@elevasis/core 0.1.0

package/src/auth/multi-tenancy/credentials/__tests__/encryption.test.ts

@@ -0,0 +1,216 @@
+import { describe, it, expect } from 'vitest'
+import { encryptCredential, decryptCredential } from '../server/encryption'
+
+// Note: SECRETS_ENCRYPTION_KEY is set in vitest.config.ts env section
+// The encryption module reads it at load time
+
+describe('Credential Encryption', () =>{
+
+  describe('encryptCredential', () => {
+    it('encrypts plaintext to base64-encoded JSON string', () => {
+      const plaintext = 'my-secret-api-key'
+      const encrypted = encryptCredential(plaintext)
+
+      // Should be a valid JSON string
+      expect(() => JSON.parse(encrypted)).not.toThrow()
+
+      const parsed = JSON.parse(encrypted)
+      expect(parsed).toHaveProperty('iv')
+      expect(parsed).toHaveProperty('authTag')
+      expect(parsed).toHaveProperty('data')
+    })
+
+    it('produces different ciphertext for same input (random IV)', () => {
+      const plaintext = 'same-secret'
+
+      const encrypted1 = encryptCredential(plaintext)
+      const encrypted2 = encryptCredential(plaintext)
+
+      // Different IVs mean different ciphertext
+      expect(encrypted1).not.toBe(encrypted2)
+
+      // But both decrypt to same plaintext
+      expect(decryptCredential(encrypted1)).toBe(plaintext)
+      expect(decryptCredential(encrypted2)).toBe(plaintext)
+    })
+
+    it('handles empty string', () => {
+      const plaintext = ''
+      const encrypted = encryptCredential(plaintext)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe('')
+    })
+
+    it('handles long strings', () => {
+      const plaintext = 'x'.repeat(10000)
+      const encrypted = encryptCredential(plaintext)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(plaintext)
+    })
+
+    it('handles special characters and unicode', () => {
+      const plaintext = 'Hello 世界! 🔐 Special chars: \n\t\r"\'\\`'
+      const encrypted = encryptCredential(plaintext)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(plaintext)
+    })
+
+    it('validates key is configured at module load', () => {
+      // We can't test missing key dynamically since MASTER_KEY is set at module load
+      // Instead, verify the key is set and encryption works
+      const encrypted = encryptCredential('test')
+      expect(encrypted).toBeDefined()
+    })
+  })
+
+  describe('decryptCredential', () => {
+    it('decrypts ciphertext back to original plaintext', () => {
+      const plaintext = 'my-secret-api-key'
+      const encrypted = encryptCredential(plaintext)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(plaintext)
+    })
+
+    it('successfully decrypts with configured key', () => {
+      const encrypted = encryptCredential('test')
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe('test')
+    })
+
+    it('throws error on malformed JSON', () => {
+      expect(() => decryptCredential('not-json')).toThrow()
+    })
+
+    it('throws error on missing fields', () => {
+      const invalidData = JSON.stringify({ iv: 'abc', authTag: 'def' }) // Missing 'data'
+
+      expect(() => decryptCredential(invalidData)).toThrow()
+    })
+
+    it('throws error on tampered ciphertext', () => {
+      const encrypted = encryptCredential('secret')
+      const parsed = JSON.parse(encrypted)
+
+      // Tamper with the data
+      parsed.data = 'tampered-data'
+      const tampered = JSON.stringify(parsed)
+
+      expect(() => decryptCredential(tampered)).toThrow()
+    })
+
