feat: add CSEK to download (#2604)

thiyaguk09 · web-flow · commit cacc0be49a4f · 2025-07-30T11:24:29.000-04:00
diff --git a/src/file.ts b/src/file.ts
@@ -403,6 +403,7 @@ export type DownloadCallback = (
 
 export interface DownloadOptions extends CreateReadStreamOptions {
   destination?: string;
+  encryptionKey?: string | Buffer;
 }
 
 interface CopyQuery {
@@ -2309,6 +2310,11 @@ class File extends ServiceObject<File, FileMetadata> {
     const destination = options.destination;
     delete options.destination;
 
+    if (options.encryptionKey) {
+      this.setEncryptionKey(options.encryptionKey);
+      delete options.encryptionKey;
+    }
+
     const fileStream = this.createReadStream(options);
     let receivedData = false;
 
diff --git a/test/file.ts b/test/file.ts
@@ -2490,6 +2490,7 @@ describe('File', () => {
 
   describe('download', () => {
     let fileReadStream: Readable;
+    let originalSetEncryptionKey: Function;
 
     beforeEach(() => {
       fileReadStream = new Readable();
@@ -2502,6 +2503,13 @@ describe('File', () => {
       file.createReadStream = () => {
         return fileReadStream;
       };
+
+      originalSetEncryptionKey = file.setEncryptionKey;
+      file.setEncryptionKey = sinon.stub();
+    });
+
+    afterEach(() => {
+      file.setEncryptionKey = originalSetEncryptionKey;
     });
 
     it('should accept just a callback', done => {
@@ -2532,6 +2540,31 @@ describe('File', () => {
       file.download(readOptions, assert.ifError);
     });
 
+    it('should call setEncryptionKey with the provided key and not pass it to createReadStream', done => {
+      const encryptionKey = Buffer.from('encryption-key');
+      const downloadOptions = {
+        encryptionKey: encryptionKey,
+        userProject: 'user-project-id',
+      };
+
+      file.createReadStream = (options: {}) => {
+        assert.deepStrictEqual(options, {userProject: 'user-project-id'});
+        return fileReadStream;
+      };
+
+      file.download(downloadOptions, (err: Error) => {
+        assert.ifError(err);
+        // Verify that setEncryptionKey was called with the correct key
+        assert.ok(
+          (file.setEncryptionKey as sinon.SinonStub).calledWith(encryptionKey)
+        );
+        done();
+      });
+
+      fileReadStream.push('some data');
+      fileReadStream.push(null);
+    });
+
     it('should only execute callback once', done => {
       Object.assign(fileReadStream, {
         _read(this: Readable) {
