@7365admin1/core 3.51.1-staging.228 → 3.51.1-staging.229

package/.changeset/hid-amico-secret-loud.md

@@ -0,0 +1,9 @@
+---
+"@7365admin1/core": patch
+---
+
+HID Amico: stop silently deriving the credential encryption key from
+ACCESS_TOKEN_SECRET. Reading still accepts the legacy key so existing credentials
+keep working (and now logs an error saying so), but writing a new credential
+refuses with a message naming HID_AMICO_SECRET, so a later rotation of the JWT
+signing secret cannot orphan credentials that were written after this.

package/dist/index.js

@@ -536,13 +536,13 @@ var require_logger = __commonJS({
     "use strict";
     exports.__esModule = true;
     var _utils = require_utils();
-    var logger219 = {
+    var logger220 = {
       methodMap: ["debug", "info", "warn", "error"],
       level: "info",
       // Maps a given level value to the `methodMap` indexes above.
       lookupLevel: function lookupLevel(level) {
         if (typeof level === "string") {
-          var levelMap = _utils.indexOf(logger219.methodMap, level.toLowerCase());
+          var levelMap = _utils.indexOf(logger220.methodMap, level.toLowerCase());
           if (levelMap >= 0) {
             level = levelMap;
           } else {
@@ -553,9 +553,9 @@ var require_logger = __commonJS({
       },
       // Can be overridden in the host environment
       log: function log(level) {
-        level = logger219.lookupLevel(level);
-        if (typeof console !== "undefined" && logger219.lookupLevel(logger219.level) <= level) {
-          var method = logger219.methodMap[level];
+        level = logger220.lookupLevel(level);
+        if (typeof console !== "undefined" && logger220.lookupLevel(logger220.level) <= level) {
+          var method = logger220.methodMap[level];
           if (!console[method]) {
             method = "log";
           }
@@ -566,7 +566,7 @@ var require_logger = __commonJS({
         }
       }
     };
-    exports["default"] = logger219;
+    exports["default"] = logger220;
     module2.exports = exports["default"];
   }
 });
@@ -43973,7 +43973,7 @@ var VALID_STATUSES = /* @__PURE__ */ new Set([
 ]);
 
 // src/services/hid-amico.service.ts
-var import_crypto2 = __toESM(require("crypto"));
+var import_crypto3 = __toESM(require("crypto"));
 var import_axios = __toESM(require("axios"));
 var import_node_server_utils133 = require("@7365admin1/node-server-utils");
 
