EncryptionStrategyEntity, EncryptionStrategyEntityCreateData>, keyRepository: Repository<EncryptionKey, EncryptionKeyCreateData>, strategyClasses: Newable<EncryptionStrategyInterface<unknown>>[], options: EncryptionMasterOptions<unknown> | undefined);
+    onAppInit(): Promise<void>;
+    encrypt<TKey, TEncryptOptions extends BaseEncryptOptions<TKey>>(value: string, options?: EncryptOptions<TKey, TEncryptOptions>): Promise<EncryptionString>;
+    decrypt<TDecryptOptions extends AnyObject>(value: EncryptionString, options?: TDecryptOptions): Promise<string>;
+    createKey<TKey>(strategyClass: Newable<EncryptionStrategyInterface<TKey>>, data: OmitStrict<EncryptionKeyCreateData, 'strategy' | 'value'>, options?: BaseRepositoryOptions): Promise<EncryptionKey>;
+    deleteKey(keyId: string, options?: DeleteEncryptionKeyOptions): Promise<void>;
+    deleteAllKeys(where: Where<EncryptionKey>, options?: DeleteEncryptionKeyOptions): Promise<void>;
+    markKeyAsDefaultForStrategy<TKey>(keyId: string, strategyClass: Newable<EncryptionStrategyInterface<TKey>>, options?: BaseRepositoryOptions): Promise<void>;
+    decryptKey<TKey, TEncryptOptions extends BaseEncryptOptions<TKey>>(strategy: Newable<EncryptionStrategyInterface<TKey, TEncryptOptions>>, encryptedKey: EncryptionString): Promise<TKey>;
+    needsReEncryption(encrypted: EncryptionString): Promise<boolean>;
+    private needsMasterReEncryption;
+    private generateEncryptedKey;
+    private findKey;
+    private findKeyEntityById;
+    private createKeyEntity;
+    private updateKeyEntityById;
+    private deleteKeyEntityById;
+    private createStrategyEntity;
+    private syncStrategyEntityKey;
+    private findOrCreateDefaultKeyForStrategy;
+    private findStrategy;
+    private findStrategyClass;
+    private masterEncrypt;
+    private masterDecrypt;
+    private findDefaultStrategy;
+    private validateNoDuplicateEncryptionStrategy;
+    private validateNoDuplicateMasterEncryptionStrategy;
+    private validateNoMissingEncryptionStrategy;
+    private validateNoDotsInMasterKeyIds;
+    private validateNoMissingMasterKeyIds;
+    private validateNoMissingMasterEncryptionStrategy;
+    private validateStrategyNamesAndVersions;
+    private validateMasterStrategyNamesAndVersions;
+    private reEncryptKeys;
+    private reEncryptKey;
+}
+//# sourceMappingURL=encryption.service.d.ts.map

package/dist/cjs/auth/encryption/encryption.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.service.d.ts","sourceRoot":"","sources":["../../../../src/auth/encryption/encryption.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAuB,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,EAAE,KAAK,uBAAuB,EAAuB,MAAM,mCAAmC,CAAC;AACtG,OAAO,EAAE,KAAK,0BAA0B,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAC7H,OAAO,EAAqB,KAAK,gBAAgB,EAAuB,MAAM,wBAAwB,CAAC;AACvG,OAAO,EAAE,wBAAwB,EAAE,KAAK,kCAAkC,EAA4B,MAAM,+CAA+C,CAAC;AAC5J,OAAO,EAAsB,kBAAkB,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACjI,OAAO,EAAE,4BAA4B,EAAE,MAAM,mEAAmE,CAAC;AACjH,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAMnF,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,gEAAgE,CAAC;AAC5G,OAAO,EAAE,KAAK,EAAE,MAAM,mDAAmD,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAS1D,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,KAAK,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAEvF,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAa/D,qBAEa,kBAAmB,SAAQ,4BAA4B,CAAC,MAAM,EAAE,aAAa,EAAE,oBAAoB,CAAC;IAG7G,SAAS,KAAK,MAAM,IAAI,eAAe,CAEtC;IAGD,SAAS,KAAK,YAAY,IAAI,qBAAqB,CAElD;IAGD,SAAS,KAAK,cAAc,IAAI,uBAAuB,CAEtD;;CAKJ;AAED;;GAEG;AACH,qBACa,iBAAkB,YAAW,0BAA0B,EAAE,SAAS;IAQvE,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAEnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAE9B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAXpC,OAAO,CAAC,gCAAgC,CAAkB;IAC1D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA8C;IACzE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkC;IACnE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;gBAItC,kBAAkB,EAAE,UAAU,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,EAE5F,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,uBAAuB,CAAC,EAEjE,eAAe,EAAE,OAAO,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,EAAE,EAEjF,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,GAAG,SAAS;IASnD,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB1B,OAAO,CAAC,IAAI,EAAE,eAAe