fix: resolve size_bytes type parsing and test AAD decryption issues

Author: Killerjunior

src/services/crypto/open-envelope.ts

@@ -120,6 +120,19 @@ function str(value: unknown, field: string): string {
   return value;
 }
 
+function num(value: unknown, field: string): number {
+  if (typeof value === "number" && !Number.isNaN(value) && value >= 0) {
+    return value;
+  }
+  if (typeof value === "string") {
+    const parsed = Number(value);
+    if (!Number.isNaN(parsed) && parsed >= 0) {
+      return parsed;
+    }
+  }
+  throw new OpenEnvelopeError(`missing or invalid ${field}`, "crypto_validation_error");
+}
+
 /**
  * Open (decrypt) a sealed envelope.
  *
@@ -221,9 +234,7 @@ export async function openEnvelope(
             (a as { content_type?: unknown }).content_type,
             "attachment.content_type",
           ),
-          size_bytes: Number(
-            str((a as { size_bytes?: unknown }).size_bytes, "attachment.size_bytes"),
-          ),
+          size_bytes: num((a as { size_bytes?: unknown }).size_bytes, "attachment.size_bytes"),
           content_hash: str(
             (a as { content_hash?: unknown }).content_hash,
             "attachment.content_hash",

tests/unit/crypto/open-envelope.test.ts

@@ -6,6 +6,7 @@ import {
   type KeyProvider,
 } from "../../../src/services/crypto/open-envelope";
 import { createCommitment } from "../../../src/services/crypto/commitment";
+import { canonicalizeAttachmentDescriptors } from "../../../src/services/crypto/attachment-metadata";
 
 function toBase64(bytes: Uint8Array): string {
   let binary = "";
@@ -23,7 +24,14 @@ function toHex(bytes: Uint8Array): string {
 async function buildEnvelope(body: string, key: CryptoKey, recipient: string) {
   const iv = crypto.getRandomValues(new Uint8Array(12));
   const plaintext = new TextEncoder().encode(body);
-  const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, key, plaintext));
+  const aad = canonicalizeAttachmentDescriptors([]);
+  const ct = new Uint8Array(
+    await crypto.subtle.encrypt(
+      { name: "AES-GCM", iv, additionalData: aad as BufferSource },
+      key,
+      plaintext,
+    ),
+  );
   const tag = ct.slice(ct.length - 16);
   const ciphertextWithTag = ct; // GCM output already includes the tag
   const commitment = await createCommitment(ciphertextWithTag);