Implement secure key via KDF for transparent data encryption/decryption #60

support/src/utils/encryption.cpp

@@ -126,6 +126,27 @@ auto decrypt_file_path(std::string_view encryption_token, const kdf_config &cfg,
   return true;
 }
 
+auto decrypt_file_path(const utils::hash::hash_256_t &master_key,
+                       std::string &file_path) -> bool {
+  std::vector<std::string> decrypted_parts;
+  for (const auto &part : std::filesystem::path(file_path)) {
+    auto file_name = part.string();
+    if (file_name == "/") {
+      continue;
+    }
+
+    if (not decrypt_file_name(master_key, file_name)) {
+      return false;
+    }
+
+    decrypted_parts.push_back(file_name);
+  }
+
+  file_path =
+      utils::path::create_api_path(utils::string::join(decrypted_parts, '/'));
+  return true;
+}
+
 auto decrypt_file_name(std::string_view encryption_token,
                        std::string &file_name) -> bool {
   data_buffer buffer;
@@ -149,6 +170,26 @@ auto decrypt_file_name(std::string_view encryption_token, const kdf_config &cfg,
                                          file_name);
 }
 
+auto decrypt_file_name(const utils::hash::hash_256_t &master_key,
+                       std::string &file_name) -> bool {
+  data_buffer buffer;
+  if (not utils::collection::from_hex_string(file_name, buffer)) {
+    return false;
+  }
+
+  utils::encryption::kdf_config path_cfg;
+  if (not utils::encryption::kdf_config::from_header(buffer, path_cfg)) {
+    return false;
+  }
+
+  auto path_key = path_cfg.recreate_subkey(utils::encryption::kdf_context::path,
+                                           master_key);
+
+  file_name.clear();
+  return utils::encryption::decrypt_data(
+      path_key, &buffer[utils::encryption::kdf_config::size()], file_name);
+}
+
 template <typename data_t>
 [[nodiscard]] auto
 read_encrypted_range(http_range range, const utils::hash::hash_256_t &key,