Function decryptSecret

packages/plugins/encrypted-secrets/src/index.ts:62–77

(key: Buffer, payload: string)

  });

const decryptSecret = (key: Buffer, payload: string): Effect.Effect<string, StorageError> =>
  Effect.try({
    // A malformed payload, a wrong key, or tampered bytes all surface here:
    // GCM verification fails in `decipher.final()`, and bad base64/arity throws
    // before that — both land in the StorageError channel.
    try: () => {
      const parts = payload.split(".");
      const iv = Buffer.from(parts[1] ?? "", "base64");
      const tag = Buffer.from(parts[2] ?? "", "base64");
      const ciphertext = Buffer.from(parts[3] ?? "", "base64");
      const decipher = createDecipheriv("aes-256-gcm", key, iv);
      decipher.setAuthTag(tag);
      return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf8");
    },
    catch: (cause) => new StorageError({ message: "Failed to decrypt secret", cause }),
  });

const ENCRYPTED_PROVIDER_KEY = ProviderKey.make("encrypted");