@@ -45927,6 +45927,31 @@ function stringifyHidJson(value) {
   );
 }
 
+// src/utils/hid-secret.util.ts
+var import_crypto2 = __toESM(require("crypto"));
+var HID_SECRET_ENV = "HID_AMICO_SECRET";
+var HID_LEGACY_SECRET_ENV = "ACCESS_TOKEN_SECRET";
+var HID_SECRET_MISSING_FOR_WRITE = `${HID_SECRET_ENV} is not configured, so a new HID credential cannot be encrypted. Set ${HID_SECRET_ENV} on this service and try again. It is deliberately NOT falling back to ${HID_LEGACY_SECRET_ENV}: that key is rotated independently, and anything encrypted with it becomes permanently unreadable the moment it is.`;
+var HID_SECRET_MISSING_ENTIRELY = `Neither ${HID_SECRET_ENV} nor ${HID_LEGACY_SECRET_ENV} is configured, so stored HID credentials cannot be decrypted. Set ${HID_SECRET_ENV} on this service.`;
+var HID_SECRET_LEGACY_FALLBACK_IN_USE = `${HID_SECRET_ENV} is not configured. Stored HID credentials are being decrypted with ${HID_LEGACY_SECRET_ENV}, which is rotated independently \u2014 when it is rotated they become permanently unreadable. Set ${HID_SECRET_ENV} and re-save the affected HID readers and SIP accounts.`;
+function resolveHidSecretKey(purpose, env2 = process.env) {
+  const dedicated = env2[HID_SECRET_ENV];
+  if (dedicated) {
+    return { key: deriveKey(dedicated), usedLegacyFallback: false };
+  }
+  if (purpose === "encrypt") {
+    throw new Error(HID_SECRET_MISSING_FOR_WRITE);
+  }
+  const legacy = env2[HID_LEGACY_SECRET_ENV];
+  if (!legacy) {
+    throw new Error(HID_SECRET_MISSING_ENTIRELY);
+  }
+  return { key: deriveKey(legacy), usedLegacyFallback: true };
+}
+function deriveKey(secret) {
+  return import_crypto2.default.createHash("sha256").update(secret).digest();
+}
+
 // src/services/hid-amico.service.ts
 var PASSWORD_PREFIX = "v1";
 var HID_READER_NOT_FOUND = "HID Amico reader not found.";
@@ -46047,14 +46072,22 @@ function sanitizeHidObjectPayload(object, value) {
   };
   return redactValue(sanitized);
 }
-function getSecretKey() {
-  const secret = process.env.HID_AMICO_SECRET || process.env.ACCESS_TOKEN_SECRET;
-  if (!secret) {
-    throw new import_node_server_utils133.InternalServerError(
-      "HID_AMICO_SECRET or ACCESS_TOKEN_SECRET must be configured before HID credentials can be used."
-    );
+var reportedLegacyHidSecret = false;
+function getSecretKey(purpose) {
+  try {
+    const { key, usedLegacyFallback } = resolveHidSecretKey(purpose);
+    if (usedLegacyFallback && !reportedLegacyHidSecret) {
+      reportedLegacyHidSecret = true;
+      import_node_server_utils133.logger.error({
+        operation: "hid-amico:getSecretKey",
+        message: HID_SECRET_LEGACY_FALLBACK_IN_USE
+      });
+    }
+    return key;
+  } catch (error) {
+    import_node_server_utils133.logger.error({ operation: "hid-amico:getSecretKey", purpose, message: error.message });
+    throw new import_node_server_utils133.InternalServerError(error.message);
   }
-  return import_crypto2.default.createHash("sha256").update(secret).digest();
 }
 function getReaderCapabilities(readerModel, firmwareVersion) {
   const isAmicoBiometricReader2 = readerModel === "VL35LF" || readerModel === "VL70LF";
@@ -46120,8 +46153,8 @@ function getPublicMonitorConfiguration(monitor, callbackToken) {
   };
 }
 function encryptSecret(value) {
-  const iv = import_crypto2.default.randomBytes(12);
-  const cipher = import_crypto2.default.createCipheriv("aes-256-gcm", getSecretKey(), iv);
+  const iv = import_crypto3.default.randomBytes(12);
+  const cipher = import_crypto3.default.createCipheriv("aes-256-gcm", getSecretKey("encrypt"), iv);
   const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
   return [PASSWORD_PREFIX, iv.toString("hex"), tag.toString("hex"), encrypted.toString("hex")].join(":");
@@ -46130,9 +46163,10 @@ function decryptSecret(value) {
   if (!value?.startsWith(`${PASSWORD_PREFIX}:`)) {
     return value;
   }
+  const key = getSecretKey("decrypt");
   try {
     const [, ivHex, tagHex, encryptedHex] = value.split(":");
-    const decipher = import_crypto2.default.createDecipheriv("aes-256-gcm", getSecretKey(), Buffer.from(ivHex, "hex"));
+    const decipher = import_crypto3.default.createDecipheriv("aes-256-gcm", key, Buffer.from(ivHex, "hex"));
     decipher.setAuthTag(Buffer.from(tagHex, "hex"));
     return Buffer.concat([
       decipher.update(Buffer.from(encryptedHex, "hex")),
@@ -46172,7 +46206,7 @@ function normalizeHidReaderBaseUrl(value) {
   return endpoint.origin;
 }
 function createStableHidId(seed) {
-  const bytes = import_crypto2.default.createHash("sha256").update(seed).digest().subarray(0, 6);
+  const bytes = import_crypto3.default.createHash("sha256").update(seed).digest().subarray(0, 6);
   return Number.parseInt(bytes.toString("hex"), 16) || 1;
 }
 function isUnknownRecord2(value) {
@@ -46247,7 +46281,7 @@ function resolveProfileIdentityType(memberType, userType) {
 var VISITOR_QR_FORMAT = "0";
 function createVisitorQrCredential(visitorId, readerId, qrValue) {
   const credentialId = createStableHidId(`visitor-qr:${readerId}:${visitorId}`);
-  const token = qrValue || `VIS${import_crypto2.default.randomBytes(12).toString("hex").toUpperCase()}`;
+  const token = qrValue || `VIS${import_crypto3.default.randomBytes(12).toString("hex").toUpperCase()}`;
   return { credentialId, object: "qrcodes", value: token, qrValue: token };
 }
 async function configureVisitorQrReader(client) {
@@ -46751,7 +46785,7 @@ function getSipProvisioningConfig() {
   return { provisionerUrl, provisionerToken, websocketUrl, domain };
 }
 function createSipPassword() {
-  return import_crypto2.default.randomBytes(12).toString("base64url");
+  return import_crypto3.default.randomBytes(12).toString("base64url");
 }
 function sipAccountResponse(account) {
   const { websocketUrl, domain } = getSipProvisioningConfig();
@@ -49431,7 +49465,7 @@ function useHidAmicoService() {
     assertReaderCardProfile(reader, cardType);
     const hidUserId = Number(hidUserIdValue);
     const client = new HidAmicoClient(reader);
-    const lockOwner = import_crypto2.default.randomUUID();
+    const lockOwner = import_crypto3.default.randomUUID();
     const acquired = await repo.acquireEnrollmentLock(readerId, lockOwner, timeoutSeconds + 30);
     if (!acquired) {
       throw new import_node_server_utils133.BadRequestError("Another physical HID card enrollment is already running on this reader.");
@@ -51445,17 +51479,17 @@ var import_fs5 = __toESM(require("fs"));
 var import_path2 = __toESM(require("path"));
 var import_axios2 = __toESM(require("axios"));
 var import_xml2js = require("xml2js");
-var import_crypto3 = __toESM(require("crypto"));
+var import_crypto4 = __toESM(require("crypto"));
 var ALGORITHM = "aes-256-gcm";
-var SECRET_KEY = import_crypto3.default.createSecretKey(
-  new Uint8Array(import_crypto3.default.createHash("sha256").update("acm-secret-key").digest())
+var SECRET_KEY = import_crypto4.default.createSecretKey(
+  new Uint8Array(import_crypto4.default.createHash("sha256").update("acm-secret-key").digest())
 );
 function decryptAcmUrl(encryptedText) {
   const [ivB64, authTagB64, encryptedB64] = encryptedText.split(":");
   const iv = Buffer.from(ivB64, "base64");
   const authTag = Buffer.from(authTagB64, "base64");
   const encrypted = Buffer.from(encryptedB64, "base64");
-  const decipher = import_crypto3.default.createDecipheriv(
+  const decipher = import_crypto4.default.createDecipheriv(
     ALGORITHM,
     SECRET_KEY,
     new Uint8Array(iv)
@@ -51598,10 +51632,10 @@ async function getTransactions(index, url) {
 }
 function encryptPayload(payloadHex) {
   const buffer = Buffer.from(payloadHex, "ascii");
-  const encrypted = import_crypto3.default.publicEncrypt(
+  const encrypted = import_crypto4.default.publicEncrypt(
     {
       key: "testing",
-      padding: import_crypto3.default.constants.RSA_PKCS1_PADDING
+      padding: import_crypto4.default.constants.RSA_PKCS1_PADDING
     },
     buffer
   );
@@ -51611,7 +51645,7 @@ function toHex(num, length) {
   return num.toString(16).padStart(length * 2, "0");
 }
 function buildPayload(cardNumber, validityMinutes) {
-  const randomHex = import_crypto3.default.randomBytes(2).toString("hex");
+  const randomHex = import_crypto4.default.randomBytes(2).toString("hex");
   const cardHex = toHex(cardNumber, 4);
   const epochHex = toHex(Math.floor(Date.now() / 1e3), 4);
   const validityHex = toHex(validityMinutes, 2);
@@ -51626,7 +51660,7 @@ function generateQrCodeData(cardNumber, validityMinutes) {
 var import_xml2js2 = require("xml2js");
 
