@dynamatix/gb-schemas 0.21.15 → 0.21.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynamatix/gb-schemas",
-  "version": "0.21.15",
+  "version": "0.21.16",
   "description": "All the schemas for gatehouse bank back-end.",
   "main": "index.js",
   "scripts": {

package/utils/encryption.js

@@ -26,7 +26,26 @@ const isObjectIdOrArray = (value) => {
     return mongoose.isValidObjectId(value);
 };
 
-// Encrypt an object (excluding _id and ObjectId references)
+// **Deterministic IV Generation (for consistent encryption)**
+const deriveIV = (value) => {
+    const hash = crypto.createHash('sha256').update(value.toString()).digest();
+    return hash.slice(0, IV_LENGTH); // First 16 bytes as IV
+};
+
+// **Encrypt a Single Value Deterministically**
+const encryptValue = (value) => {
+    const iv = deriveIV(value); // Same IV for same value (allows searching)
+    const cipher = crypto.createCipheriv('aes-256-gcm', SECRET_KEY, iv);
+
+    let encrypted = cipher.update(JSON.stringify(value), 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+
+    const authTag = cipher.getAuthTag().toString('hex'); // Authentication tag
+
+    return `${iv.toString('hex')}:${authTag}:${encrypted}`;
+};
+
+// **Encrypt an Object (excluding ObjectId references & _id)**
 export const encryptObject = (obj, collectionName) => {
     if (EXCLUDED_COLLECTIONS.includes(collectionName) || !obj || typeof obj !== 'object') {
         return obj;
@@ -35,18 +54,13 @@ export const encryptObject = (obj, collectionName) => {
     let encryptedObj = {};
     for (const key in obj) {
         if (key === '_id' || isObjectIdOrArray(obj[key])) {
-            encryptedObj[key] = obj[key]; // Skip _id and ObjectIds
+            encryptedObj[key] = obj[key]; // Keep _id and ObjectId references unchanged
         } else {
             try {
-                const iv = crypto.randomBytes(IV_LENGTH);
-                const cipher = crypto.createCipheriv('aes-256-gcm', SECRET_KEY, iv);
-                let encrypted = cipher.update(JSON.stringify(obj[key]), 'utf8', 'hex');
-                encrypted += cipher.final('hex');
-                const authTag = cipher.getAuthTag().toString('hex');
-                encryptedObj[key] = `${iv.toString('hex')}:${authTag}:${encrypted}`;
+                encryptedObj[key] = encryptValue(obj[key]);
             } catch (error) {
-                console.error(`Encryption error for key ${key}:`, error);
-                encryptedObj[key] = obj[key]; // Store original value if encryption fails
+                console.error(`Encryption error for key "${key}":`, error);
+                encryptedObj[key] = obj[key]; // Fallback to original value
             }
         }
     }
@@ -54,7 +68,7 @@ export const encryptObject = (obj, collectionName) => {
     return encryptedObj;
 };
 
-// Decrypt an object (excluding _id and ObjectId references)
+// **Decrypt an Object (excluding ObjectId references & _id)**
 export const decryptObject = (obj, collectionName) => {
     if (EXCLUDED_COLLECTIONS.includes(collectionName) || !obj || typeof obj !== 'object') {
         return obj;
@@ -63,7 +77,7 @@ export const decryptObject = (obj, collectionName) => {
     let decryptedObj = {};
     for (const key in obj) {
         if (key === '_id' || isObjectIdOrArray(obj[key])) {
-            decryptedObj[key] = obj[key]; // Skip _id and ObjectIds
+            decryptedObj[key] = obj[key]; // Keep _id and ObjectId references unchanged
         } else {
             try {
                 const [ivHex, authTagHex, encryptedData] = obj[key].split(':');
@@ -75,11 +89,11 @@ export const decryptObject = (obj, collectionName) => {
                 decrypted += decipher.final('utf8');
                 decryptedObj[key] = JSON.parse(decrypted);
             } catch (error) {
-                console.error(`Decryption error for key ${key}:`, error);
-                decryptedObj[key] = obj[key]; // Store original value if decryption fails
+                console.error(`Decryption error for key "${key}":`, error);
+                decryptedObj[key] = obj[key]; // Fallback to original value
             }
         }
     }
 
     return decryptedObj;
-};
+};