,SAAS,kBAAkB,CAAC,IAAI,CAAC,EAChE,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,GAChD,OAAO,CAAC,gBAAgB,CAAC;IA4FtB,OAAO,CAAC,eAAe,SAAS,SAAS,EAC3C,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE,eAAe,GAC1B,OAAO,CAAC,MAAM,CAAC;IAQZ,SAAS,CAAC,IAAI,EAChB,aAAa,EAAE,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,EACzD,IAAI,EAAE,UAAU,CAAC,uBAAuB,EAAE,UAAU,GAAG,OAAO,CAAC,EAC/D,OAAO,CAAC,EAAE,qBAAqB,GAChC,OAAO,CAAC,aAAa,CAAC;IAiBnB,SAAS,CACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACrC,OAAO,CAAC,IAAI,CAAC;IAUV,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,GAAE,0BAA+B,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BnG,2BAA2B,CAAC,IAAI,EAClC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,EACzD,OAAO,GAAE,qBAA0B,GACpC,OAAO,CAAC,IAAI,CAAC;IAuCV,UAAU,CAAC,IAAI,EAAE,eAAe,SAAS,kBAAkB,CAAC,IAAI,CAAC,EACnE,QAAQ,EAAE,OAAO,CAAC,2BAA2B,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,EACrE,YAAY,EAAE,gBAAgB,GAC/B,OAAO,CAAC,IAAI,CAAC;IAOV,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAatE,OAAO,CAAC,uBAAuB;YAyBjB,oBAAoB;YAOpB,OAAO;YAYP,iBAAiB;YAMjB,eAAe;YAkBf,mBAAmB;YAanB,mBAAmB;YASnB,oBAAoB;IAMlC,OAAO,CAAC,qBAAqB;YASf,iCAAiC;IAM/C,OAAO,CAAC,YAAY;IAcpB,OAAO,CAAC,iBAAiB;YAcX,aAAa;YAkBb,aAAa;IAmB3B,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,qCAAqC;IAc7C,OAAO,CAAC,2CAA2C;IAkBnD,OAAO,CAAC,mCAAmC;IAc3C,OAAO,CAAC,4BAA4B;IAmBpC,OAAO,CAAC,6BAA6B;IAuBrC,OAAO,CAAC,yCAAyC;IAoBjD,OAAO,CAAC,gCAAgC;IAiBxC,OAAO,CAAC,sCAAsC;YAqBhC,aAAa;YAIb,YAAY;CAU7B"}

package/dist/cjs/auth/encryption/encryption.service.js

@@ -0,0 +1,559 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncryptionService = exports.EncryptionKeyCache = void 0;
+const encryption_key_model_1 = require("./encryption-key.model");
+const encryption_utilities_1 = require("./encryption.utilities");
+const encryption_strategy_entity_model_1 = require("./strategies/encryption-strategy-entity.model");
+const write_through_read_through_cache_1 = require("../../caching/cache/read-through/write-through-read-through.cache");
+const cache_delete_decorator_1 = require("../../caching/decorators/cache-delete.decorator");
+const cache_write_decorator_1 = require("../../caching/decorators/cache-write.decorator");
+const cache_decorator_1 = require("../../caching/decorators/cache.decorator");
+const cached_decorator_1 = require("../../caching/decorators/cached.decorator");
+const in_memory_cache_store_1 = require("../../caching/store/in-memory.cache-store");
+const repository_1 = require("../../data-source/repository");
+const inject_repository_decorator_1 = require("../../di/decorators/inject-repository.decorator");
+const inject_decorator_1 = require("../../di/decorators/inject.decorator");
+const injectable_decorator_1 = require("../../di/decorators/injectable.decorator");
+const zibri_di_tokens_default_1 = require("../../di/default/zibri-di-tokens.default");
+const no_provider_error_1 = require("../../di/errors/no-provider.error");
+const inject_function_1 = require("../../di/inject.function");
+const register_function_1 = require("../../di/register.function");
+const not_found_error_1 = require("../../error-handling/errors/not-found.error");
+const promise_utilities_1 = require("../../utilities/promise.utilities");
+const INIT_ERROR_MESSAGE = 'Error initializing encryption service.';
+let EncryptionKeyCache = class EncryptionKeyCache extends write_through_read_through_cache_1.WriteThroughReadThroughCache {
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    get logger() {
+        return (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.LOGGER);
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    get cacheService() {
+        return (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.CACHE_SERVICE);
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    get metricsService() {
+        return (0, inject_function_1.inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.METRICS_SERVICE);
+    }
+    constructor() {
+        super('EncryptionKeyCache', new in_memory_cache_store_1.InMemoryCacheStore(), []);
+    }
+};
+exports.EncryptionKeyCache = EncryptionKeyCache;
+exports.EncryptionKeyCache = EncryptionKeyCache = __decorate([
+    (0, cache_decorator_1.Cache)()
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    ,
+    __metadata("design:paramtypes", [])
+], EncryptionKeyCache);
+/**
+ * Default encryption service implementation of Zibri.
