check operator version and provide correct presigned url

src/main/java/com/uid2/core/service/ClientMetadataProvider.java

@@ -22,8 +22,8 @@ public class ClientMetadataProvider implements IClientMetadataProvider {
     private final ICloudStorage downloadUrlGenerator;
 
     @Override
-    public String getMetadata(OperatorInfo info) throws Exception {
-        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(ClientsMetadataPathName));
+    public String getMetadata(OperatorInfo info,boolean includeEncrypted) throws Exception {
+        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(ClientsMetadataPathName),includeEncrypted);
         String original = readToEndAsString(metadataStreamProvider.download(pathname));
         JsonObject main = (JsonObject) Json.decodeValue(original);
         JsonObject obj = main.getJsonObject("client_keys");

src/main/java/com/uid2/core/service/IClientMetadataProvider.java

@@ -4,5 +4,5 @@
 import com.uid2.shared.auth.OperatorType;
 
 public interface IClientMetadataProvider {
-    String getMetadata(OperatorInfo info) throws Exception;
+    String getMetadata(OperatorInfo info, boolean includeEncrypted) throws Exception;
 }

src/main/java/com/uid2/core/service/IKeyAclMetadataProvider.java

@@ -4,5 +4,5 @@
 import com.uid2.shared.auth.OperatorType;
 
 public interface IKeyAclMetadataProvider {
-    String getMetadata(OperatorInfo info) throws Exception;
+    String getMetadata(OperatorInfo info, boolean includeEncrypted) throws Exception;
 }

src/main/java/com/uid2/core/service/IKeyMetadataProvider.java

@@ -4,5 +4,5 @@
 import com.uid2.shared.auth.OperatorType;
 
 public interface IKeyMetadataProvider {
-    String getMetadata(OperatorInfo info) throws Exception;
+    String getMetadata(OperatorInfo info, boolean includeEncrypted) throws Exception;
 }

src/main/java/com/uid2/core/service/IKeysetKeyMetadataProvider.java

@@ -3,5 +3,5 @@
 import com.uid2.core.util.OperatorInfo;
 
 public interface IKeysetKeyMetadataProvider {
-    String getMetadata(OperatorInfo info) throws Exception;
+    String getMetadata(OperatorInfo info, Boolean includeEncrypted) throws Exception;
 }

src/main/java/com/uid2/core/service/IKeysetMetadataProvider.java

@@ -3,5 +3,5 @@
 import com.uid2.core.util.OperatorInfo;
 
 public interface IKeysetMetadataProvider {
-    String getMetadata(OperatorInfo info) throws Exception;
+    String getMetadata(OperatorInfo info, Boolean includeEncrypted) throws Exception;
 }

src/main/java/com/uid2/core/service/KeyAclMetadataProvider.java

@@ -20,8 +20,8 @@ public KeyAclMetadataProvider(ICloudStorage cloudStorage) {
     }
 
     @Override
-    public String getMetadata(OperatorInfo info) throws Exception {
-        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(Const.Config.KeysAclMetadataPathProp));
+    public String getMetadata(OperatorInfo info, boolean includeEncrypted) throws Exception {
+        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(Const.Config.KeysAclMetadataPathProp), includeEncrypted);
         String original = readToEndAsString(metadataStreamProvider.download(pathname));
         JsonObject main = (JsonObject) Json.decodeValue(original);
         JsonObject obj = main.getJsonObject("keys_acl");

src/main/java/com/uid2/core/service/KeyMetadataProvider.java

@@ -22,8 +22,8 @@ public KeyMetadataProvider(ICloudStorage cloudStorage) {
     }
 
     @Override
-    public String getMetadata(OperatorInfo info) throws Exception {
-        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(KeysMetadataPathName));
+    public String getMetadata(OperatorInfo info, boolean includeEncrypted) throws Exception {
+        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(KeysMetadataPathName),includeEncrypted);
         String original = readToEndAsString(metadataStreamProvider.download(pathname));
         JsonObject main = (JsonObject) Json.decodeValue(original);
         JsonObject obj = main.getJsonObject("keys");

src/main/java/com/uid2/core/service/KeysetKeysMetadataProvider.java

@@ -20,8 +20,8 @@ public KeysetKeysMetadataProvider(ICloudStorage cloudStorage) {
     }
 
     @Override
-    public String getMetadata(OperatorInfo info) throws Exception {
-        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(Const.Config.KeysetKeysMetadataPathProp));
+    public String getMetadata(OperatorInfo info, Boolean includeEncrypted) throws Exception {
+        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(Const.Config.KeysetKeysMetadataPathProp), includeEncrypted);
         String original = readToEndAsString(metadataStreamProvider.download(pathname));
         JsonObject main = (JsonObject) Json.decodeValue(original);
         JsonObject obj = main.getJsonObject("keyset_keys");

src/main/java/com/uid2/core/service/KeysetMetadataProvider.java

@@ -19,8 +19,8 @@ public KeysetMetadataProvider(ICloudStorage cloudStorage) {
     }
 
