feat(storage): allow setting file encryption key to null to disable CSEK and fix copy behavior for non-encrypted destinations

Author: thiyaguk09

handwritten/storage/src/file.ts

@@ -317,7 +317,7 @@ export type RenameCallback = MoveCallback;
 export type RotateEncryptionKeyOptions = string | Buffer | EncryptionKeyOptions;
 
 export interface EncryptionKeyOptions {
-  encryptionKey?: string | Buffer;
+  encryptionKey?: string | Buffer | null;
   kmsKeyName?: string;
   preconditionOpts?: PreconditionOptions;
 }
@@ -366,7 +366,7 @@ const COMPRESSIBLE_MIME_REGEX = new RegExp(
 
 export interface FileOptions {
   crc32cGenerator?: CRC32CValidatorGenerator;
-  encryptionKey?: string | Buffer;
+  encryptionKey?: string | Buffer | null;
   generation?: number | string;
   restoreToken?: string;
   kmsKeyName?: string;
@@ -425,7 +425,7 @@ export type DownloadCallback = (
 
 export interface DownloadOptions extends CreateReadStreamOptions {
   destination?: string;
-  encryptionKey?: string | Buffer;
+  encryptionKey?: string | Buffer | null;
 }
 
 interface CopyQuery {
@@ -600,7 +600,7 @@ class File extends ServiceObject<File, FileMetadata> {
   restoreToken?: string;
   parent!: Bucket;
 
-  private encryptionKey?: string | Buffer;
+  private encryptionKey?: string | Buffer | null;
   private encryptionKeyBase64?: string;
   private encryptionKeyHash?: string;
   private encryptionKeyInterceptor?: Interceptor;
@@ -1102,7 +1102,7 @@ class File extends ServiceObject<File, FileMetadata> {
 
     this.name = name;
 
-    if (options.encryptionKey) {
+    if (options.encryptionKey !== undefined) {
       this.setEncryptionKey(options.encryptionKey);
     }
 
@@ -1379,14 +1379,26 @@ class File extends ServiceObject<File, FileMetadata> {
 
     const headers: {[index: string]: string | undefined} = {};
 
-    if (this.encryptionKey !== undefined) {
+    if (this.encryptionKey !== undefined && this.encryptionKey !== null) {
       headers['x-goog-copy-source-encryption-algorithm'] = 'AES256';
       headers['x-goog-copy-source-encryption-key'] = this.encryptionKeyBase64;
       headers['x-goog-copy-source-encryption-key-sha256'] =
         this.encryptionKeyHash;
     }
 
-    if (newFile.encryptionKey !== undefined) {
+    let copiedKey = false;
+    if (
+      this.encryptionKey !== undefined &&
+      this.encryptionKey !== null &&
+      newFile.encryptionKey === undefined
+    ) {
+      newFile.encryptionKey = this.encryptionKey;
+      newFile.encryptionKeyBase64 = this.encryptionKeyBase64;
+      newFile.encryptionKeyHash = this.encryptionKeyHash;
+      copiedKey = true;
+    }
+
+    if (newFile.encryptionKey !== undefined && !copiedKey) {
       this.setEncryptionKey(newFile.encryptionKey!);
     } else if (options.destinationKmsKeyName !== undefined) {
       query.destinationKmsKeyName = options.destinationKmsKeyName;
@@ -1864,7 +1876,7 @@ class File extends ServiceObject<File, FileMetadata> {
         ),
         file: this.name,
         generation: this.generation,
-        key: this.encryptionKey,
+        key: this.encryptionKey === null ? undefined : this.encryptionKey,
         kmsKeyName: this.kmsKeyName,
         metadata: options.metadata,
         offset: options.offset,
@@ -2392,7 +2404,7 @@ class File extends ServiceObject<File, FileMetadata> {
     const destination = options.destination;
     delete options.destination;
 
-    if (options.encryptionKey) {
+    if (options.encryptionKey !== undefined) {
       this.setEncryptionKey(options.encryptionKey);
       delete options.encryptionKey;
     }
@@ -2482,8 +2494,23 @@ class File extends ServiceObject<File, FileMetadata> {
    * region_tag:storage_download_encrypted_file
    * Example of downloading an encrypted file:
    */
-  setEncryptionKey(encryptionKey: string | Buffer) {
+  setEncryptionKey(encryptionKey: string | Buffer | null) {
+    if (this.encryptionKeyInterceptor) {
+      const index = this.interceptors.indexOf(this.encryptionKeyInterceptor);
+      if (index > -1) {
+        this.interceptors.splice(index, 1);
+      }
+      this.encryptionKeyInterceptor = undefined;
+    }
+
     this.encryptionKey = encryptionKey;
+
+    if (encryptionKey === null || encryptionKey === undefined) {
+      this.encryptionKeyBase64 = undefined;
+      this.encryptionKeyHash = undefined;
+      return this;
+    }
+
     this.encryptionKeyBase64 = Buffer.from(encryptionKey as string).toString(
       'base64',
     );
@@ -2504,7 +2531,7 @@ class File extends ServiceObject<File, FileMetadata> {
       },
     };
 