+ */
+let EncryptionService = class EncryptionService {
+    strategyRepository;
+    keyRepository;
+    strategyClasses;
+    hasCreatedInitialDefaultStrategy = false;
+    strategies = [];
+    strategyEntities = [];
+    options;
+    constructor(strategyRepository, keyRepository, strategyClasses, options) {
+        this.strategyRepository = strategyRepository;
+        this.keyRepository = keyRepository;
+        this.strategyClasses = strategyClasses;
+        if (!options) {
+            throw new no_provider_error_1.NoProviderError(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.ENCRYPTION_MASTER_OPTIONS, []);
+        }
+        this.options = options;
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async onAppInit() {
+        if (!this.strategyClasses.length) {
+            throw new Error('Needs to provide at least one encryption strategy.');
+        }
+        for (const strategy of this.strategyClasses) {
+            (0, register_function_1.register)({ token: strategy, useClass: strategy });
+            this.strategies.push((0, inject_function_1.inject)(strategy));
+        }
+        const strategies = await this.strategyRepository.findAll();
+        this.strategyEntities.push(...strategies);
+        this.validateNoDuplicateEncryptionStrategy();
+        this.validateNoMissingEncryptionStrategy();
+        this.validateStrategyNamesAndVersions();
+        const keys = await this.keyRepository.findAll();
+        this.validateNoDuplicateMasterEncryptionStrategy();
+        this.validateNoMissingMasterEncryptionStrategy(keys);
+        this.validateMasterStrategyNamesAndVersions();
+        this.validateNoDotsInMasterKeyIds();
+        this.validateNoMissingMasterKeyIds(keys);
+        await this.reEncryptKeys(keys);
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async encrypt(value, options) {
+        if (!options) {
+            const strategy = this.findDefaultStrategy();
+            if (!this.hasCreatedInitialDefaultStrategy && !strategy.entity && !this.strategyEntities.length) {
+                const key = {
+                    status: encryption_key_model_1.EncryptionKeyStatus.DEFAULT,
+                    value: await this.generateEncryptedKey(strategy.strategy)
+                };
+                const entity = await this.createStrategyEntity({
+                    name: strategy.strategy.name,
+                    version: strategy.strategy.version,
+                    status: encryption_strategy_entity_model_1.EncryptionStrategyStatus.DEFAULT,
+                    keys: [key]
+                });
+                this.hasCreatedInitialDefaultStrategy = true;
+                const strategyClass = this.findStrategyClass(strategy.strategy.name, strategy.strategy.version);
+                const decryptedKey = await this.decryptKey(strategyClass, key.value);
+                return await strategy.strategy.encrypt(value, { keyId: entity.keys[0].id, key: decryptedKey });
+            }
+            if (!strategy.entity) {
+                const key = {
+                    status: encryption_key_model_1.EncryptionKeyStatus.DEFAULT,
+                    value: await this.generateEncryptedKey(strategy.strategy)
+                };
+                const entity = await this.createStrategyEntity({
+                    name: strategy.strategy.name,
+                    version: strategy.strategy.version,
+                    status: encryption_strategy_entity_model_1.EncryptionStrategyStatus.ACTIVE,
+                    keys: [key]
+                });
+                const strategyClass = this.findStrategyClass(strategy.strategy.name, strategy.strategy.version);
+                const decryptedKey = await this.decryptKey(strategyClass, key.value);
+                return await strategy.strategy.encrypt(value, { keyId: entity.keys[0].id, key: decryptedKey });
+            }
+            const strategyClass = this.findStrategyClass(strategy.strategy.name, strategy.strategy.version);
+            const key = await this.findOrCreateDefaultKeyForStrategy(strategy.entity);
+            const decryptedKey = await this.decryptKey(strategyClass, key.value);
+            return await strategy.strategy.encrypt(value, { keyId: key.id, key: decryptedKey });
+        }
