humphd · humphd · Feb 26, 2025 · Feb 25, 2025 · Feb 25, 2025
diff --git a/README.md b/README.md
@@ -171,6 +171,38 @@ const decrypted = await decryptSops({
 });
 ```
 
+### `decryptSops(sopsObject, options?)`
+
+Decrypts SOPS-encrypted content directly from a pre-parsed SOPS object.
+
+```js
+const sopsObject = {
+  secret:
+    "ENC[AES256_GCM,data:trrpgezXug4Dq9T/inwkMA==,iv:glPwxoY2UuHO91vlJRaqYtFkPY1VsWvkJtfkEKZJdns=,tag:v7DbOYl7C5gdQRdW6BVoLw==,type:str]",
+  sops: {
+    kms: null,
+    gcp_kms: null,
+    azure_kv: null,
+    hc_vault: null,
+    age: [
+      {
+        recipient:
+          "age1je6kjhzuhdjy3fqptpttxjh5k8q46vygzlgtpuq3030c947pc5tqz9dqvr",
+        enc: "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsYVh6WTdzNnArL1E1RVVw\nZEoyU2hqZVZuVjR3bFJ2dlZaOGQ4VUVla1hVCll3MDZrY1VZeWtPNzVPUGNFWjBK\ncDZLVFZheU4wK0hBOTNmRFcwUkE4OFkKLS0tIHl3Y0x5Sk9lVDRCQkR3QzNzRWY4\ncFNPWFZqdEtyUmFhL3pLOHJvNlhuTTAKNLKVIFujPtmpYo/Oycit0JbcfPVN2TN5\nG9emUjK1XVOwkNda0olhEt4KAjSBV7dYt8luOL8VQeR33PadX7RK3A==\n-----END AGE ENCRYPTED FILE-----\n",
+      },
+    ],
+    lastmodified: "2024-12-25T09:03:17Z",
+    mac: "ENC[AES256_GCM,data:pjgkspXlmS1uFtR5yRZXcXISNEOk2/L4lN1zJoo49kgbABun2EwpZ2wfhPUDEDKn7kfmKuSOl4xQ/adUHVJh6bOHyQTf9lfH2BekCy828BIODowzk2tR5uiin8bB5q5VQfNJIaYEn3EWpGaOupEaNTZOyi5ML+WXB8s6w53Wg0w=,iv:wKEh9xSZ5RtsNdlRcEpYnbLKmUV6yitneJQhVt7qBSM=,tag:CmfHyYRe2/GVEexW5A8OWg==,type:str]",
+    pgp: null,
+    unencrypted_suffix: "_unencrypted",
+    version: "3.9.2",
+  },
+};
+
+// Assumes SOPS_AGE_KEY is set in the env
+const decrypted = await decryptSops(sopsObject);
+```
+
 ### Options
 
 The `decryptSops` function accepts the following options:

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "sops-age",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "sops age decryption for JavaScript",
   "repository": "humphd/sops-age",
   "license": "MIT",

diff --git a/src/index.ts b/src/index.ts
@@ -131,6 +131,12 @@ export async function decryptSops(
     return decrypt(sopsData, decryptOptions);
   }
 
+  // Case 3. An bare input object with no options (AGE key must be set in the env)
+  if (inputOrOptions && isSopsInput(inputOrOptions)) {
+    const sopsData = await parseSops(inputOrOptions);
+    return decrypt(sopsData, {});
+  }
+
   throw new Error(
     "Invalid options: when no input given, you must specify one of `path` or `url`",
   );

diff --git a/src/sops-file.ts b/src/sops-file.ts
@@ -5,6 +5,7 @@ import { z } from "zod";
 import { loadFromFile } from "./runtime.js";
 
 export type SopsInput =
+  | object
   | string
   | File
   | Blob
@@ -31,7 +32,22 @@ export function isSopsInput(value: unknown): value is SopsInput {
     return true;
   }
 
-  // Check for object types
+  // Check for an already parsed, sops-like object
+  if (
+    typeof value === "object" &&
+    value !== null &&
+    "sops" in value &&
+    typeof (value as any).sops === "object" &&
+    (value as any).sops !== null &&
+    Array.isArray((value as any).sops.age) &&
+    typeof (value as any).sops.mac === "string" &&
+    typeof (value as any).sops.lastmodified === "string" &&
+    typeof (value as any).sops.version === "string"
+  ) {
+    return true;
+  }
+
+  // Look for other types we can handle
   if (typeof value === "object") {
     return (
       value instanceof File ||
@@ -114,6 +130,10 @@ async function inputToString(input: SopsInput): Promise<string> {
     return new TextDecoder().decode(concatenated);
   }
 
+  if (typeof input === "object") {
+    return JSON.stringify(input);
+  }
+
   throw new Error(`Unsupported input type: ${typeof input}`);
 }
 

diff --git a/tests/unit/index.test.ts b/tests/unit/index.test.ts
@@ -15,6 +15,17 @@ const AGE_SECRET_KEY =
   "AGE-SECRET-KEY-1QXRVEJH9S4NQU0FPD6V79ESZQ8S6PXH3L8V40EVPTHFH6KNKD4DQ7SKC4P";
 
 describe("decryptSops()", () => {
+  test("with valid object input", async () => {
+    const value = await decryptSops(test_secret_enc_json);
+    expect(value).toEqual(test_secret_json);
+  });
+
+  test("with invalid object input", async () => {
+    await expect(
+      decryptSops({ missing: "sops", invalid: true }),
+    ).rejects.toThrow();
+  });
+
   test("with direct input", async () => {
     const value = await decryptSops(JSON.stringify(test_secret_enc_json), {
       secretKey: AGE_SECRET_KEY,