     @Override
-    public String getMetadata(OperatorInfo info) throws Exception {
-        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(Const.Config.KeysetsMetadataPathProp));
+    public String getMetadata(OperatorInfo info, Boolean includeEncrypted) throws Exception {
+        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(Const.Config.KeysetsMetadataPathProp), includeEncrypted);
         String original = readToEndAsString(metadataStreamProvider.download(pathname));
         JsonObject main = (JsonObject) Json.decodeValue(original);
         JsonObject obj = main.getJsonObject("keysets");

src/main/java/com/uid2/core/util/MetadataHelper.java

@@ -4,6 +4,7 @@
 import com.uid2.shared.auth.OperatorType;
 import com.uid2.shared.auth.Role;
 import com.uid2.shared.store.CloudPath;
+import com.uid2.shared.store.scope.EncryptedScope;
 import com.uid2.shared.store.scope.GlobalScope;
 import com.uid2.shared.store.scope.SiteScope;
 import com.uid2.shared.store.scope.StoreScope;
@@ -22,17 +23,28 @@ public static String getSiteSpecificMetadataPathName(int siteId, String metadata
         return SiteSpecificDataSubDirPath +siteId + metadataPathName;
     }
 
-    public static String getMetadataPathName(OperatorType operatorType, int siteId, String metadataPathName)
-    {
+    public static String getMetadataPathName(OperatorType operatorType, int siteId, String metadataPathName) {
+        return getMetadataPathName(operatorType, siteId, metadataPathName, false);
+    }
+
+    public static String getMetadataPathName(OperatorType operatorType, int siteId, String metadataPathName, Boolean canDecrypt) {
         StoreScope store;
         Boolean providePrivateSiteData = ConfigStore.Global.getBoolean("provide_private_site_data");
-        if (operatorType == OperatorType.PUBLIC || (providePrivateSiteData == null || !providePrivateSiteData.booleanValue()))
-        {
-            store = new GlobalScope(new CloudPath(metadataPathName));
-        }
-        else //PRIVATE
-        {
-            store = new SiteScope(new CloudPath(metadataPathName), siteId);
+        if (canDecrypt){
+            if (operatorType == OperatorType.PUBLIC){
+                store = new EncryptedScope(new CloudPath(metadataPathName),siteId, true);
+            }else{
+                store = new EncryptedScope(new CloudPath(metadataPathName),siteId, false);
+            }
+        }else{
+            if (operatorType == OperatorType.PUBLIC || (providePrivateSiteData == null || !providePrivateSiteData.booleanValue()))
+            {
+                store = new GlobalScope(new CloudPath(metadataPathName));
+            }
+            else //PRIVATE
+            {
+                store = new SiteScope(new CloudPath(metadataPathName), siteId);
+            }
         }
         return store.getMetadataPath().toString();
     }

src/main/java/com/uid2/core/vertx/CoreVerticle.java

@@ -52,6 +52,8 @@
 import java.util.*;
 import com.uid2.shared.store.reader.RotatingS3KeyProvider;
 import com.uid2.shared.model.S3Key;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import static com.uid2.shared.Const.Config.EnforceJwtProp;
 
@@ -81,6 +83,7 @@ public class CoreVerticle extends AbstractVerticle {
     private final OperatorJWTTokenProvider operatorJWTTokenProvider;
     private final JwtService jwtService;
     private final RotatingS3KeyProvider s3KeyProvider;
+    private static final String ENCRYPTION_SUPPORT_VERSION = "2.3"; // Set this to the appropriate version later
 
