@dynamatix/gb-schemas 0.16.2 → 0.17.0

package/index.js

@@ -3,4 +3,6 @@ export * from './shared/index.js';
 export * from './properties/index.js';
 export * from './applicants/index.js';
 export * from './users/index.js';
-export * from './product-catalogues/index.js';
+export * from './product-catalogues/index.js';
+
+export * from './utils/encryption.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamatix/gb-schemas",
-  "version": "0.16.2",
+  "version": "0.17.0",
   "description": "All the schemas for gatehouse bank back-end.",
   "main": "index.js",
   "scripts": {

package/utils/encryption.js

@@ -0,0 +1,72 @@
+import crypto from 'crypto';
+import dotenv from 'dotenv';
+
+dotenv.config();
+
+const SECRET_KEY = Buffer.from(process.env.ENCRYPTION_KEY, 'hex'); // 32 bytes for AES-256
+const IV_LENGTH = 16; // AES-GCM IV length
+const EXCLUDED_COLLECTIONS = process.env.EXCLUDED_COLLECTIONS?.split(",") || []; // Excluded collections from encryption
+
+// Encrypt an object (ignores _id and fields from excluded collections)
+export const encryptObject = (obj, collectionName) => {
+    // Skip encryption if the collection is excluded
+    if (EXCLUDED_COLLECTIONS.includes(collectionName)) {
+        return obj;
+    }
+
+    if (!obj || typeof obj !== "object") return obj;
+    let encryptedObj = {};
+
+    for (const key in obj) {
+        if (key === "_id") {
+            encryptedObj[key] = obj[key]; // Don't encrypt _id
+        } else {
+            const iv = crypto.randomBytes(IV_LENGTH); // Generate IV
+            const cipher = crypto.createCipheriv("aes-256-gcm", SECRET_KEY, iv);
+
+            let encrypted = cipher.update(JSON.stringify(obj[key]), 'utf8', 'hex');
+            encrypted += cipher.final('hex');
+
+            const authTag = cipher.getAuthTag().toString('hex'); // Get auth tag for integrity check
+
+            encryptedObj[key] = `${iv.toString('hex')}:${authTag}:${encrypted}`;
+        }
+    }
+
+    return encryptedObj;
+};
+
+// Decrypt an object (ignores _id and fields from excluded collections)
+export const decryptObject = (obj, collectionName) => {
+    // Skip decryption if the collection is excluded
+    if (EXCLUDED_COLLECTIONS.includes(collectionName)) {
+        return obj;
+    }
+
+    if (!obj || typeof obj !== "object") return obj;
+    let decryptedObj = {};
+
+    for (const key in obj) {
+        if (key === "_id") {
+            decryptedObj[key] = obj[key]; // Don't decrypt _id
+        } else {
+            try {
+                const [ivHex, authTagHex, encryptedData] = obj[key].split(':');
+                const iv = Buffer.from(ivHex, 'hex');
+                const authTag = Buffer.from(authTagHex, 'hex');
+
+                const decipher = crypto.createDecipheriv("aes-256-gcm", SECRET_KEY, iv);
+                decipher.setAuthTag(authTag);
+
+                let decrypted = decipher.update(encryptedData, 'hex', 'utf8');
+                decrypted += decipher.final('utf8');
+
+                decryptedObj[key] = JSON.parse(decrypted);
+            } catch (error) {
+                decryptedObj[key] = obj[key]; // Return original if decryption fails
+            }
+        }
+    }
+
+    return decryptedObj;
+};