[cli] Fix bug in decrypting exported data from Ente Auth (#1951)

## Description

## Tests
Tested locally

cli/internal/crypto/crypto.go

@@ -113,3 +113,23 @@ func DecryptChaChaBase64(data string, key []byte, nonce string) (string, []byte,
 	}
 	return base64.StdEncoding.EncodeToString(decryptedData), decryptedData, nil
 }
+
+func DecryptChaChaBase64Auth(data string, key []byte, nonce string) (string, []byte, error) {
+	// Decode data from base64
+	dataBytes, err := base64.StdEncoding.DecodeString(data)
+	if err != nil {
+		// safe to log the encrypted data
+		return "", nil, fmt.Errorf("invalid base64 data %s: %v", data, err)
+	}
+	// Decode nonce from base64
+	nonceBytes, err := base64.StdEncoding.DecodeString(nonce)
+	if err != nil {
+		return "", nil, fmt.Errorf("invalid nonce: %v", err)
+	}
+	// Decrypt data
+	decryptedData, err := decryptChaCha20poly1305V2(dataBytes, key, nonceBytes)
+	if err != nil {
+		return "", nil, fmt.Errorf("failed to decrypt data: %v", err)
+	}
+	return base64.StdEncoding.EncodeToString(decryptedData), decryptedData, nil
+}

cli/internal/crypto/crypto_libsodium.go

@@ -88,6 +88,23 @@ func decryptChaCha20poly1305(data []byte, key []byte, nonce []byte) ([]byte, err
 	return decoded, nil
 }
 
+// decryptChaCha20poly1305V2 is used only to decrypt Ente Auth data. Ente Auth use new version of LibSodium.
+// In that version, the final tag value is 0x0 instead of TagFinal.
+func decryptChaCha20poly1305V2(data []byte, key []byte, nonce []byte) ([]byte, error) {
+	decryptor, err := NewDecryptor(key, nonce)
+	if err != nil {
+		return nil, err
+	}
+	decoded, tag, err := decryptor.Pull(data)
+	if tag != TagFinal && tag != TagMessage {
+		return nil, errors.New("invalid tag")
+	}
+	if err != nil {
+		return nil, err
+	}
+	return decoded, nil
+}
+
 //func SecretBoxOpenLibSodium(c []byte, n []byte, k []byte) ([]byte, error) {
 //	var cp sodium.Bytes = c
 //	res, err := cp.SecretBoxOpen(sodium.SecretBoxNonce{Bytes: n}, sodium.SecretBoxKey{Bytes: k})

cli/main.go

@@ -15,7 +15,7 @@ import (
 	"strings"
 )
 
-var AppVersion = "0.1.13"
+var AppVersion = "0.1.14"
 
 func main() {
 	cliDBPath, err := GetCLIConfigPath()

cli/pkg/authenticator/decrypt.go

@@ -55,7 +55,7 @@ func DecryptExport(inputPath string, outputPath string) error {
 		return fmt.Errorf("error deriving key: %v", err)
 	}
 
-	_, decryptedData, err := eCrypto.DecryptChaChaBase64(export.EncryptedData, key, export.EncryptionNonce)
+	_, decryptedData, err := eCrypto.DecryptChaChaBase64Auth(export.EncryptedData, key, export.EncryptionNonce)
 	if err != nil {
 		fmt.Printf("\nerror decrypting data %v", err)
 		fmt.Println("\nPlease check your password and try again")