+        const strategy = this.strategies.find(s => s instanceof options.strategy);
+        if (!strategy) {
+            throw new Error(`The given strategy ${options.strategy.name} was not provided as part of ZIBRI_DI_TOKENS.ENCRYPTION_STRATEGIES`);
+        }
+        if (options.strategyOptions?.keyId) {
+            const decryptedKey = await this.findKey(options.strategyOptions.keyId, undefined);
+            return await strategy.encrypt(value, { key: decryptedKey, keyId: options.strategyOptions.keyId, ...options.strategyOptions });
+        }
+        const entity = this.strategyEntities.find(s => s.name === strategy.name && s.version === strategy.version);
+        if (!entity) {
+            const key = {
+                status: encryption_key_model_1.EncryptionKeyStatus.DEFAULT,
+                value: await this.generateEncryptedKey(strategy)
+            };
+            const createdEntity = await this.createStrategyEntity({
+                name: strategy.name,
+                version: strategy.version,
+                status: encryption_strategy_entity_model_1.EncryptionStrategyStatus.ACTIVE,
+                keys: [key]
+            });
+            const decryptedKey = await this.decryptKey(options.strategy, key.value);
+            return await strategy.encrypt(value, { keyId: createdEntity.keys[0].id, key: decryptedKey, ...options.strategyOptions });
+        }
+        const key = await this.findOrCreateDefaultKeyForStrategy(entity);
+        const decryptedKey = await this.decryptKey(options.strategy, key.value);
+        return await strategy.encrypt(value, { key: decryptedKey, keyId: key.id, ...options.strategyOptions });
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async decrypt(value, options) {
+        const content = encryption_utilities_1.EncryptionUtilities.encryptionStringToContent(value);
+        const strategy = this.findStrategy(content.strategyName, content.version);
+        const key = await this.findKey(content.keyId, undefined);
+        return await strategy.decrypt(value, { key, keyId: content.keyId, ...options ?? {} });
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async createKey(strategyClass, data, options) {
+        const strategy = (0, inject_function_1.inject)(strategyClass);
+        const encryptedKey = await this.generateEncryptedKey(strategy);
+        const entity = this.strategyEntities.find(s => s.name === strategy.name && s.version === strategy.version);
+        if (!entity) {
+            throw new not_found_error_1.NotFoundError(`Could not find ${encryption_strategy_entity_model_1.EncryptionStrategyEntity.name}.`);
+        }
+        const currentDefaultKey = entity.keys.find(k => k.status === encryption_key_model_1.EncryptionKeyStatus.DEFAULT);
+        if (data.status === encryption_key_model_1.EncryptionKeyStatus.DEFAULT && currentDefaultKey) {
+            await this.updateKeyEntityById(currentDefaultKey.id, { status: encryption_key_model_1.EncryptionKeyStatus.ACTIVE }, options);
+        }
+        return await this.createKeyEntity(encryptedKey, entity, data, options);
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async deleteKey(keyId, options) {
+        const key = await this.findKeyEntityById(keyId, options);
+        if (key.status === encryption_key_model_1.EncryptionKeyStatus.DEFAULT && !(options?.allowDefault ?? false)) {
+            throw new Error('Cannot delete the default key. Pass allowDefault: true to override.');
+        }
+        await this.deleteKeyEntityById(keyId, options);
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async deleteAllKeys(where, options = {}) {
+        const keys = await this.keyRepository.findAll({ where });
+        if (!(options.allowDefault ?? false) && keys.some(k => k.status === encryption_key_model_1.EncryptionKeyStatus.DEFAULT)) {
+            throw new Error('Cannot delete a default key. Pass allowDefault: true to override.');
+        }
+        const transaction = options.transaction ?? await this.keyRepository.dataSource.startTransaction();
+        const ownTransaction = !options.transaction;
+        options.transaction = transaction;
+        try {
+            await promise_utilities_1.PromiseUtilities.allChunked(keys, k => this.deleteKeyEntityById(k.id, options));
+            if (ownTransaction) {