+    it('throws error on tampered auth tag', () => {
+      const encrypted = encryptCredential('secret')
+      const parsed = JSON.parse(encrypted)
+
+      // Tamper with the auth tag
+      parsed.authTag = 'AAAAAAAAAAAAAAAAAAAAAA=='
+      const tampered = JSON.stringify(parsed)
+
+      expect(() => decryptCredential(tampered)).toThrow()
+    })
+
+    it('detects tampering via auth tag (GCM mode)', () => {
+      const encrypted = encryptCredential('secret')
+      const parsed = JSON.parse(encrypted)
+
+      // Tamper with just one byte of data
+      const dataBuffer = Buffer.from(parsed.data, 'base64')
+      dataBuffer[0] ^= 0x01 // Flip one bit
+      parsed.data = dataBuffer.toString('base64')
+
+      const tampered = JSON.stringify(parsed)
+
+      // GCM should detect the tampering and throw
+      expect(() => decryptCredential(tampered)).toThrow()
+    })
+
+    it('throws error on invalid base64 encoding', () => {
+      const invalidData = JSON.stringify({
+        iv: 'not-valid-base64!!!',
+        authTag: 'AAAA',
+        data: 'BBBB'
+      })
+
+      expect(() => decryptCredential(invalidData)).toThrow()
+    })
+  })
+
+  describe('Round-trip encryption/decryption', () => {
+    it('preserves API key format', () => {
+      const apiKey = 'sk_test_1234567890abcdefghijklmnopqrstuvwxyz'
+      const encrypted = encryptCredential(apiKey)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(apiKey)
+    })
+
+    it('preserves database connection strings', () => {
+      const connString = 'postgresql://user:password@localhost:5432/database?sslmode=require'
+      const encrypted = encryptCredential(connString)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(connString)
+    })
+
+    it('preserves JSON credentials', () => {
+      const jsonCreds = JSON.stringify({
+        type: 'service_account',
+        project_id: 'my-project',
+        private_key: '-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----\n'
+      })
+
+      const encrypted = encryptCredential(jsonCreds)
+      const decrypted = decryptCredential(encrypted)
+
+      expect(decrypted).toBe(jsonCreds)
+      expect(JSON.parse(decrypted)).toEqual(JSON.parse(jsonCreds))
+    })
+  })
+
+  describe('Security properties', () => {
+    it('uses AES-256-GCM (authenticated encryption)', () => {
+      const encrypted = encryptCredential('test')
+      const parsed = JSON.parse(encrypted)
+
+      // Auth tag should be present (GCM mode)
+      expect(parsed.authTag).toBeDefined()
+      expect(parsed.authTag.length).toBeGreaterThan(0)
+    })
+
+    it('uses random IV for each encryption', () => {
+      const ivs = new Set()
+
+      for (let i = 0; i < 100; i++) {
+        const encrypted = encryptCredential('test')
+        const parsed = JSON.parse(encrypted)
+        ivs.add(parsed.iv)
+      }
+
+      // All IVs should be unique
+      expect(ivs.size).toBe(100)
+    })
+
+    it('IV is 16 bytes (128 bits)', () => {
+      const encrypted = encryptCredential('test')
+      const parsed = JSON.parse(encrypted)
+
+      // Base64-encoded 16 bytes = 24 characters
+      const ivBuffer = Buffer.from(parsed.iv, 'base64')
+      expect(ivBuffer.length).toBe(16)
+    })
+
+    it('auth tag is 16 bytes (128 bits)', () => {
+      const encrypted = encryptCredential('test')
+      const parsed = JSON.parse(encrypted)
+
+      // Base64-encoded 16 bytes = 24 characters
+      const authTagBuffer = Buffer.from(parsed.authTag, 'base64')
+      expect(authTagBuffer.length).toBe(16)
+    })
+  })
+})

