| 16 | } |
| 17 | |
| 18 | async get( |
| 19 | key: string, |
| 20 | options?: { version?: number }, |
| 21 | ): Promise<{ value: string; version: number } | null> { |
| 22 | // Check if key is a UUID (secret ID) or a name |
| 23 | const isUUID = |
| 24 | /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(key); |
| 25 | |
| 26 | let secretId: string; |
| 27 | if (isUUID) { |
| 28 | // Key is already a UUID, use it directly |
| 29 | secretId = key; |
| 30 | } else { |
| 31 | // Key is a name, resolve it to a UUID |
| 32 | const [secretRecord] = await this.db |
| 33 | .select({ id: schema.secrets.id }) |
| 34 | .from(schema.secrets) |
| 35 | .where(eq(schema.secrets.name, key)) |
| 36 | .limit(1); |
| 37 | |
| 38 | if (!secretRecord) { |
| 39 | return null; |
| 40 | } |
| 41 | secretId = secretRecord.id; |
| 42 | } |
| 43 | |
| 44 | const conditions: SQL[] = [eq(schema.secretVersions.secretId, secretId)]; |
| 45 | |
| 46 | if (typeof options?.version === 'number') { |
| 47 | conditions.push(eq(schema.secretVersions.version, options.version)); |
| 48 | } else { |
| 49 | conditions.push(eq(schema.secretVersions.isActive, true)); |
| 50 | } |
| 51 | |
| 52 | const [record] = await this.db |
| 53 | .select({ |
| 54 | encryptedValue: schema.secretVersions.encryptedValue, |
| 55 | iv: schema.secretVersions.iv, |
| 56 | authTag: schema.secretVersions.authTag, |
| 57 | keyId: schema.secretVersions.encryptionKeyId, |
| 58 | versionNumber: schema.secretVersions.version, |
| 59 | }) |
| 60 | .from(schema.secretVersions) |
| 61 | .where(and(...conditions)) |
| 62 | .limit(1); |
| 63 | |
| 64 | if (!record) { |
| 65 | return null; |
| 66 | } |
| 67 | |
| 68 | try { |
| 69 | const value = await this.encryption.decrypt({ |
| 70 | ciphertext: record.encryptedValue, |
| 71 | iv: record.iv, |
| 72 | authTag: record.authTag, |
| 73 | keyId: record.keyId, |
| 74 | }); |
| 75 | |