@dynamatix/gb-schemas 0.21.14 → 0.21.16

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@dynamatix/gb-schemas",
-  "version": "0.21.14",
-  "description": "All the schemas for gatehouse bank back-end",
+  "version": "0.21.16",
+  "description": "All the schemas for gatehouse bank back-end.",
   "main": "index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"

package/utils/encryption.js

@@ -26,7 +26,26 @@ const isObjectIdOrArray = (value) => {
     return mongoose.isValidObjectId(value);
 };
 
-// Encrypt an object (excluding _id and ObjectId references)
+// **Deterministic IV Generation (for consistent encryption)**
+const deriveIV = (value) => {
+    const hash = crypto.createHash('sha256').update(value.toString()).digest();
+    return hash.slice(0, IV_LENGTH); // First 16 bytes as IV
+};
+
+// **Encrypt a Single Value Deterministically**
+const encryptValue = (value) => {
+    const iv = deriveIV(value); // Same IV for same value (allows searching)
+    const cipher = crypto.createCipheriv('aes-256-gcm', SECRET_KEY, iv);
+
+    let encrypted = cipher.update(JSON.stringify(value), 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+
+    const authTag = cipher.getAuthTag().toString('hex'); // Authentication tag
+
+    return `${iv.toString('hex')}:${authTag}:${encrypted}`;
+};
+
+// **Encrypt an Object (excluding ObjectId references & _id)**
 export const encryptObject = (obj, collectionName) => {
     if (EXCLUDED_COLLECTIONS.includes(collectionName) || !obj || typeof obj !== 'object') {
         return obj;
@@ -35,18 +54,13 @@ export const encryptObject = (obj, collectionName) => {
     let encryptedObj = {};
     for (const key in obj) {
         if (key === '_id' || isObjectIdOrArray(obj[key])) {
-            encryptedObj[key] = obj[key]; // Skip _id and ObjectIds
+            encryptedObj[key] = obj[key]; // Keep _id and ObjectId references unchanged
         } else {
             try {
-                const iv = crypto.randomBytes(IV_LENGTH);
-                const cipher = crypto.createCipheriv('aes-256-gcm', SECRET_KEY, iv);
-                let encrypted = cipher.update(JSON.stringify(obj[key]), 'utf8', 'hex');
-                encrypted += cipher.final('hex');
-                const authTag = cipher.getAuthTag().toString('hex');
-                encryptedObj[key] = `${iv.toString('hex')}:${authTag}:${encrypted}`;
+                encryptedObj[key] = encryptValue(obj[key]);
             } catch (error) {
-                console.error(`Encryption error for key ${key}:`, error);
-                encryptedObj[key] = obj[key]; // Store original value if encryption fails
+                console.error(`Encryption error for key "${key}":`, error);
+                encryptedObj[key] = obj[key]; // Fallback to original value
             }
         }
     }
@@ -54,7 +68,7 @@ export const encryptObject = (obj, collectionName) => {
     return encryptedObj;
 };
 
-// Decrypt an object (excluding _id and ObjectId references)
+// **Decrypt an Object (excluding ObjectId references & _id)**
 export const decryptObject = (obj, collectionName) => {
     if (EXCLUDED_COLLECTIONS.includes(collectionName) || !obj || typeof obj !== 'object') {
         return obj;
@@ -63,7 +77,7 @@ export const decryptObject = (obj, collectionName) => {
     let decryptedObj = {};
     for (const key in obj) {
         if (key === '_id' || isObjectIdOrArray(obj[key])) {
-            decryptedObj[key] = obj[key]; // Skip _id and ObjectIds
+            decryptedObj[key] = obj[key]; // Keep _id and ObjectId references unchanged
         } else {
             try {
                 const [ivHex, authTagHex, encryptedData] = obj[key].split(':');
@@ -75,11 +89,11 @@ export const decryptObject = (obj, collectionName) => {
                 decrypted += decipher.final('utf8');
                 decryptedObj[key] = JSON.parse(decrypted);
             } catch (error) {
-                console.error(`Decryption error for key ${key}:`, error);
-                decryptedObj[key] = obj[key]; // Store original value if decryption fails
+                console.error(`Decryption error for key "${key}":`, error);
+                decryptedObj[key] = obj[key]; // Fallback to original value
             }
         }
     }
 
     return decryptedObj;
-};
+};

package/utils/encryption.middleware.js

@@ -7,7 +7,7 @@ dotenv.config();
 const EXCLUDED_COLLECTIONS = process.env.EXCLUDED_COLLECTIONS?.split(",") || [];
 
 export default function mongooseEncryption(schema, options) {
-    console.log("========MONGOOSE ENCRYPTION IS IN PROGRESS========");
+    console.log("========MONGOOSE ENCRYPTION IS IN PROGRESS");
 
     const collectionName = options?.collection || schema.options.collection;
 
@@ -16,74 +16,90 @@ export default function mongooseEncryption(schema, options) {
         return;
     }
 
-    // ** Encrypt query parameters before execution **
+    // Encrypt query parameters before execution
     schema.pre(['find', 'findOne', 'findById'], function (next) {
-        const query = this.getQuery();
-        this.setQuery(encryptObject(query, collectionName));
+        this.getQuery(); // Ensure the query is processed
+        const encryptedQuery = encryptObject(this.getQuery(), collectionName);
+        this.setQuery(encryptedQuery);
         next();
     });
 
