node js code snippet to decrypt AES-GCM-256bit encrypted utm_content provided by facebook app ads install referral provided within install referrer content

decrypt.js

const crypto = require('crypto')

const decryptData = async (installReferrerString, decryptionKey) => {

    try {

        const ALGORITHM = 'aes-256-gcm'

        // Step 1: Decode the URI
        const decodedUri = decodeURIComponent(installReferrerString)

        // Step 2: Decoded URI to key-value pairs
        const regex = /[?&]([^=#]+)=([^&#]*)/g
        const params = {}
        let match = []

        while ((match = regex.exec(decodedUri))) {
            params[match[1]] = match[2]
        }

        if (!params.utm_content) {
            console.error("utm_content data not available in provided install referrer link")
            return
        }

        // Step 3: utm_content string to JSON
        const { data: encryptedData, nonce } = jsonParsedUtmContent.source
        const jsonParsedUtmContent = JSON.parse(params.utm_content)
        
        // Step 4: Prepare for decryption
        const encryptedDataBuffer = Buffer.from(encryptedData, 'hex')
        const nonceBuffer = Buffer.from(nonce, 'hex')
        const decryptionKeyBuffer = Buffer.from(decryptionKey, 'hex')

        // Step 5: Decryption
        const decipher = crypto.createDecipheriv(ALGORITHM, decryptionKeyBuffer, nonceBuffer)

        let output = Buffer.concat([
            // Using slice here to remove the last 16 bytes tag added by libsodium while encypting the data
            decipher.update(encryptedDataBuffer.slice(0, -16))
        ])

        const decryptedDataString = output.toString()
        const decryptedData = JSON.parse(decryptedDataString)

        return decryptedData

    } catch (err) {
        console.error("Decryption error:")
        console.error(err)
    }

}

// Sample function call
const installReferrerString = "utm_source=apps.facebook.com&utm_campaign=fb4a&utm_content=<ENTIRE_FB_ENCRYPTED_DATA>"
const decryptionKey = "<DECRYPTION_KEY_PROVIDED_IN_FACEBOOK_APPS_PAGE>"
const adsReferralData = decryptData(installReferrerString, decryptionKey)