+                await transaction.commit();
+            }
+        }
+        catch (error) {
+            if (ownTransaction) {
+                await transaction.rollback();
+            }
+            throw error;
+        }
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async markKeyAsDefaultForStrategy(keyId, strategyClass, options = {}) {
+        const transaction = options.transaction ?? await this.keyRepository.dataSource.startTransaction();
+        const ownTransaction = !options.transaction; // track if we created it
+        options.transaction = transaction;
+        try {
+            const strategy = (0, inject_function_1.inject)(strategyClass);
+            const entity = this.strategyEntities.find(s => s.name === strategy.name && s.version === strategy.version);
+            if (!entity) {
+                throw new not_found_error_1.NotFoundError(`Could not find ${encryption_strategy_entity_model_1.EncryptionStrategyEntity.name}.`);
+            }
+            const key = await this.findKeyEntityById(keyId, options);
+            if (key.strategy.name !== strategy.name || key.strategy.version !== strategy.version) {
+                throw new Error('The key for the given id has a different strategy than the provided one');
+            }
+            const currentDefaultKey = entity.keys.find(k => k.status === encryption_key_model_1.EncryptionKeyStatus.DEFAULT);
+            if (currentDefaultKey) {
+                await this.updateKeyEntityById(currentDefaultKey.id, { status: encryption_key_model_1.EncryptionKeyStatus.ACTIVE }, options);
+            }
+            await this.updateKeyEntityById(keyId, { status: encryption_key_model_1.EncryptionKeyStatus.DEFAULT }, options);
+            if (ownTransaction) {
+                await transaction.commit();
+            }
+        }
+        catch (error) {
+            if (ownTransaction) {
+                await transaction.rollback();
+            }
+            throw error;
+        }
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async decryptKey(strategy, encryptedKey) {
+        const keyBase64 = await this.masterDecrypt(encryptedKey);
+        const keyBuffer = Buffer.from(keyBase64, 'base64');
+        return await (0, inject_function_1.inject)(strategy).deserializeKey(keyBuffer);
+    }
+    // eslint-disable-next-line jsdoc/require-jsdoc
+    async needsReEncryption(encrypted) {
+        const content = encryption_utilities_1.EncryptionUtilities.encryptionStringToContent(encrypted);
+        const strategy = this.findStrategy(content.strategyName, content.version);
+        const strategyEntity = this.strategyEntities.find(s => s.name === strategy.name && s.version === strategy.version);
+        if (!strategyEntity) {
+            throw new not_found_error_1.NotFoundError(`Could not find ${encryption_strategy_entity_model_1.EncryptionStrategyEntity.name}.`);
+        }
+        const key = await this.findKeyEntityById(content.keyId, undefined);
+        return strategyEntity.status === encryption_strategy_entity_model_1.EncryptionStrategyStatus.DEPRECATED || key.status === encryption_key_model_1.EncryptionKeyStatus.DEPRECATED;
+    }
+    needsMasterReEncryption(encrypted) {
+        const content = encryption_utilities_1.EncryptionUtilities.encryptionStringToContent(encrypted);
+        const allKeys = [
+            this.options.currentMasterKey,
+            ...this.options.oldMasterKeys ?? []
+        ];
+        const key = allKeys.find(k => k.id === content.keyId);
+        if (!key) {
+            throw new Error(`No master key found with id "${content.keyId}"`);
+        }
+        const allStrategies = [
+            this.options.currentMasterStrategy,
+            ...this.options.oldMasterStrategies ?? []
+        ];
+        const strategy = allStrategies.find(k => k.name === content.strategyName && k.version === content.version);
+        if (!strategy) {
+            throw new Error(`No master strategy found for ${content.strategyName} (${content.version})`);
+        }
+        return strategy.name !== this.options.currentMasterStrategy.name
+            || strategy.version !== this.options.currentMasterStrategy.version
+            || key.id !== this.options.currentMasterKey.id;
+    }
+    async generateEncryptedKey(strategy) {
