Function decryptWithSymmetricKey

packages/encryption/src/encryption.ts:210–238

(encryptedValue: string, keyBase64: string)

 * Decrypts a value encrypted with encryptWithSymmetricKey.
 */
export function decryptWithSymmetricKey(encryptedValue: string, keyBase64: string): string {
  if (!keyBase64) {
    throw new EncryptionConfigurationError('Encryption key is required');
  }

  const parts = encryptedValue.split(':');
  if (parts.length !== 3) {
    throw new EncryptionFormatError(
      'Invalid encrypted value format: expected iv:authTag:encrypted'
    );
  }
  const [ivBase64, authTagBase64, encrypted] = parts;

  const iv = Buffer.from(ivBase64, 'base64');
  const authTag = Buffer.from(authTagBase64, 'base64');
  const key = Buffer.from(keyBase64, 'base64');

  if (key.length !== 32) {
    throw new EncryptionConfigurationError('Encryption key must be exactly 32 bytes (256 bits)');
  }

  const decipher = createDecipheriv('aes-256-gcm', key, iv);
  decipher.setAuthTag(authTag);

  let decrypted = decipher.update(encrypted, 'base64', 'utf8');
  decrypted += decipher.final('utf8');

  return decrypted;
}

// ---- Helpers for batch decryption ----