( rawDek: string | null, credentials: Credentials, )
| 84 | // --- Session encryption key resolution --- |
| 85 | |
| 86 | function resolveSessionKey( |
| 87 | rawDek: string | null, |
| 88 | credentials: Credentials, |
| 89 | ): { key: Uint8Array; variant: 'legacy' | 'dataKey' } { |
| 90 | if (rawDek && credentials.encryption.type === 'dataKey') { |
| 91 | const dekBundle = decodeBase64(rawDek); |
| 92 | // First byte is version (0x00) |
| 93 | const encryptedDek = dekBundle.slice(1); |
| 94 | const key = decryptBox(encryptedDek, credentials.encryption.privateKey); |
| 95 | if (key) { |
| 96 | return { key, variant: 'dataKey' }; |
| 97 | } |
| 98 | } |
| 99 | if (credentials.encryption.type === 'legacy') { |
| 100 | return { key: credentials.encryption.secret, variant: 'legacy' }; |
| 101 | } |
| 102 | // Fallback: try treating secret as legacy key |
| 103 | return { key: credentials.secret, variant: 'legacy' }; |
| 104 | } |
| 105 | |
| 106 | // --- API methods --- |
| 107 |
no test coverage detected