@boxyhq/saml-jackson 0.2.1-beta.155 → 0.2.1-beta.156

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boxyhq/saml-jackson",
-  "version": "0.2.1-beta.155",
+  "version": "0.2.1-beta.156",
   "license": "Apache 2.0",
   "description": "SAML 2.0 service",
   "main": "src/index.js",

package/src/db/db.js

@@ -3,18 +3,39 @@ const mongo = require('./mongo.js');
 const redis = require('./redis.js');
 const sql = require('./sql/sql.js');
 const store = require('./store.js');
+const encrypter = require('./encrypter.js');
+
+const decrypt = (res, encryptionKey) => {
+  if (res.iv && res.tag) {
+    return JSON.parse(
+      encrypter.decrypt(res.value, res.iv, res.tag, encryptionKey)
+    );
+  }
+
+  return JSON.parse(res.value);
+};
 
 class DB {
-  constructor(db) {
+  constructor(db, encryptionKey) {
     this.db = db;
+    this.encryptionKey = encryptionKey;
   }
 
   async get(namespace, key) {
-    return await this.db.get(namespace, key);
+    const res = await this.db.get(namespace, key);
+    if (!res) {
+      return null;
+    }
+
+    return decrypt(res, this.encryptionKey);
   }
 
   async getByIndex(namespace, idx) {
-    return await this.db.getByIndex(namespace, idx);
+    const res = await this.db.getByIndex(namespace, idx);
+    const encryptionKey = this.encryptionKey;
+    return res.map((r) => {
+      return decrypt(r, encryptionKey);
+    });
   }
 
   // ttl is in seconds
@@ -23,13 +44,11 @@ class DB {
       throw new Error('secondary indexes not allow on a store with ttl');
     }
 
-    return await this.db.put(
-      namespace,
-      key,
-      JSON.stringify(val),
-      ttl,
-      ...indexes
-    );
+    const dbVal = this.encryptionKey
+      ? encrypter.encrypt(JSON.stringify(val), this.encryptionKey)
+      : { value: JSON.stringify(val) };
+
+    return await this.db.put(namespace, key, dbVal, ttl, ...indexes);
   }
 
   async delete(namespace, key) {
@@ -43,15 +62,18 @@ class DB {
 
 module.exports = {
   new: async (options) => {
+    const encryptionKey = options.encryptionKey
+      ? Buffer.from(options.encryptionKey, 'latin1')
+      : null;
     switch (options.engine) {
       case 'redis':
-        return new DB(await redis.new(options));
+        return new DB(await redis.new(options), encryptionKey);
       case 'sql':
-        return new DB(await sql.new(options));
+        return new DB(await sql.new(options), encryptionKey);
       case 'mongo':
-        return new DB(await mongo.new(options));
+        return new DB(await mongo.new(options), encryptionKey);
       case 'mem':
-        return new DB(await mem.new(options));
+        return new DB(await mem.new(options), encryptionKey);
       default:
         throw new Error('unsupported db engine: ' + options.engine);
     }

package/src/db/db.test.js

@@ -2,6 +2,8 @@ const t = require('tap');
 
 const DB = require('./db.js');
 
+const encryptionKey = '3yGrTcnKPBqqHoH3zZMAU6nt4bmIYb2q';
+
 let configStores = [];
 let ttlStores = [];
 const ttl = 3;
@@ -17,39 +19,87 @@ const record2 = {
   city: 'London',
 };
 
+const memDbConfig = {
+  engine: 'mem',
+  ttl: 1,
+};
+
+const redisDbConfig = {
+  engine: 'redis',
+  url: 'redis://localhost:6379',
+};
+
+const postgresDbConfig = {
+  engine: 'sql',
+  url: 'postgresql://postgres:postgres@localhost:5432/postgres',
+  type: 'postgres',
+  ttl: 1,
+  limit: 1,
+};
+
+const mongoDbConfig = {
+  engine: 'mongo',
+  url: 'mongodb://localhost:27017/jackson',
+};
+
+const mysqlDbConfig = {
+  engine: 'sql',
+  url: 'mysql://root:mysql@localhost:3307/mysql',
+  type: 'mysql',
+  ttl: 1,
+  limit: 1,
+};
+
+const mariadbDbConfig = {
+  engine: 'sql',
+  url: 'mariadb://root@localhost:3306/mysql',
+  type: 'mariadb',
+  ttl: 1,
+  limit: 1,
+};
+
 const dbs = [
   {
-    engine: 'mem',
-    ttl: 1,
+    ...memDbConfig,
+  },
+  {
+    ...memDbConfig,
+    encryptionKey,
+  },
+  {
+    ...redisDbConfig,
+  },
+  {
+    ...redisDbConfig,
+    encryptionKey,
+  },
+  {
+    ...postgresDbConfig,
+  },
+  {
+    ...postgresDbConfig,
+    encryptionKey,
+  },
+  {
+    ...mongoDbConfig,
   },
   {
-    engine: 'redis',
-    url: 'redis://localhost:6379',
+    ...mongoDbConfig,
+    encryptionKey,
   },
   {
-    engine: 'sql',
-    url: 'postgresql://postgres:postgres@localhost:5432/postgres',
-    type: 'postgres',
-    ttl: 1,
-    limit: 1,
+    ...mysqlDbConfig,
   },
   {
-    engine: 'mongo',
-    url: 'mongodb://localhost:27017/jackson',
+    ...mysqlDbConfig,
+    encryptionKey,
   },
   {
-    engine: 'sql',
-    url: 'mysql://root:mysql@localhost:3307/mysql',
-    type: 'mysql',
-    ttl: 1,
-    limit: 1,
+    ...mariadbDbConfig,
   },
   {
-    engine: 'sql',
-    url: 'mariadb://root@localhost:3306/mysql',
-    type: 'mariadb',
-    ttl: 1,
-    limit: 1,
+    ...mariadbDbConfig,
+    encryptionKey,
   },
 ];
 