+        const rawKey = await strategy.generateRandomKey();
+        const keyBytes = await strategy.serializeKey(rawKey);
+        const keyBase64 = keyBytes.toString('base64');
+        return await this.masterEncrypt(keyBase64);
+    }
+    async findKey(keyId, options) {
+        const entity = await this.findKeyEntityById(keyId, options);
+        const strategy = this.findStrategyClass(entity.strategy.name, entity.strategy.version);
+        return await this.decryptKey(strategy, entity.value);
+    }
+    // eslint-disable-next-line unusedImports/no-unused-vars
+    async findKeyEntityById(id, options) {
+        return await this.keyRepository.findById(id, { relations: ['strategy'], ...options });
+    }
+    // eslint-disable-next-line unusedImports/no-unused-vars
+    async createKeyEntity(encryptedValue, strategy, data, options) {
+        const created = await this.keyRepository.create({
+            value: encryptedValue,
+            strategy,
+            ...data
+        }, options);
+        const key = await this.keyRepository.findById(created.id, { relations: ['strategy'], ...options });
+        this.syncStrategyEntityKey(strategy, key);
+        return key;
+    }
+    // eslint-disable-next-line unusedImports/no-unused-vars
+    async updateKeyEntityById(id, data, options) {
+        const updated = await this.keyRepository.updateById(id, data, options);
+        const key = await this.keyRepository.findById(updated.id, { relations: ['strategy'], ...options });
+        this.syncStrategyEntityKey(updated.strategy, key);
+        return key;
+    }
+    // eslint-disable-next-line unusedImports/no-unused-vars
+    async deleteKeyEntityById(id, options) {
+        const strategy = this.strategyEntities.find(s => s.keys.some(k => k.id === id));
+        if (!strategy) {
+            throw new not_found_error_1.NotFoundError(`Could not find strategy for key with id ${id}`);
+        }
+        strategy.keys = strategy.keys.filter(k => k.id !== id);
+        await this.keyRepository.deleteById(id, options);
+    }
+    async createStrategyEntity(data) {
+        const res = await this.strategyRepository.create(data);
+        this.strategyEntities.push(res);
+        return res;
+    }
+    syncStrategyEntityKey(strategy, key) {
+        const existingIndex = strategy.keys.findIndex(k => k.id === key.id);
+        if (existingIndex >= 0) {
+            strategy.keys[existingIndex] = key;
+            return;
+        }
+        strategy.keys.push(key);
+    }
+    async findOrCreateDefaultKeyForStrategy(strategy) {
+        return strategy.keys.find(k => k.status === encryption_key_model_1.EncryptionKeyStatus.DEFAULT)
+            ?? strategy.keys.at(0)
+            ?? await this.createKey(this.findStrategyClass(strategy.name, strategy.version), { status: encryption_key_model_1.EncryptionKeyStatus.DEFAULT });
+    }
+    findStrategy(name, version) {
+        const res = this.strategies.find(s => s.name === name && s.version === version);
+        if (!res) {
+            throw new Error(`No strategy found for ${name} (${version})`);
+        }
+        return res;
+    }
+    findStrategyClass(name, version) {
+        const res = this.strategyClasses.find(s => (0, inject_function_1.inject)(s).name === name && (0, inject_function_1.inject)(s).version === version);
+        if (!res) {
+            throw new Error(`No strategy found for ${name} (${version})`);
+        }
+        return res;
+    }
+    async masterEncrypt(keyBase64) {
+        const encrypted = await this.options.currentMasterStrategy.encrypt(keyBase64, {
+            key: this.options.currentMasterKey.value,
+            keyId: this.options.currentMasterKey.id
+        });
+        const content = encryption_utilities_1.EncryptionUtilities.encryptionStringToContent(encrypted);
+        if (content.keyId !== this.options.currentMasterKey.id) {
+            throw new Error(`Master key id mismatch: expected ${this.options.currentMasterKey.id}, got ${content.keyId}`);
+        }
+        return encrypted;
+    }
+    async masterDecrypt(encrypted) {
+        const content = encryption_utilities_1.EncryptionUtilities.encryptionStringToContent(encrypted);
+        const masterKey = [
+            this.options.currentMasterKey,
+            ...this.options.oldMasterKeys ?? []
