fix: handle destination encryption headers and prevent key interceptor conflicts during file copy operations

Author: thiyaguk09

handwritten/storage/src/file.ts

@@ -1386,20 +1386,18 @@ class File extends ServiceObject<File, FileMetadata> {
         this.encryptionKeyHash;
     }
 
-    let copiedKey = false;
     if (
       this.encryptionKey !== undefined &&
       this.encryptionKey !== null &&
       newFile.encryptionKey === undefined
     ) {
-      newFile.encryptionKey = this.encryptionKey;
-      newFile.encryptionKeyBase64 = this.encryptionKeyBase64;
-      newFile.encryptionKeyHash = this.encryptionKeyHash;
-      copiedKey = true;
+      newFile.setEncryptionKey(this.encryptionKey);
     }
 
-    if (newFile.encryptionKey !== undefined && !copiedKey) {
-      this.setEncryptionKey(newFile.encryptionKey!);
+    if (newFile.encryptionKey !== undefined && newFile.encryptionKey !== null) {
+      headers['x-goog-encryption-algorithm'] = 'AES256';
+      headers['x-goog-encryption-key'] = newFile.encryptionKeyBase64;
+      headers['x-goog-encryption-key-sha256'] = newFile.encryptionKeyHash;
     } else if (options.destinationKmsKeyName !== undefined) {
       query.destinationKmsKeyName = options.destinationKmsKeyName;
       delete options.destinationKmsKeyName;
@@ -1431,6 +1429,14 @@ class File extends ServiceObject<File, FileMetadata> {
       delete options.preconditionOpts;
     }
 
+    const originalGetRequestInterceptors = this.getRequestInterceptors;
+    this.getRequestInterceptors = () => {
+      return originalGetRequestInterceptors.call(this).filter(
+        interceptorFn =>
+          interceptorFn !== this.encryptionKeyInterceptor?.request
+      );
+    };
+
     this.request(
       {
         method: 'POST',
@@ -1468,6 +1474,8 @@ class File extends ServiceObject<File, FileMetadata> {
         callback!(null, newFile, resp);
       },
     );
+
+    this.getRequestInterceptors = originalGetRequestInterceptors;
   }
 
   /**

handwritten/storage/test/file.ts

@@ -596,9 +596,7 @@ describe('File', () => {
     });
 
     it('should set correct headers when file is encrypted', done => {
-      file.encryptionKey = {};
-      file.encryptionKeyBase64 = 'base64';
-      file.encryptionKeyHash = 'hash';
+      file.setEncryptionKey('sourceKey');
 
       const newFile = new File(BUCKET, 'new-file');
 
@@ -607,29 +605,43 @@ describe('File', () => {
           'x-goog-copy-source-encryption-algorithm': 'AES256',
           'x-goog-copy-source-encryption-key': file.encryptionKeyBase64,
           'x-goog-copy-source-encryption-key-sha256': file.encryptionKeyHash,
+          'x-goog-encryption-algorithm': 'AES256',
+          'x-goog-encryption-key': file.encryptionKeyBase64,
+          'x-goog-encryption-key-sha256': file.encryptionKeyHash,
         });
         done();
       };
 
       file.copy(newFile, assert.ifError);
     });
 
-    it('should set encryption key on the new File instance', done => {
+    it('should send destination encryption headers when destination file has an encryption key', done => {
       const newFile = new File(BUCKET, 'new-file');
-      newFile.encryptionKey = 'encryptionKey';
+      newFile.setEncryptionKey('destinationKey');
 
-      file.setEncryptionKey = (encryptionKey: {}) => {
-        assert.strictEqual(encryptionKey, newFile.encryptionKey);
+      file.request = (reqOpts: DecorateRequestOptions) => {
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-encryption-algorithm'],
+          'AES256'
+        );
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-encryption-key'],
+          newFile.encryptionKeyBase64
+        );
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-encryption-key-sha256'],
+          newFile.encryptionKeyHash
+        );
         done();
       };
 
       file.copy(newFile, assert.ifError);
     });
 
     it('should not copy encryption key or send destination headers when destination file has null encryption key', done => {
-      file.encryptionKey = 'sourceKey';
-      file.encryptionKeyBase64 = 'sourceKeyBase64';
-      file.encryptionKeyHash = 'sourceKeyHash';
+      file.setEncryptionKey('sourceKey');
+      const expectedSourceKeyBase64 = file.encryptionKeyBase64;
+      const expectedSourceKeyHash = file.encryptionKeyHash;
 
       const newFile = new File(BUCKET, 'new-file');
       newFile.setEncryptionKey(null);
@@ -645,11 +657,11 @@ describe('File', () => {
         );
         assert.strictEqual(
           reqOpts.headers!['x-goog-copy-source-encryption-key'],
-          'sourceKeyBase64'
+          expectedSourceKeyBase64
         );
         assert.strictEqual(
           reqOpts.headers!['x-goog-copy-source-encryption-key-sha256'],
-          'sourceKeyHash'
+          expectedSourceKeyHash
         );
 
         assert.strictEqual(
@@ -665,7 +677,7 @@ describe('File', () => {
           undefined
         );
 
-        assert.strictEqual(file.encryptionKeyInterceptor, undefined);
+        assert.notStrictEqual(file.encryptionKeyInterceptor, undefined);
 
         done();
       };
@@ -674,9 +686,7 @@ describe('File', () => {
     });
 
     it('should copy the source key to the destination file object if destination key is undefined', done => {
-      file.encryptionKey = 'sourceKey';
-      file.encryptionKeyBase64 = 'sourceKeyBase64';
-      file.encryptionKeyHash = 'sourceKeyHash';
+      file.setEncryptionKey('sourceKey');
 
       const newFile = new File(BUCKET, 'new-file');
 
@@ -689,6 +699,18 @@ describe('File', () => {
           reqOpts.headers!['x-goog-copy-source-encryption-key'],
           file.encryptionKeyBase64
         );
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-encryption-algorithm'],
+          'AES256'
+        );
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-encryption-key'],
+          file.encryptionKeyBase64
+        );
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-encryption-key-sha256'],
+          file.encryptionKeyHash
+        );
         done();
       };