-    this.interceptors.push(this.encryptionKeyInterceptor!);
+    this.interceptors.push(this.encryptionKeyInterceptor);
 
     return this;
   }
@@ -4462,7 +4489,7 @@ class File extends ServiceObject<File, FileMetadata> {
       file: this.name,
       generation: this.generation,
       isPartialUpload: options.isPartialUpload,
-      key: this.encryptionKey,
+      key: this.encryptionKey === null ? undefined : this.encryptionKey,
       kmsKeyName: this.kmsKeyName,
       metadata: options.metadata,
       offset: options.offset,

handwritten/storage/system-test/storage.ts

@@ -2793,6 +2793,24 @@ describe('storage', function () {
         const [contents] = await file.download();
         assert.strictEqual(contents.toString(), 'secret data');
       });
+
+      it('should copy a CSEK-encrypted file to a standard non-CSEK destination when destination key is null', async () => {
+        const srcFile = bucket.file('encrypted-source');
+        srcFile.setEncryptionKey('a'.repeat(32));
+
+        await srcFile.save('csek data', { resumable: false });
+
+        const dstFile = bucket.file('non-csek-destination');
+        dstFile.setEncryptionKey(null);
+
+        await srcFile.copy(dstFile);
+
+        const [metadata] = await dstFile.getMetadata();
+        assert.strictEqual(metadata.customerEncryption, undefined);
+
+        const [contents] = await dstFile.download();
+        assert.strictEqual(contents.toString(), 'csek data');
+      });
     });
 
     describe.skip('kms keys', () => {

handwritten/storage/test/file.ts

@@ -626,6 +626,75 @@ describe('File', () => {
       file.copy(newFile, assert.ifError);
     });
 
+    it('should not copy encryption key or send destination headers when destination file has null encryption key', done => {
+      file.encryptionKey = 'sourceKey';
+      file.encryptionKeyBase64 = 'sourceKeyBase64';
+      file.encryptionKeyHash = 'sourceKeyHash';
+
+      const newFile = new File(BUCKET, 'new-file');
+      newFile.setEncryptionKey(null);
+
+      file.request = (reqOpts: DecorateRequestOptions) => {
+        assert.strictEqual(newFile.encryptionKey, null);
+        assert.strictEqual(newFile.encryptionKeyBase64, undefined);
+        assert.strictEqual(newFile.encryptionKeyHash, undefined);
+
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-copy-source-encryption-algorithm'],
+          'AES256'
+        );
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-copy-source-encryption-key'],
+          'sourceKeyBase64'
+        );
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-copy-source-encryption-key-sha256'],
+          'sourceKeyHash'
+        );
+
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-encryption-algorithm'],
+          undefined
+        );
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-encryption-key'],
+          undefined
+        );
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-encryption-key-sha256'],
+          undefined
+        );
+
+        assert.strictEqual(file.encryptionKeyInterceptor, undefined);
+
+        done();
+      };
+
+      file.copy(newFile, assert.ifError);
+    });
+
+    it('should copy the source key to the destination file object if destination key is undefined', done => {
+      file.encryptionKey = 'sourceKey';
+      file.encryptionKeyBase64 = 'sourceKeyBase64';
+      file.encryptionKeyHash = 'sourceKeyHash';
+
+      const newFile = new File(BUCKET, 'new-file');
+
+      file.request = (reqOpts: DecorateRequestOptions) => {
+        assert.strictEqual(newFile.encryptionKey, file.encryptionKey);
+        assert.strictEqual(newFile.encryptionKeyBase64, file.encryptionKeyBase64);
+        assert.strictEqual(newFile.encryptionKeyHash, file.encryptionKeyHash);
+
+        assert.strictEqual(
+          reqOpts.headers!['x-goog-copy-source-encryption-key'],
+          file.encryptionKeyBase64
+        );
+        done();
+      };
+
+      file.copy(newFile, assert.ifError);
+    });
+
     it('should set destination KMS key name', done => {
       const newFile = new File(BUCKET, 'new-file');
       newFile.kmsKeyName = 'kms-key-name';
@@ -5440,6 +5509,30 @@ describe('File', () => {
 
       done();
     });
+
+    describe('null key', () => {
+      beforeEach(() => {
+        file.setEncryptionKey(KEY);
+        file.setEncryptionKey(null);
+      });
+
+      it('should localize the key to null', () => {
+        assert.strictEqual(file.encryptionKey, null);
+      });
+
+      it('should clear the base64 key', () => {
+        assert.strictEqual(file.encryptionKeyBase64, undefined);
+      });
+
+      it('should clear the hash', () => {
+        assert.strictEqual(file.encryptionKeyHash, undefined);
+      });
+
+      it('should remove the request interceptor', () => {
+        assert.strictEqual(file.encryptionKeyInterceptor, undefined);
+        assert.strictEqual(file.interceptors.length, 0);
+      });
+    });
   });
 
   describe('startResumableUpload_', () => {