-    // ** Decrypt result after querying **
-    schema.post(['find', 'findOne', 'findById'], function (docs) {
-        if (Array.isArray(docs)) {
-            docs.forEach((doc) => doc && Object.assign(doc, decryptObject(doc.toObject(), collectionName)));
-        } else if (docs) {
-            Object.assign(docs, decryptObject(docs.toObject(), collectionName));
-        }
-    });
 
-    // ** Encrypt before saving (insert, update) **
-    schema.pre(['save', 'create'], function (next) {
-        this.set(encryptObject(this.toObject(), collectionName));
+    // Encrypt before saving (e.g., insert, update)
+    schema.pre(['save','create'], function (next) {
+        // Encrypt the document before saving to the database
+        this.set(encryptObject(this.toObject(), collectionName)); // Encrypt the document
         next();
     });
 
-    // ** Encrypt update operations **
-    schema.pre(['updateOne', 'findOneAndUpdate'], function (next) {
-        const update = this.getUpdate();
-        if (update) {
-            this.setUpdate(encryptObject(update, collectionName));
+    // Encrypt before update operations (single or multiple documents)
+    schema.pre("update", function (result) {
+        if (Array.isArray(result)) {
+            result.forEach(doc => doc.set(decryptObject(doc.toObject(), collectionName)));
+        } else {
+            result.set(encryptObject(result.toObject(), collectionName)); // Decrypt single document
         }
-        next();
     });
 
-    // ** Encrypt before bulkWrite operations **
-    schema.pre("bulkWrite", function (next) {
-        const operations = this.getUpdate();
-        if (operations) {
-            operations.forEach((operation) => {
-                if (operation.insertOne?.document) {
-                    operation.insertOne.document = encryptObject(operation.insertOne.document, collectionName);
-                } else if (operation.updateOne?.update) {
-                    operation.updateOne.update = encryptObject(operation.updateOne.update, collectionName);
-                } else if (operation.updateMany?.update) {
-                    operation.updateMany.update = encryptObject(operation.updateMany.update, collectionName);
-                }
-            });
+    // Encrypt after updateOne operations
+    schema.pre(["updateOne","findOneAndUpdate"], function (result) {
+        if (result && result.toObject) {
+            result.set(encryptObject(result.toObject(), collectionName)); // Decrypt single document
         }
+    });
+
+    // Encrypt before bulkWrite operations
+    schema.pre("bulkWrite", function (next, operations) {
+        operations.forEach(operation => {
+            if (operation.insertOne && operation.insertOne.document) {
+                operation.insertOne.document = encryptObject(operation.insertOne.document, collectionName);
+            } else if (operation.updateOne && operation.updateOne.update) {
+                operation.updateOne.update = encryptObject(operation.updateOne.update, collectionName);
+            } else if (operation.updateMany && operation.updateMany.update) {
+                operation.updateMany.update = encryptObject(operation.updateMany.update, collectionName);
+            }
+        });
         next();
     });
+    
 
-    // ** Decrypt after creating a document **
-    schema.post("create", function (docs) {
+    // Decrypt result after querying
+    schema.post(['find', 'findOne', 'findById'], function (docs) {
         if (Array.isArray(docs)) {
-            docs.forEach((doc) => Object.assign(doc, decryptObject(doc.toObject(), collectionName)));
+            docs.forEach((doc) => doc && doc.set(decryptObject(doc.toObject(), collectionName)));
+        } else if (docs) {
+            docs.set(decryptObject(docs.toObject(), collectionName));
+        }
+    });
+
+    // Decrypt after update operations (single or multiple documents)
+    schema.post("update", function (result) {
+        if (Array.isArray(result)) {
+            result.forEach(doc => doc.set(decryptObject(doc.toObject(), collectionName)));
         } else {
-            Object.assign(docs, decryptObject(docs.toObject(), collectionName));
+            result.set(decryptObject(result.toObject(), collectionName)); // Decrypt single document
         }
     });
 
-    // ** Decrypt after update operations **
-    schema.post(["updateOne", "findOneAndUpdate"], function (result) {
+    // Decrypt after updateOne operations
+    schema.post("updateOne", function (result) {
         if (result && result.toObject) {
-            Object.assign(result, decryptObject(result.toObject(), collectionName));
+            result.set(decryptObject(result.toObject(), collectionName)); // Decrypt single document
         }
     });
 
-    // ** Decrypt after findOneAndUpdate, findOneAndDelete, deleteOne, remove **
-    schema.post(["findOneAndUpdate", "findOneAndDelete", "deleteOne"], function (doc) {
+
+    // Decrypt after findOneAndUpdate operations
+    schema.post(["findOneAndUpdate","findOneAndDelete","deleteOne","remove"], function (doc) {
         if (doc) {
-            Object.assign(doc, decryptObject(doc.toObject(), collectionName));
+            doc.set(decryptObject(doc.toObject(), collectionName)); // Decrypt single document
+        }
+    });
+
+    // Decrypt after deleteMany operations
+    schema.post("deleteMany", function (result) {
+        if (Array.isArray(result)) {
+            result.forEach(doc => doc.set(decryptObject(doc.toObject(), collectionName))); // Decrypt document fields
         }
     });
 }