+        ].find(k => k.id === content.keyId);
+        if (!masterKey) {
+            throw new Error(`Could not find master encryption key with id "${content.keyId}"`);
+        }
+        const masterStrategy = [
+            this.options.currentMasterStrategy,
+            ...this.options.oldMasterStrategies ?? []
+        ].find(s => s.name === content.strategyName && s.version === content.version);
+        if (!masterStrategy) {
+            throw new Error(`Could not find master encryption strategy ${content.strategyName} (${content.version})`);
+        }
+        return await masterStrategy.decrypt(encrypted, { key: masterKey.value, keyId: masterKey.id });
+    }
+    findDefaultStrategy() {
+        const entity = this.strategyEntities.find(s => s.status === encryption_strategy_entity_model_1.EncryptionStrategyStatus.DEFAULT);
+        return entity
+            ? { strategy: this.findStrategy(entity.name, entity.version), entity }
+            : { strategy: this.strategies[0], entity };
+    }
+    validateNoDuplicateEncryptionStrategy() {
+        const duplicateStrategies = this.strategies.filter(s => this.strategies.filter(hs => hs.name === s.name && hs.version === s.version).length > 1);
+        if (duplicateStrategies.length) {
+            throw new Error([
+                'There are duplicate encryption strategies:',
+                [...new Set(duplicateStrategies)].map(s => `- ${s.name} (${s.version})`)
+            ].join('\n'));
+        }
+    }
+    validateNoDuplicateMasterEncryptionStrategy() {
+        const allMasterStrategies = [
+            this.options.currentMasterStrategy,
+            ...this.options.oldMasterStrategies ?? []
+        ];
+        const duplicateStrategies = allMasterStrategies.filter(s => allMasterStrategies.filter(hs => hs.name === s.name && hs.version === s.version).length > 1);
+        if (duplicateStrategies.length) {
+            throw new Error([
+                'There are duplicate master encryption strategies:',
+                [...new Set(duplicateStrategies)].map(s => `- ${s.name} (${s.version})`)
+            ].join('\n'));
+        }
+    }
+    validateNoMissingEncryptionStrategy() {
+        const missingStrategies = this.strategyEntities.filter(s => !this.strategies.some(hs => hs.name === s.name && hs.version === s.version));
+        if (missingStrategies.length) {
+            const message = [INIT_ERROR_MESSAGE, 'There are missing strategies:'];
+            for (const strategy of missingStrategies) {
+                message.push(`  - ${strategy.name} (${strategy.version})`);
+            }
+            message.push('Did you remove them?');
+            throw new Error(message.join('\n'));
+        }
+    }
+    validateNoDotsInMasterKeyIds() {
+        const allKeys = [
+            this.options.currentMasterKey,
+            ...this.options.oldMasterKeys ?? []
+        ];
+        const keysWithDotsInId = allKeys.filter(s => s.id.includes('.'));
+        if (!keysWithDotsInId.length) {
+            return;
+        }
+        const message = [INIT_ERROR_MESSAGE, 'There are master keys that use dots in their id:'];
+        for (const key of keysWithDotsInId) {
+            message.push(`  - ${key.id}`);
+        }
+        throw new Error(message.join('\n'));
+    }
+    validateNoMissingMasterKeyIds(keys) {
+        const allMasterKeys = [
+            this.options.currentMasterKey,
+            ...this.options.oldMasterKeys ?? []
+        ];
+        const missingKeyIds = keys
+            .map(k => encryption_utilities_1.EncryptionUtilities.encryptionStringToContent(k.value).keyId)
+            .filter(keyId => !allMasterKeys.some(k => k.id === keyId));
+        if (!missingKeyIds.length) {
+            return;
+        }
+        throw new Error([
+            INIT_ERROR_MESSAGE,
+            'There are missing master key ids:',
+            ...missingKeyIds.map(id => `  - ${id}`)
+        ].join('\n'));
+    }
+    validateNoMissingMasterEncryptionStrategy(keys) {
+        const allMasterStrategies = [
+            this.options.currentMasterStrategy,
+            ...this.options.oldMasterStrategies ?? []
+        ];
+        const missingStrategies = keys
+            .map(k => encryption_utilities_1.EncryptionUtilities.encryptionStringToContent(k.value))
