feat(storage): support copying CSEK-encrypted files to non-CSEK destinations

handwritten/storage/src/file.ts

@@ -390,7 +390,7 @@ export type RenameCallback = MoveCallback;
 export type RotateEncryptionKeyOptions = string | Buffer | EncryptionKeyOptions;
 
 export interface EncryptionKeyOptions {
-  encryptionKey?: string | Buffer;
+  encryptionKey?: string | Buffer | null;
   kmsKeyName?: string;
   preconditionOpts?: PreconditionOptions;
 }
@@ -439,7 +439,7 @@ const COMPRESSIBLE_MIME_REGEX = new RegExp(
 
 export interface FileOptions {
   crc32cGenerator?: CRC32CValidatorGenerator;
-  encryptionKey?: string | Buffer;
+  encryptionKey?: string | Buffer | null;
   generation?: number | string;
   restoreToken?: string;
   kmsKeyName?: string;
@@ -498,7 +498,7 @@ export type DownloadCallback = (
 
 export interface DownloadOptions extends CreateReadStreamOptions {
   destination?: string;
-  encryptionKey?: string | Buffer;
+  encryptionKey?: string | Buffer | null;
 }
 
 interface CopyQuery {
@@ -673,7 +673,7 @@ class File extends ServiceObject<File, FileMetadata> {
   restoreToken?: string;
   parent!: Bucket;
 
-  private encryptionKey?: string | Buffer;
+  private encryptionKey?: string | Buffer | null;
   private encryptionKeyBase64?: string;
   private encryptionKeyHash?: string;
   private encryptionKeyInterceptor?: Interceptor;
@@ -1175,7 +1175,7 @@ class File extends ServiceObject<File, FileMetadata> {
 
     this.name = name;
 
-    if (options.encryptionKey) {
+    if (options.encryptionKey !== undefined) {
       this.setEncryptionKey(options.encryptionKey);
     }
 
@@ -1452,15 +1452,25 @@ class File extends ServiceObject<File, FileMetadata> {
 
     const headers: {[index: string]: string | undefined} = {};
 
-    if (this.encryptionKey !== undefined) {
+    if (this.encryptionKey !== undefined && this.encryptionKey !== null) {
       headers['x-goog-copy-source-encryption-algorithm'] = 'AES256';
       headers['x-goog-copy-source-encryption-key'] = this.encryptionKeyBase64;
       headers['x-goog-copy-source-encryption-key-sha256'] =
         this.encryptionKeyHash;
     }
 
-    if (newFile.encryptionKey !== undefined) {
-      this.setEncryptionKey(newFile.encryptionKey!);
+    if (
+      this.encryptionKey !== undefined &&
+      this.encryptionKey !== null &&
+      newFile.encryptionKey === undefined
+    ) {
+      newFile.setEncryptionKey(this.encryptionKey);
+    }
+
+    if (newFile.encryptionKey !== undefined && newFile.encryptionKey !== null) {
+      headers['x-goog-encryption-algorithm'] = 'AES256';
+      headers['x-goog-encryption-key'] = newFile.encryptionKeyBase64;
+      headers['x-goog-encryption-key-sha256'] = newFile.encryptionKeyHash;
     } else if (options.destinationKmsKeyName !== undefined) {
       query.destinationKmsKeyName = options.destinationKmsKeyName;
       delete options.destinationKmsKeyName;
@@ -1492,10 +1502,12 @@ class File extends ServiceObject<File, FileMetadata> {
       delete options.preconditionOpts;
     }
 
-    this.request(
+    this.bucket.request(
       {
         method: 'POST',
-        uri: `/rewriteTo/b/${destBucket.name}/o/${encodeURIComponent(
+        uri: `/o/${encodeURIComponent(
+          this.name,
+        )}/rewriteTo/b/${destBucket.name}/o/${encodeURIComponent(
           newFile.name,
         )}`,
         qs: query,
@@ -1937,7 +1949,7 @@ class File extends ServiceObject<File, FileMetadata> {
         ),
         file: this.name,
         generation: this.generation,
-        key: this.encryptionKey,
+        key: this.encryptionKey === null ? undefined : this.encryptionKey,
         kmsKeyName: this.kmsKeyName,
         metadata: options.metadata,
         offset: options.offset,
@@ -2465,7 +2477,7 @@ class File extends ServiceObject<File, FileMetadata> {
     const destination = options.destination;
     delete options.destination;
 