 // src/utils/rsa-encryption.ts
-var crypto6 = __toESM(require("crypto"));
+var crypto7 = __toESM(require("crypto"));
 var import_fs6 = __toESM(require("fs"));
 var import_path3 = __toESM(require("path"));
 var pub = import_path3.default.resolve(process.cwd(), "./src/public/rsa-keys/new_rsa_512_pub.pem");
@@ -51656,7 +51690,7 @@ var EntrypassRSAEncryption = class extends EncryptionCredentials {
   static constructQrcode(params) {
     const { virtualCardNo, validityMinutes } = params;
     const virtualCardNoHex = this.cardNumberToHex(virtualCardNo);
-    const randomHex = crypto6.randomBytes(2).toString("hex").toUpperCase();
+    const randomHex = crypto7.randomBytes(2).toString("hex").toUpperCase();
     const epochHex = Math.floor(Date.now() / 1e3).toString(16).toUpperCase();
     const validityHex = validityMinutes.toString(16).padStart(4, "0").toUpperCase();
     const plainHex = randomHex + virtualCardNoHex.toUpperCase() + epochHex + validityHex;
@@ -51667,10 +51701,10 @@ var EntrypassRSAEncryption = class extends EncryptionCredentials {
     const bufferValue = this.constructQrcode(params);
     const plainTextPayload = bufferValue;
     console.log("Payload to be encrypted:", plainTextPayload);
-    const encryptedBuffer = crypto6.publicEncrypt(
+    const encryptedBuffer = crypto7.publicEncrypt(
       {
         key: this.RAW_PUBLIC_KEY,
-        padding: crypto6.constants.RSA_PKCS1_PADDING
+        padding: crypto7.constants.RSA_PKCS1_PADDING
       },
       Buffer.from(plainTextPayload, "utf8")
     );
@@ -51681,10 +51715,10 @@ var EntrypassRSAEncryption = class extends EncryptionCredentials {
   static decryptQRCode(base64Cipher) {
     try {
       const buffer = Buffer.from(base64Cipher, "base64");
-      const decryptedBuffer = crypto6.privateDecrypt(
+      const decryptedBuffer = crypto7.privateDecrypt(
         {
           key: this.RAW_PRIVATE_KEY,
-          padding: crypto6.constants.RSA_PKCS1_PADDING
+          padding: crypto7.constants.RSA_PKCS1_PADDING
         },
         buffer
       );
@@ -81718,12 +81752,12 @@ async function manpowerEvents(io) {
 var import_axios4 = __toESM(require("axios"));
 