     public CoreVerticle(ICloudStorage cloudStorage,
                         IAuthorizableProvider authProvider,
@@ -379,8 +382,9 @@ private void handleSaltRefresh(RoutingContext rc) {
     private void handleKeyRefresh(RoutingContext rc) {
         try {
             OperatorInfo info = OperatorInfo.getOperatorInfo(rc);
+            boolean includeEncrypted = isEncryptionSupported(rc);
             rc.response().putHeader(HttpHeaders.CONTENT_TYPE, "application/json")
-                    .end(keyMetadataProvider.getMetadata(info));
+                    .end(keyMetadataProvider.getMetadata(info, includeEncrypted));
         } catch (Exception e) {
             logger.warn("exception in handleKeyRefresh: " + e.getMessage(), e);
             Error("error", 500, rc, "error processing key refresh");
@@ -390,8 +394,9 @@ private void handleKeyRefresh(RoutingContext rc) {
     private void handleKeyAclRefresh(RoutingContext rc) {
         try {
             OperatorInfo info = OperatorInfo.getOperatorInfo(rc);
+            boolean includeEncrypted = isEncryptionSupported(rc);
             rc.response().putHeader(HttpHeaders.CONTENT_TYPE, "application/json")
-                    .end(keyAclMetadataProvider.getMetadata(info));
+                    .end(keyAclMetadataProvider.getMetadata(info, includeEncrypted));
         } catch (Exception e) {
             logger.warn("exception in handleKeyAclRefresh: " + e.getMessage(), e);
             Error("error", 500, rc, "error processing key acl refresh");
@@ -401,8 +406,9 @@ private void handleKeyAclRefresh(RoutingContext rc) {
     private void handleKeysetRefresh(RoutingContext rc) {
         try {
             OperatorInfo info = OperatorInfo.getOperatorInfo(rc);
+            boolean includeEncrypted = isEncryptionSupported(rc);
             rc.response().putHeader(HttpHeaders.CONTENT_TYPE, "application/json")
-                    .end(keysetMetadataProvider.getMetadata(info));
+                    .end(keysetMetadataProvider.getMetadata(info, includeEncrypted));
         } catch (Exception e) {
             logger.warn("exception in handleKeysetRefresh: " + e.getMessage(), e);
             Error("error", 500, rc, "error processing key refresh");
@@ -412,8 +418,9 @@ private void handleKeysetRefresh(RoutingContext rc) {
     private void handleKeysetKeyRefresh(RoutingContext rc) {
         try {
             OperatorInfo info = OperatorInfo.getOperatorInfo(rc);
+            boolean includeEncrypted = isEncryptionSupported(rc);
             rc.response().putHeader(HttpHeaders.CONTENT_TYPE, "application/json")
-                    .end(keysetKeyMetadataProvider.getMetadata(info));
+                    .end(keysetKeyMetadataProvider.getMetadata(info, includeEncrypted));
         } catch (Exception e) {
             logger.warn("exception in handleKeysetKeyRefresh: " + e.getMessage(), e);
             Error("error", 500, rc, "error processing key refresh");
@@ -423,8 +430,9 @@ private void handleKeysetKeyRefresh(RoutingContext rc) {
     private void handleClientRefresh(RoutingContext rc) {
         try {
             OperatorInfo info = OperatorInfo.getOperatorInfo(rc);
+            boolean includeEncrypted = isEncryptionSupported(rc);
             rc.response().putHeader(HttpHeaders.CONTENT_TYPE, "application/json")
-                    .end(clientMetadataProvider.getMetadata(info));
+                    .end(clientMetadataProvider.getMetadata(info, includeEncrypted));
         } catch (Exception e) {
             logger.warn("exception in handleClientRefresh: " + e.getMessage(), e);
             Error("error", 500, rc, "error processing client refresh");
@@ -662,4 +670,49 @@ public static void Error(String errorStatus, int statusCode, RoutingContext rc,
         rc.response().setStatusCode(statusCode).putHeader(HttpHeaders.CONTENT_TYPE, "application/json")
                 .end(json.encode());
     }
+
+    private boolean isEncryptionSupported(RoutingContext context) {
+        String appVersion = context.request().getHeader(Const.Http.AppVersionHeader);
+        if (appVersion == null) return false;
+        String[] versions = appVersion.split(";");
+        for (String version : versions) {
+            if (version.startsWith("uid2-operator=")) {
+                String operatorVersion = version.substring("uid2-operator=".length());
+                return isVersionGreaterOrEqual(operatorVersion, ENCRYPTION_SUPPORT_VERSION);
+            }
+        }
+        return false;
+    }
+
+    private boolean isVersionGreaterOrEqual(String v1, String v2) {
+        Pattern pattern = Pattern.compile("(\\d+)(?:\\.(\\d+))?(?:\\.(\\d+))?");
+
+        Matcher m1 = pattern.matcher(v1);
+        Matcher m2 = pattern.matcher(v2);
+
+        int[] parts1 = extractParts(m1);
+        int[] parts2 = extractParts(m2);
+
+        for (int i = 0; i < Math.max(parts1.length, parts2.length); i++) {
+            int p1 = i < parts1.length ? parts1[i] : 0;
+            int p2 = i < parts2.length ? parts2[i] : 0;
+            if (p1 != p2) {
+                return p1 > p2;
+            }
+        }
+
+        return true;
+    }
+
+    private int[] extractParts(Matcher matcher) {
+        // Extract numeric parts from the matcher and return them as an array
+        int[] parts = new int[3];
+        if (matcher.find()) {
+            for (int i = 1; i <= 3; i++) {
+                String group = matcher.group(i);
+                parts[i - 1] = group != null ? Integer.parseInt(group) : 0;
+            }
+        }
+        return parts;
+    }
 }