aws-kms-ee/lib/functions.js

AWS KMS Envelope Encryption

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.decryptObject = exports.encryptObject = undefined;

var _cloneDeepWith = require('lodash/cloneDeepWith');

var _cloneDeepWith2 = _interopRequireDefault(_cloneDeepWith);

var _merge = require('lodash/merge');

var _merge2 = _interopRequireDefault(_merge);

var _compact = require('lodash/compact');

var _compact2 = _interopRequireDefault(_compact);

var _first = require('lodash/first');

var _first2 = _interopRequireDefault(_first);

var _connector = require('./connector');

var _connector2 = _interopRequireDefault(_connector);

var _utils = require('./utils');

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

const encryptObject = exports.encryptObject = (object, {
  masterKeyAlias, fields, dataKeys, regions, AES
}) => new _connector2.default(masterKeyAlias).generateDataKey().then(encryptDataKeyPerRegion({ masterKeyAlias, dataKeys, regions })).then(dataKey => ({
  encrypted: (0, _cloneDeepWith2.default)(object, (value, key) => {
    if (fields.includes(key)) {
      return (0, _utils.encryptValue)(key, value, dataKey, AES);
    } else {
      return undefined;
    }
  }),
  metadata: {
    dataKeys: dataKey.dataKeys,
    masterKeyAlias,
    fields
  }
}));

const decryptObject = exports.decryptObject = (object, metadata) => decryptDataKey(metadata).then(dataKey => ({
  object: (0, _cloneDeepWith2.default)(object, (value, key) => {
    if (metadata.fields.includes(key)) {
      return (0, _utils.decryptValue)(key, value, dataKey, metadata.AES);
    } else {
      return undefined;
    }
  }),
  metadata
}));

const encryptDataKeyPerRegion = metadata => ({ Plaintext, CiphertextBlob }) => Promise.all(otherRegions(metadata).map(region => new _connector2.default(metadata.masterKeyAlias, region).encryptDataKey(Plaintext).then(resp => ({
  [region]: resp.CiphertextBlob.toString('base64')
})).catch(err => {
  (0, _utils.logError)(err, 1, region);
  return {
    [region]: undefined
  };
})).concat({
  [process.env.AWS_REGION]: CiphertextBlob.toString('base64')
})).then(dataKeys => ({
  dataKeys: (0, _merge2.default)({}, ...dataKeys),
  Plaintext
}));

const decryptDataKey = metadata => new _connector2.default(metadata.masterKeyAlias).decryptDataKey(metadata.dataKeys[process.env.AWS_REGION]).catch(e1 => {
  (0, _utils.logError)(e1, 0, process.env.AWS_REGION);
  return Promise.all(otherRegions(metadata).map(region => new _connector2.default(metadata.masterKeyAlias, region).decryptDataKey(metadata.dataKeys[region]).catch(e2 => {
    (0, _utils.logError)(e2, 0, region);
    return undefined;
  }))).then(dataKey => (0, _first2.default)((0, _compact2.default)(dataKey)) || Promise.reject(new Error('could not decrypt data key from any region')));
});

const otherRegions = metadata => (metadata.regions || metadata.dataKeys && Object.keys(metadata.dataKeys) || []).filter(region => region !== process.env.AWS_REGION);