bug: Removes the internal added prefix from custom encryption context before creating the branch key material node object

Author: sharmabikram

modules/branch-keystore-node/src/branch_keystore_helpers.ts

@@ -351,7 +351,9 @@ function constructCustomEncryptionContext(
   //# for the constructed key.
   for (const [key, value] of Object.entries(authenticatedEncryptionContext)) {
     if (key.startsWith(CUSTOM_ENCRYPTION_CONTEXT_FIELD_PREFIX)) {
-      customEncryptionContext[key] = value
+      customEncryptionContext[
+        key.slice(CUSTOM_ENCRYPTION_CONTEXT_FIELD_PREFIX.length)
+      ] = value
     }
   }
 

modules/branch-keystore-node/test/branch_keystore_helpers.test.ts

@@ -37,6 +37,7 @@ import {
   TYPE_FIELD,
   PARTITION_KEY,
   SORT_KEY,
+  CUSTOM_ENCRYPTION_CONTEXT_FIELD_PREFIX,
 } from '../src/constants'
 import { DynamoDBKeyStorage } from '../src/dynamodb_key_storage'
 import { EncryptedHierarchicalKey } from '../src/types'
@@ -53,6 +54,16 @@ const VALID_CUSTOM_ENCRYPTION_CONTEXT = Object.fromEntries(
   )
 )
 
+// Expected output after stripping the `aws-crypto-ec:` prefix
+const EXPECTED_CUSTOM_ENCRYPTION_CONTEXT = Object.fromEntries(
+  Object.entries({ ...VALID_CUSTOM_ENCRYPTION_CONTEXT_KV_PAIRS }).map(
+    ([key, value]) => [
+      key.slice(CUSTOM_ENCRYPTION_CONTEXT_FIELD_PREFIX.length),
+      value.toString(),
+    ]
+  )
+)
+
 const INVALID_CUSTOM_ENCRYPTION_CONTEXT_KV_PAIRS = {
   'awz-crypto-ec:key1': 'value 1',
   key2: 'value 2',
@@ -650,7 +661,7 @@ describe('Test keystore helpers', () => {
         Buffer.from(ENCRYPTED_ACTIVE_BRANCH_KEY.type.version, 'utf-8')
       )
       expect(activeBranchKeyMaterials.encryptionContext).deep.equals(
-        VALID_CUSTOM_ENCRYPTION_CONTEXT
+        EXPECTED_CUSTOM_ENCRYPTION_CONTEXT
       )
 
       const versionedBranchKeyMaterials = constructBranchKeyMaterials(
@@ -671,7 +682,7 @@ describe('Test keystore helpers', () => {
         Buffer.from(ENCRYPTED_VERSION_BRANCH_KEY.type.version, 'utf-8')
       )
       expect(versionedBranchKeyMaterials.encryptionContext).deep.equals(
-        VALID_CUSTOM_ENCRYPTION_CONTEXT
+        EXPECTED_CUSTOM_ENCRYPTION_CONTEXT
       )
     })
   })