@develit-services/bank 0.8.20 → 1.1.0

package/README.md

@@ -337,6 +337,39 @@ Sifrovane bankovni tokeny (AES). Typy: `AUTH_TOKEN`, `REFRESH_TOKEN`, `CLIENT_ID
 
 Jednorazove tokeny pro autorizacni flow uctu.
 
+## Secrets Store — encryption key
+
+Bankovni credentials (`account_credentials`) jsou sifrovane pomoci **AES-256-GCM** (Web Crypto API). Sifrovaci klic je ulozen v Secrets Store jako `BANK_SERVICE_ENCRYPTION_KEY`.
+
+### Jak klic funguje
+
+- **Algoritmus**: AES-GCM (256-bit)
+- **IV**: 12 bytu, nahodne generovany pro kazdou sifrovaci operaci
+- **Format ulozeni**: base64(IV + ciphertext) v sloupci `account_credentials.value`
+- **Sifrovana data**: `AUTH_TOKEN`, `REFRESH_TOKEN`, `CLIENT_ID`, `API_KEY` bankovnich konektoru
+
+### Jak vygenerovat klic
+
+```bash
+# Vygeneruje 256-bit AES klic a vypise jako base64
+node -e "crypto.subtle.generateKey({name:'AES-GCM',length:256},true,['encrypt','decrypt']).then(k=>crypto.subtle.exportKey('raw',k)).then(b=>console.log(Buffer.from(b).toString('base64')))"
+```
+
+Alternativne:
+
+```bash
+# 32 nahodnych bytu = 256 bitu, zakodovano jako base64
+openssl rand -base64 32
+```
+
+Vysledny base64 retezec ulozit do Secrets Store pod nazvem `BANK_SERVICE_ENCRYPTION_KEY`.
+
+### Bezpecnostni doporuceni
+
+- Pouzijte **jiny klic pro kazde prostredi** (local, dev, staging, production)
+- Pri rotaci klice je nutne **re-encryptovat** vsechny existujici credentials — zmena klice bez migrace zpusobi neschopnost desifrovat stavajici tokeny
+- Klic nikdy neukladejte do kodu, env souboru ani git repozitare
+
 ## Error Codes
 
 Format: `{CATEGORY}-B-{NUMBER}`

package/dist/database/schema.cjs

@@ -1,6 +1,6 @@
 'use strict';
 
-const database_schema = require('../shared/bank.o95cOH_P.cjs');
+const database_schema = require('../shared/bank.B5nOIsGC.cjs');
 require('@develit-io/backend-sdk');
 require('drizzle-orm/sqlite-core');
 require('date-fns');

package/dist/database/schema.d.cts

@@ -1,7 +1,8 @@
-export { az as account, aA as accountCredentials, aB as batch, aC as ott, aD as payment, aE as paymentRelations, aF as paymentRequest, aG as paymentRequestRelations } from '../shared/bank.BOY6AI1t.cjs';
+export { az as account, aA as accountCredentials, aB as batch, aC as ott, aD as payment, aE as paymentRelations, aF as paymentRequest, aG as paymentRequestRelations } from '../shared/bank.BECp1kh0.cjs';
 import 'drizzle-orm/sqlite-core';
 import 'drizzle-orm';
 import '@develit-io/backend-sdk';
 import '@develit-io/general-codes';
 import 'zod';
 import 'drizzle-zod';
+import 'zod/v4/core';

package/dist/database/schema.d.mts

@@ -1,7 +1,8 @@
-export { az as account, aA as accountCredentials, aB as batch, aC as ott, aD as payment, aE as paymentRelations, aF as paymentRequest, aG as paymentRequestRelations } from '../shared/bank.BOY6AI1t.mjs';
+export { az as account, aA as accountCredentials, aB as batch, aC as ott, aD as payment, aE as paymentRelations, aF as paymentRequest, aG as paymentRequestRelations } from '../shared/bank.BECp1kh0.mjs';
 import 'drizzle-orm/sqlite-core';
 import 'drizzle-orm';
 import '@develit-io/backend-sdk';
 import '@develit-io/general-codes';
 import 'zod';
 import 'drizzle-zod';
+import 'zod/v4/core';

package/dist/database/schema.d.ts

@@ -1,7 +1,8 @@
-export { az as account, aA as accountCredentials, aB as batch, aC as ott, aD as payment, aE as paymentRelations, aF as paymentRequest, aG as paymentRequestRelations } from '../shared/bank.BOY6AI1t.js';
+export { az as account, aA as accountCredentials, aB as batch, aC as ott, aD as payment, aE as paymentRelations, aF as paymentRequest, aG as paymentRequestRelations } from '../shared/bank.BECp1kh0.js';
 import 'drizzle-orm/sqlite-core';
 import 'drizzle-orm';
 import '@develit-io/backend-sdk';
 import '@develit-io/general-codes';
 import 'zod';
 import 'drizzle-zod';
+import 'zod/v4/core';

package/dist/database/schema.mjs

@@ -1,4 +1,4 @@
-export { x as account, y as accountCredentials, z as batch, D as ott, E as payment, F as paymentRelations, G as paymentRequest, H as paymentRequestRelations } from '../shared/bank.ESTBT4J6.mjs';
+export { x as account, y as accountCredentials, z as batch, D as ott, E as payment, F as paymentRelations, G as paymentRequest, H as paymentRequestRelations } from '../shared/bank.DMsXwzJn.mjs';
 import '@develit-io/backend-sdk';
 import 'drizzle-orm/sqlite-core';
 import 'date-fns';

package/dist/export/worker.cjs

@@ -1,17 +1,17 @@
 'use strict';
 
 const backendSdk = require('@develit-io/backend-sdk');
-const database_schema = require('../shared/bank.o95cOH_P.cjs');
+const database_schema = require('../shared/bank.B5nOIsGC.cjs');
 const drizzleOrm = require('drizzle-orm');
 const cloudflare_workers = require('cloudflare:workers');
 const d1 = require('drizzle-orm/d1');
-const mock_connector = require('../shared/bank.DWsHTK_n.cjs');
+const mock_connector = require('../shared/bank.BMLgGhBY.cjs');
 require('jose');
 const zod = require('zod');
 const generalCodes = require('@develit-io/general-codes');
 require('date-fns');
 require('node:crypto');
-const credentialsResolver = require('../shared/bank.vGCuP898.cjs');
+const credentialsResolver = require('../shared/bank.f7ykgYdD.cjs');
 require('drizzle-orm/sqlite-core');
 require('drizzle-orm/relations');
 require('drizzle-zod');
@@ -353,7 +353,7 @@ function buildPaymentRequestEvent(pr) {
     metadata: {
       correlationId: pr.correlationId,
       entityId: pr.id,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      timestamp: /* @__PURE__ */ new Date()
     }
   };
 }
@@ -389,7 +389,7 @@ const authorizeAccountInputSchema = zod.z.object({
   syncIntervalS: zod.z.number().int().positive().optional(),
   startSync: zod.z.boolean().optional(),
   lastSyncAt: zod.z.date().optional(),
-  address: zod.z.string().optional()
+  address: backendSdk.structuredAddressSchema.optional()
 });
 
 const simulateDepositInputSchema = zod.z.object({
@@ -1189,7 +1189,7 @@ let BankServiceBase = class extends backendSdk.develitWorker(cloudflare_workers.
           metadata: {
             correlationId: createdPayment.correlationId,
             entityId: createdPayment.id,
-            timestamp: (/* @__PURE__ */ new Date()).toDateString()
+            timestamp: /* @__PURE__ */ new Date()
           }
         });
         return createdPayment;