From 8ebd492db60cb5aab38b45f58150601465a94630 Mon Sep 17 00:00:00 2001
From: Mikko Koli <mikko.koli@cgi.com>
Date: Wed, 21 Mar 2018 15:43:19 +0200
Subject: [PATCH] Allow empty plaintext for transit decryption.

Fixes gh-223.
Original pull request: gh-225.
---
 .../vault/core/VaultTransitTemplate.java      |  9 ++++-
 .../VaultTransitTemplateIntegrationTests.java | 37 +++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java
index 7b1f1183..9c2d18d9 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java
@@ -532,10 +532,12 @@ public class VaultTransitTemplate implements VaultTransitOperations {
 					encrypted = new VaultDecryptionResult(new VaultException(
 							data.get("error")));
 				}
-				else {
+				else if (StringUtils.hasText(data.get("plaintext"))) {
 					encrypted = new VaultDecryptionResult(toPlaintext(
 							Base64Utils.decodeFromString(data.get("plaintext")),
 							ciphertext.getContext()));
+				} else {
+					encrypted = new VaultDecryptionResult(toPlaintext("",ciphertext.getContext()));
 				}
 			}
 			else {
@@ -559,6 +561,11 @@ public class VaultTransitTemplate implements VaultTransitOperations {
 				.of(plaintext);
 	}
 
+	private static Plaintext toPlaintext(String plaintext, VaultTransitContext context) {
+		return context != null ? Plaintext.of(plaintext).with(context) : Plaintext
+				.of(plaintext);
+	}
+
 	@SuppressWarnings("unchecked")
 	private static List<Map<String, String>> getBatchData(VaultResponse vaultResponse) {
 		return (List<Map<String, String>>) vaultResponse.getRequiredData().get(
diff --git a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java
index 6315299a..680d31f9 100644
--- a/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java
+++ b/spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java
@@ -547,6 +547,43 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport
 	}
 
 	@Test
+    public void shouldBatchDecryptEmptyPlaintext() {
+        assumeTrue(vaultVersion.isGreaterThanOrEqualTo(BATCH_INTRODUCED_IN_VERSION));
+
+        transitOperations.createKey("mykey");
+
+        Ciphertext empty = transitOperations.encrypt("mykey", Plaintext.of(""));
+
+        List<VaultDecryptionResult> decrypted = transitOperations.decrypt("mykey",
+                Arrays.asList(empty));
+
+        assertThat(decrypted.get(0).getAsString()).isEqualTo("");
+    }
+
+    @Test
+    public void shouldBatchDecryptEmpltyPlaintextWithContext() {
+
+        assumeTrue(vaultVersion.isGreaterThanOrEqualTo(BATCH_INTRODUCED_IN_VERSION));
+
+        VaultTransitKeyCreationRequest request = VaultTransitKeyCreationRequest.builder() //
+                .derived(true) //
+                .build();
+
+        transitOperations.createKey("mykey", request);
+
+        Plaintext empty = Plaintext.of("").with(
+                VaultTransitContext.builder().context("oneContext".getBytes()).build());
+
+        List<VaultEncryptionResult> encrypted = transitOperations.encrypt("mykey",
+                Arrays.asList(empty));
+        List<VaultDecryptionResult> decrypted = transitOperations.decrypt("mykey",
+                Arrays.asList(encrypted.get(0).get()));
+
+        assertThat(decrypted.get(0).get()).isEqualTo(empty);
+    }
+
+
+    @Test
 	public void generateHmacShouldCreateHmac() {
 
 		assumeTrue(vaultVersion.isGreaterThanOrEqualTo(SIGN_VERIFY_INTRODUCED_IN_VERSION));