decryptPayload static method

String? decryptPayload(String base64Payload, String licenseKey)

Decrypts a base64-encoded AES-256-GCM payload from the observability endpoint. Blob layout: 12 bytes IV + N bytes ciphertext + 16 bytes GCM tag Returns decrypted JSON string, or null on any failure.

Implementation

static String? decryptPayload(String base64Payload, String licenseKey) {
  try {
    final blob = base64Decode(base64Payload);
    if (blob.length < 28) return null;

    final iv         = Uint8List.fromList(blob.sublist(0, 12));
    final ciphertext = blob.sublist(12, blob.length - 16);
    final tag        = blob.sublist(blob.length - 16);

    final key = _deriveKey(licenseKey);

    final ctWithTag = Uint8List(ciphertext.length + tag.length)
      ..setRange(0, ciphertext.length, ciphertext)
      ..setRange(ciphertext.length, ciphertext.length + tag.length, tag);

    final params = AEADParameters(
      KeyParameter(key),
      128,
      iv,
      Uint8List(0),
    );

    final gcm = GCMBlockCipher(AESEngine())..init(false, params);

    final output = Uint8List(ciphertext.length);
    var offset = 0;
    offset += gcm.processBytes(ctWithTag, 0, ctWithTag.length, output, offset);
    gcm.doFinal(output, offset);

    return utf8.decode(output);
  } catch (_) {
    return null;
  }
}