package/src/auth/multi-tenancy/credentials/__tests__/service.test.ts

@@ -0,0 +1,174 @@
+/**
+ * Credential service function tests
+ * Tests prepareCredentialForInsert and transformToMetadata with provider field
+ */
+
+import { describe, it, expect, vi } from 'vitest'
+import {
+  prepareCredentialForInsert,
+  transformToMetadata,
+  type CreateCredentialParams
+} from '../server/service'
+import type { Database } from '../../../../supabase/database.types'
+
+// Mock encryption module
+vi.mock('../server/encryption', () => ({
+  encryptCredential: vi.fn((value: string) => `encrypted:${value}`),
+  decryptCredential: vi.fn((value: string) => value.replace('encrypted:', ''))
+}))
+
+type CredentialRow = Database['public']['Tables']['credentials']['Row']
+
+describe('prepareCredentialForInsert', () => {
+  const baseParams: CreateCredentialParams = {
+    organizationId: 'org-123',
+    name: 'test-cred',
+    type: 'api-key',
+    value: { apiKey: 'secret-key' },
+    createdBy: 'user-456'
+  }
+
+  it('includes provider in insert data when provided', () => {
+    const params: CreateCredentialParams = {
+      ...baseParams,
+      type: 'oauth',
+      value: { accessToken: 'token', refreshToken: 'refresh' },
+      provider: 'dropbox'
+    }
+
+    const result = prepareCredentialForInsert(params)
+
+    expect(result.provider).toBe('dropbox')
+  })
+
+  it('sets provider to null when not provided', () => {
+    const result = prepareCredentialForInsert(baseParams)
+
+    expect(result.provider).toBeNull()
+  })
+
+  it('sets provider to null for non-OAuth credentials', () => {
+    const params: CreateCredentialParams = {
+      ...baseParams,
+      type: 'api-key',
+      // No provider field
+    }
+
+    const result = prepareCredentialForInsert(params)
+
+    expect(result.provider).toBeNull()
+  })
+
+  it('handles all OAuth provider values correctly', () => {
+    const providers = ['dropbox', 'notion', 'google-sheets']
+
+    for (const provider of providers) {
+      const params: CreateCredentialParams = {
+        ...baseParams,
+        type: 'oauth',
+        provider
+      }
+
+      const result = prepareCredentialForInsert(params)
+
+      expect(result.provider).toBe(provider)
+    }
+  })
+
+  it('encrypts credential value', () => {
+    const result = prepareCredentialForInsert(baseParams)
+
+    expect(result.encrypted_value).toContain('encrypted:')
+  })
+
+  it('includes all required fields for database insert', () => {
+    const params: CreateCredentialParams = {
+      ...baseParams,
+      provider: 'dropbox'
+    }
+
+    const result = prepareCredentialForInsert(params)
+
+    expect(result).toEqual({
+      organization_id: 'org-123',
+      name: 'test-cred',
+      type: 'api-key',
+      encrypted_value: expect.stringContaining('encrypted:'),
+      created_by: 'user-456',
+      provider: 'dropbox'
+    })
+  })
+})
+
+describe('transformToMetadata', () => {
+  const baseRow: CredentialRow = {
+    id: 'cred-123',
+    organization_id: 'org-456',
+    name: 'test-cred',
+    type: 'api-key',
+    provider: null,
+    encrypted_value: 'encrypted:value',
+    created_at: '2026-02-02T00:00:00.000Z',
+    updated_at: '2026-02-02T00:00:00.000Z',
+    created_by: 'user-789'
+  }
+
+  it('converts null provider to undefined', () => {
+    const result = transformToMetadata(baseRow)
+
+    expect(result.provider).toBeUndefined()
+  })
+
+  it('preserves provider when set', () => {
+    const row: CredentialRow = {
+      ...baseRow,
+      provider: 'dropbox'
+    }
+
+    const result = transformToMetadata(row)
+
+    expect(result.provider).toBe('dropbox')
+  })
+
+  it('handles all OAuth provider values', () => {
+    const providers = ['dropbox', 'notion', 'google-sheets']
+
+    for (const provider of providers) {
+      const row: CredentialRow = {
+        ...baseRow,
+        provider
+      }
+
+      const result = transformToMetadata(row)
+
+      expect(result.provider).toBe(provider)
+    }
+  })
+
+  it('returns correct metadata structure', () => {
+    const row: CredentialRow = {
+      ...baseRow,
+      provider: 'notion'
+    }
+
+    const result = transformToMetadata(row)
+
+    expect(result).toEqual({
+      id: 'cred-123',
+      name: 'test-cred',
+      type: 'api-key',
+      provider: 'notion',
+      createdAt: '2026-02-02T00:00:00.000Z'
+    })
+  })
+
+  it('excludes sensitive fields from metadata', () => {
+    const result = transformToMetadata(baseRow)
+
+    // These fields should not be in metadata
+    expect(result).not.toHaveProperty('encrypted_value')
+    expect(result).not.toHaveProperty('organization_id')
+    expect(result).not.toHaveProperty('created_by')
+    expect(result).not.toHaveProperty('updated_at')
+  })
+})

