84 lines
2.2 KiB
TypeScript
84 lines
2.2 KiB
TypeScript
/**
|
|
* Encryption utilities for sensitive data
|
|
* Uses AES-256-GCM for encryption
|
|
*/
|
|
import * as crypto from 'crypto';
|
|
|
|
const ALGORITHM = 'aes-256-gcm';
|
|
const IV_LENGTH = 16;
|
|
|
|
/**
|
|
* Get encryption key from environment
|
|
*/
|
|
function getEncryptionKey(): Buffer {
|
|
const key = process.env.ENCRYPTION_KEY;
|
|
if (!key || key.length !== 64) {
|
|
throw new Error('ENCRYPTION_KEY must be a 32-byte hex string (64 characters)');
|
|
}
|
|
return Buffer.from(key, 'hex');
|
|
}
|
|
|
|
/**
|
|
* Encrypt text using AES-256-GCM
|
|
* Returns base64 encoded string with format: iv:authTag:encrypted
|
|
*/
|
|
export function encrypt(text: string): string {
|
|
if (!text || text.trim().length === 0) {
|
|
throw new Error('Text to encrypt cannot be empty or null');
|
|
}
|
|
|
|
try {
|
|
const key = getEncryptionKey();
|
|
const iv = crypto.randomBytes(IV_LENGTH);
|
|
const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
|
|
|
|
let encrypted = cipher.update(text, 'utf8', 'base64');
|
|
encrypted += cipher.final('base64');
|
|
|
|
const authTag = cipher.getAuthTag();
|
|
|
|
// Combine iv, authTag, and encrypted data
|
|
return `${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted}`;
|
|
} catch (error) {
|
|
console.error('[Crypto] Encryption failed:', error);
|
|
throw new Error('Failed to encrypt data');
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Decrypt text encrypted with encrypt()
|
|
* Expects base64 string with format: iv:authTag:encrypted
|
|
*/
|
|
export function decrypt(encryptedText: string): string {
|
|
try {
|
|
const key = getEncryptionKey();
|
|
const parts = encryptedText.split(':');
|
|
|
|
if (parts.length !== 3) {
|
|
throw new Error('Invalid encrypted text format');
|
|
}
|
|
|
|
const iv = Buffer.from(parts[0], 'base64');
|
|
const authTag = Buffer.from(parts[1], 'base64');
|
|
const encrypted = parts[2];
|
|
|
|
const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
|
|
decipher.setAuthTag(authTag);
|
|
|
|
let decrypted = decipher.update(encrypted, 'base64', 'utf8');
|
|
decrypted += decipher.final('utf8');
|
|
|
|
return decrypted;
|
|
} catch (error) {
|
|
console.error('[Crypto] Decryption failed:', error);
|
|
throw new Error('Failed to decrypt data');
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Generate a random encryption key (32 bytes as hex string)
|
|
*/
|
|
export function generateEncryptionKey(): string {
|
|
return crypto.randomBytes(32).toString('hex');
|
|
}
|