update based on new approach

Author: mfori

src/apify/_consts.py

@@ -6,5 +6,6 @@
 EVENT_LISTENERS_TIMEOUT = timedelta(seconds=5)
 
 BASE64_REGEXP = '[-A-Za-z0-9+/]*={0,3}'
-ENCRYPTED_INPUT_VALUE_PREFIX = 'ENCRYPTED_VALUE'
-ENCRYPTED_INPUT_VALUE_REGEXP = re.compile(f'^{ENCRYPTED_INPUT_VALUE_PREFIX}:({BASE64_REGEXP}):({BASE64_REGEXP})$')
+ENCRYPTED_STRING_VALUE_PREFIX = 'ENCRYPTED_VALUE'
+ENCRYPTED_JSON_VALUE_PREFIX = 'ENCRYPTED_JSON'
+ENCRYPTED_INPUT_VALUE_REGEXP = re.compile(f'^({ENCRYPTED_STRING_VALUE_PREFIX}|{ENCRYPTED_JSON_VALUE_PREFIX}):(?:({BASE64_REGEXP}):)?({BASE64_REGEXP}):({BASE64_REGEXP})$')

src/apify/_crypto.py

@@ -15,7 +15,7 @@
 from apify_shared.utils import ignore_docs
 from crawlee._utils.crypto import crypto_random_object_id
 
-from apify._consts import ENCRYPTED_INPUT_VALUE_REGEXP
+from apify._consts import ENCRYPTED_INPUT_VALUE_REGEXP, ENCRYPTED_STRING_VALUE_PREFIX, ENCRYPTED_JSON_VALUE_PREFIX
 
 ENCRYPTION_KEY_LENGTH = 32
 ENCRYPTION_IV_LENGTH = 16
@@ -148,30 +148,19 @@ def decrypt_input_secrets(private_key: rsa.RSAPrivateKey, input_data: Any) -> An
         if isinstance(value, str):
             match = ENCRYPTED_INPUT_VALUE_REGEXP.fullmatch(value)
             if match:
-                encrypted_password = match.group(1)
-                encrypted_value = match.group(2)
-                input_data[key] = private_decrypt(
+                prefix = match.group(1)
+                encrypted_password = match.group(3)
+                encrypted_value = match.group(4)
+                decrypted_value = private_decrypt(
                     encrypted_password,
                     encrypted_value,
                     private_key=private_key,
                 )
-        # TODO reuse the decryption logic for string and objects
-        elif isinstance(value, dict) and isinstance(value.get("secret"), str):
-            match = ENCRYPTED_INPUT_VALUE_REGEXP.fullmatch(value["secret"])
-            if match:
-                encrypted_password = match.group(1)
-                encrypted_value = match.group(2)
-                try:
-                    decrypted_json_str = private_decrypt(
-                        encrypted_password,
-                        encrypted_value,
-                        private_key=private_key,
-                    )
-                    input_data[key] = json.loads(decrypted_json_str)
-                except Exception as err:
-                    raise ValueError(
-                        f'The input field "{key}" could not be parsed as JSON after decryption: {err}'
-                    )
+
+                if prefix == ENCRYPTED_STRING_VALUE_PREFIX:
+                    input_data[key] = decrypted_value
+                elif prefix == ENCRYPTED_JSON_VALUE_PREFIX:
+                    input_data[key] = json.loads(decrypted_value)
 
     return input_data