-    if (options.encryptionKey) {
+    if (options.encryptionKey !== undefined) {
       this.setEncryptionKey(options.encryptionKey);
       delete options.encryptionKey;
     }
@@ -2555,8 +2567,23 @@ class File extends ServiceObject<File, FileMetadata> {
    * region_tag:storage_download_encrypted_file
    * Example of downloading an encrypted file:
    */
-  setEncryptionKey(encryptionKey: string | Buffer) {
+  setEncryptionKey(encryptionKey: string | Buffer | null) {
+    if (this.encryptionKeyInterceptor) {
+      const index = this.interceptors.indexOf(this.encryptionKeyInterceptor);
+      if (index > -1) {
+        this.interceptors.splice(index, 1);
+      }
+      this.encryptionKeyInterceptor = undefined;
+    }
+
     this.encryptionKey = encryptionKey;
+
+    if (encryptionKey === null || encryptionKey === undefined) {
+      this.encryptionKeyBase64 = undefined;
+      this.encryptionKeyHash = undefined;
+      return this;
+    }
+
     this.encryptionKeyBase64 = Buffer.from(encryptionKey as string).toString(
       'base64',
     );
@@ -2577,7 +2604,7 @@ class File extends ServiceObject<File, FileMetadata> {
       },
     };
 
-    this.interceptors.push(this.encryptionKeyInterceptor!);
+    this.interceptors.push(this.encryptionKeyInterceptor);
 
     return this;
   }
@@ -4195,7 +4222,23 @@ class File extends ServiceObject<File, FileMetadata> {
       options.preconditionOpts?.ifGenerationMatch !== undefined
         ? {preconditionOpts: options.preconditionOpts}
         : {};
-    this.copy(newFile, copyOptions, callback!);
+    this.copy(newFile, copyOptions, (err, file, resp) => {
+      if (!err) {
+        if (options.encryptionKey !== undefined) {
+          this.setEncryptionKey(options.encryptionKey);
+        } else {
+          this.setEncryptionKey(null);
+        }
+        if (options.kmsKeyName !== undefined) {
+          this.kmsKeyName = options.kmsKeyName;
+        } else {
+          this.kmsKeyName = undefined;
+        }
+      }
+      if (callback) {
+        callback(err, file, resp);
+      }
+    });
   }
 
   save(data: SaveData, options?: SaveOptions): Promise<void>;
@@ -4536,7 +4579,7 @@ class File extends ServiceObject<File, FileMetadata> {
       file: this.name,
       generation: this.generation,
       isPartialUpload: options.isPartialUpload,
-      key: this.encryptionKey,
+      key: this.encryptionKey === null ? undefined : this.encryptionKey,
       kmsKeyName: this.kmsKeyName,
       metadata: options.metadata,
       offset: options.offset,

handwritten/storage/system-test/storage.ts

@@ -2793,6 +2793,24 @@ describe('storage', function () {
         const [contents] = await file.download();
         assert.strictEqual(contents.toString(), 'secret data');
       });
+
+      it('should copy a CSEK-encrypted file to a standard non-CSEK destination when destination key is null', async () => {
+        const srcFile = bucket.file('encrypted-source');
+        srcFile.setEncryptionKey('a'.repeat(32));
+
+        await srcFile.save('csek data', { resumable: false });
+
+        const dstFile = bucket.file('non-csek-destination');
+        dstFile.setEncryptionKey(null);
+
+        await srcFile.copy(dstFile);
+
+        const [metadata] = await dstFile.getMetadata();
+        assert.strictEqual(metadata.customerEncryption, undefined);
+
+        const [contents] = await dstFile.download();
+        assert.strictEqual(contents.toString(), 'csek data');
+      });
     });
 
     describe.skip('kms keys', () => {