+            .filter(s => !allMasterStrategies.some(hs => hs.name === s.strategyName && hs.version === s.version));
+        if (missingStrategies.length) {
+            const message = [INIT_ERROR_MESSAGE, 'There are missing master strategies:'];
+            for (const strategy of missingStrategies) {
+                message.push(`  - ${strategy.strategyName} (${strategy.version})`);
+            }
+            message.push('Did you remove them?');
+            throw new Error(message.join('\n'));
+        }
+    }
+    validateStrategyNamesAndVersions() {
+        const strategiesWithDotsInNameOrVersion = this.strategies.filter(s => s.name.includes('.') || s.version.includes('.'));
+        if (!strategiesWithDotsInNameOrVersion.length) {
+            return;
+        }
+        const message = [
+            INIT_ERROR_MESSAGE,
+            'There are strategies that use dots in either the version or the name:'
+        ];
+        for (const strategy of strategiesWithDotsInNameOrVersion) {
+            message.push(`  - ${strategy.name} (${strategy.version})`);
+        }
+        throw new Error(message.join('\n'));
+    }
+    validateMasterStrategyNamesAndVersions() {
+        const allMasterStrategies = [
+            this.options.currentMasterStrategy,
+            ...this.options.oldMasterStrategies ?? []
+        ];
+        const strategiesWithDotsInNameOrVersion = allMasterStrategies.filter(s => s.name.includes('.') || s.version.includes('.'));
+        if (!strategiesWithDotsInNameOrVersion.length) {
+            return;
+        }
+        const message = [
+            INIT_ERROR_MESSAGE,
+            'There are master strategies that use dots in either the version or the name:'
+        ];
+        for (const strategy of strategiesWithDotsInNameOrVersion) {
+            message.push(`  - ${strategy.name} (${strategy.version})`);
+        }
+        throw new Error(message.join('\n'));
+    }
+    async reEncryptKeys(keys) {
+        await promise_utilities_1.PromiseUtilities.allChunked(keys, key => this.reEncryptKey(key));
+    }
+    async reEncryptKey(key) {
+        if (!this.needsMasterReEncryption(key.value)) {
+            return;
+        }
+        const decrypted = await this.masterDecrypt(key.value);
+        const newEncrypted = await this.masterEncrypt(decrypted);
+        await this.updateKeyEntityById(key.id, { value: newEncrypted }, undefined);
+    }
+};
+exports.EncryptionService = EncryptionService;
+__decorate([
+    (0, cached_decorator_1.Cached)(EncryptionKeyCache, (id, ..._) => id),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], EncryptionService.prototype, "findKeyEntityById", null);
+__decorate([
+    (0, cache_write_decorator_1.CacheWrite)(EncryptionKeyCache, (key, ..._) => key.id),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, encryption_strategy_entity_model_1.EncryptionStrategyEntity, Object, Object]),
+    __metadata("design:returntype", Promise)
+], EncryptionService.prototype, "createKeyEntity", null);
+__decorate([
+    (0, cache_write_decorator_1.CacheWrite)(EncryptionKeyCache, (key, ..._) => key.id),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object, Object]),
+    __metadata("design:returntype", Promise)
+], EncryptionService.prototype, "updateKeyEntityById", null);
+__decorate([
+    (0, cache_delete_decorator_1.CacheDelete)(EncryptionKeyCache, (keyId, _) => keyId),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], EncryptionService.prototype, "deleteKeyEntityById", null);
+exports.EncryptionService = EncryptionService = __decorate([
+    (0, injectable_decorator_1.Injectable)({ register: 'onUse' }),
+    __param(0, (0, inject_repository_decorator_1.InjectRepository)(encryption_strategy_entity_model_1.EncryptionStrategyEntity)),
+    __param(1, (0, inject_repository_decorator_1.InjectRepository)(encryption_key_model_1.EncryptionKey)),
+    __param(2, (0, inject_decorator_1.Inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.ENCRYPTION_STRATEGIES)),
+    __param(3, (0, inject_decorator_1.Inject)(zibri_di_tokens_default_1.ZIBRI_DI_TOKENS.ENCRYPTION_MASTER_OPTIONS)),
+    __metadata("design:paramtypes", [repository_1.Repository,
+        repository_1.Repository, Array, Object])
+], EncryptionService);
+//# sourceMappingURL=encryption.service.js.map