 // src/utils/payment-signature.util.ts
-var crypto7 = __toESM(require("crypto"));
+var crypto8 = __toESM(require("crypto"));
 function hasOwn(obj, key) {
   return Object.prototype.hasOwnProperty.call(obj, key);
 }
 function sha512(input) {
-  return crypto7.createHash("sha512").update(input).digest("hex");
+  return crypto8.createHash("sha512").update(input).digest("hex");
 }
 function assertSecret(secretKey) {
   if (!secretKey) {
@@ -82595,7 +82629,7 @@ function useRedDotPaymentController() {
 
 // src/services/verification-v2.service.ts
 var import_node_server_utils262 = require("@7365admin1/node-server-utils");
-var import_crypto4 = __toESM(require("crypto"));
+var import_crypto5 = __toESM(require("crypto"));
 var import_joi138 = __toESM(require("joi"));
 var import_mongodb160 = require("mongodb");
 function useVerificationServiceV2() {
@@ -82657,7 +82691,7 @@ function useVerificationServiceV2() {
   }
   function generateVerificationCode(length = 8) {
     const chars = "0123456789";
-    const bytes = import_crypto4.default.randomBytes(length);
+    const bytes = import_crypto5.default.randomBytes(length);
     let result = "";
     for (let i = 0; i < length; i++) {
       result += chars[bytes[i] % chars.length];