@@ -224,7 +274,7 @@ t.test('dbs', ({ end }) => {
       }
 
       await new Promise((resolve) =>
-        setTimeout(resolve, (2*ttl + 0.5) * 1000)
+        setTimeout(resolve, (2 * ttl + 0.5) * 1000)
       );
 
       const ret1 = await ttlStore.get(record1.id);

package/src/db/encrypter.js

@@ -0,0 +1,36 @@
+const crypto = require('crypto');
+
+const ALGO = 'aes-256-gcm';
+const BLOCK_SIZE = 16; // 128 bit
+
+const encrypt = (text, key) => {
+  const iv = crypto.randomBytes(BLOCK_SIZE);
+  const cipher = crypto.createCipheriv(ALGO, key, iv);
+
+  let ciphertext = cipher.update(text, 'utf8', 'base64');
+  ciphertext += cipher.final('base64');
+  return {
+    iv: iv.toString('base64'),
+    tag: cipher.getAuthTag().toString('base64'),
+    value: ciphertext,
+  };
+};
+
+const decrypt = (ciphertext, iv, tag, key) => {
+  const decipher = crypto.createDecipheriv(
+    ALGO,
+    key,
+    Buffer.from(iv, 'base64')
+  );
+  decipher.setAuthTag(Buffer.from(tag, 'base64'));
+
+  let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
+  cleartext += decipher.final('utf8');
+
+  return cleartext;
+};
+
+module.exports = {
+  encrypt,
+  decrypt,
+};

package/src/db/mem.js

@@ -34,7 +34,7 @@ class Mem {
   async get(namespace, key) {
     let res = this.store[dbutils.key(namespace, key)];
     if (res) {
-      return JSON.parse(res);
+      return res;
     }
 
     return null;

package/src/db/mongo.js

@@ -25,7 +25,7 @@ class Mongo {
       _id: dbutils.key(namespace, key),
     });
     if (res && res.value) {
-      return JSON.parse(res.value);
+      return res.value;
     }
 
     return null;
@@ -40,7 +40,7 @@ class Mongo {
 
     const ret = [];
     for (const doc of docs || []) {
-      ret.push(JSON.parse(doc.value));
+      ret.push(doc.value);
     }
 
     return ret;

package/src/db/redis.js

@@ -46,7 +46,7 @@ class Redis {
     let tx = this.client.multi();
     const k = dbutils.key(namespace, key);
 
-    tx = tx.set(k, val);
+    tx = tx.set(k, JSON.stringify(val));
 
     if (ttl) {
       tx = tx.expire(k, ttl);

package/src/db/sql/entity/JacksonStore.js

@@ -27,6 +27,16 @@ module.exports = (type) => {
       value: {
         type: valueType(type),
       },
+      iv: {
+        type: 'varchar',
+        length: 64,
+        nullable: true,
+      },
+      tag: {
+        type: 'varchar',
+        length: 64,
+        nullable: true,
+      },
     },
   });
 };

package/src/db/sql/model/JacksonStore.js

@@ -1,7 +1,9 @@
 /*export */ class JacksonStore {
-  constructor(key, value) {
+  constructor(key, value, iv, tag) {
     this.key = key;
     this.value = value;
+    this.iv = iv;
+    this.tag = tag;
   }
 }
 

package/src/db/sql/sql.js

@@ -14,7 +14,7 @@ class Sql {
       while (true) {
         try {
           this.connection = await typeorm.createConnection({
-            name: options.type,
+            name: options.type + Math.floor(Math.random() * 100000),
             type: options.type,
             url: options.url,
             synchronize: true,
@@ -82,7 +82,11 @@ class Sql {
     });
 
     if (res && res.value) {
-      return JSON.parse(res.value);
+      return {
+        value: res.value,
+        iv: res.iv,
+        tag: res.tag,
+      };
     }
 
     return null;
@@ -97,7 +101,11 @@ class Sql {
 
     if (res) {
       res.forEach((r) => {
-        ret.push(JSON.parse(r.store.value));
+        ret.push({
+          value: r.store.value,
+          iv: r.store.iv,
+          tag: r.store.tag,
+        });
       });
     }
 
@@ -107,7 +115,7 @@ class Sql {
   async put(namespace, key, val, ttl = 0, ...indexes) {
     await this.connection.transaction(async (transactionalEntityManager) => {
       const dbKey = dbutils.key(namespace, key);
-      const store = new JacksonStore(dbKey, val);
+      const store = new JacksonStore(dbKey, val.value, val.iv, val.tag);
       await transactionalEntityManager.save(store);
 
       if (ttl) {

package/src/env.js

@@ -18,6 +18,7 @@ const db = {
   url: process.env.DB_URL,
   type: process.env.DB_TYPE,
   ttl: process.env.DB_TTL,
+  encryptionKey: process.env.DB_ENCRYPTION_KEY,
 };
 
 module.exports = {