package/src/auth/multi-tenancy/credentials/index.ts

@@ -0,0 +1,6 @@
+// NOTE: Server-side code in ./server/ is intentionally NOT exported here
+// Encryption/decryption and server-side credential helpers should ONLY be used in API
+// Browser imports of @repo/core should not pull in Node.js crypto
+
+// Only export types that are safe for browser use
+export type { CreateCredentialParams, CredentialMetadata } from './server/service'

package/src/auth/multi-tenancy/credentials/server/encryption.ts

@@ -0,0 +1,39 @@
+import crypto from 'crypto'
+
+const MASTER_KEY = process.env.SECRETS_ENCRYPTION_KEY
+const ALGORITHM = 'aes-256-gcm'
+
+interface EncryptedData {
+  iv: string
+  authTag: string
+  data: string
+}
+
+export function encryptCredential(plaintext: string): string {
+  if (!MASTER_KEY) {
+    throw new Error('SECRETS_ENCRYPTION_KEY not configured')
+  }
+
+  const iv = crypto.randomBytes(16)
+  const cipher = crypto.createCipheriv(ALGORITHM, Buffer.from(MASTER_KEY, 'hex'), iv)
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
+  const authTag = cipher.getAuthTag()
+
+  return JSON.stringify({
+    iv: iv.toString('base64'),
+    authTag: authTag.toString('base64'),
+    data: encrypted.toString('base64')
+  })
+}
+
+export function decryptCredential(encrypted: string): string {
+  if (!MASTER_KEY) {
+    throw new Error('SECRETS_ENCRYPTION_KEY not configured')
+  }
+
+  const { iv, authTag, data } = JSON.parse(encrypted) as EncryptedData
+  const decipher = crypto.createDecipheriv(ALGORITHM, Buffer.from(MASTER_KEY, 'hex'), Buffer.from(iv, 'base64'))
+  decipher.setAuthTag(Buffer.from(authTag, 'base64'))
+
+  return Buffer.concat([decipher.update(Buffer.from(data, 'base64')), decipher.final()]).toString('utf8')
+}

package/src/auth/multi-tenancy/credentials/server/service.ts

@@ -0,0 +1,60 @@
+import type { Database } from '../../../../supabase/database.types'
+import { encryptCredential, decryptCredential } from './encryption'
+
+type CredentialInsert = Database['public']['Tables']['credentials']['Insert']
+type CredentialRow = Database['public']['Tables']['credentials']['Row']
+
+export interface CreateCredentialParams {
+  organizationId: string
+  name: string
+  type: string
+  value: Record<string, unknown>
+  createdBy: string | null
+  provider?: string // OAuth provider ID ('dropbox', 'notion', 'google-sheets')
+}
+
+export interface CredentialMetadata {
+  id: string
+  name: string
+  type: string
+  provider?: string // OAuth provider ID or undefined for non-OAuth
+  createdAt: string
+}
+
+/**
+ * Prepare credential data for insertion (encrypts the value)
+ */
+export function prepareCredentialForInsert(
+  params: CreateCredentialParams
+): Omit<CredentialInsert, 'id' | 'created_at' | 'updated_at'> {
+  const encrypted = encryptCredential(JSON.stringify(params.value))
+
+  return {
+    organization_id: params.organizationId,
+    name: params.name,
+    type: params.type,
+    encrypted_value: encrypted,
+    created_by: params.createdBy,
+    provider: params.provider ?? null // Store provider or null for non-OAuth
+  }
+}
+
+/**
+ * Decrypt credential value from database row
+ */
+export function decryptCredentialValue(encryptedValue: string): Record<string, unknown> {
+  return JSON.parse(decryptCredential(encryptedValue))
+}
+
+/**
+ * Transform database row to metadata (without decrypted value)
+ */
+export function transformToMetadata(row: CredentialRow): CredentialMetadata {
+  return {
+    id: row.id,
+    name: row.name,
+    type: row.type,
+    provider: row.provider ?? undefined, // Convert null to undefined
+    createdAt: row.created_at
+  }
+}

package/src/auth/multi-tenancy/index.ts

@@ -0,0 +1,17 @@
+// Config types
+export * from './types'
+
+// Organization types
+export * from './organizations/index'
+
+// User types
+export * from './users/index'
+
+// Membership types
+export * from './memberships/index'
+
+// Invitation types
+export * from './invitations/index'
+
+// Credentials types
+export * from './credentials/index'