Function decryptString

apps/api/src/lib/crypto/aes-gcm.utils.ts:89–137

(payload: string)

 * branch.
 */
export const decryptString = (payload: string): string => {
  const parts = payload.split("$");

  if (parts.length !== 4) {
    throw ApiErrors.internal("Encrypted payload is malformed");
  }

  const [version, ivB64, ciphertextB64, tagB64] = parts;

  if (version !== CIPHERTEXT_VERSION) {
    throw ApiErrors.internal(
      `Unsupported ciphertext version: ${version ?? "<empty>"}`
    );
  }

  if (
    ivB64 === undefined ||
    ciphertextB64 === undefined ||
    tagB64 === undefined
  ) {
    throw ApiErrors.internal("Encrypted payload is malformed");
  }

  const iv = Buffer.from(ivB64, "base64");
  const ciphertext = Buffer.from(ciphertextB64, "base64");
  const tag = Buffer.from(tagB64, "base64");

  if (iv.length !== AES_GCM_IV_BYTES || tag.length !== AES_GCM_TAG_BYTES) {
    throw ApiErrors.internal("Encrypted payload has wrong IV or tag length");
  }

  const key = decodeKey(env.MFA_ENCRYPTION_KEY);
  const decipher = createDecipheriv(CIPHER_ALGORITHM, key, iv, {
    authTagLength: AES_GCM_TAG_BYTES,
  });

  decipher.setAuthTag(tag);

  try {
    const plaintext = Buffer.concat([
      decipher.update(ciphertext),
      decipher.final(),
    ]);

    return plaintext.toString("utf8");
  } catch {
    throw ApiErrors.internal("Failed to decrypt payload");
  }
};

/**
 * Constant-time comparison for two same-length strings. Wraps