@erosolaraijs/cure 2.3.1 → 2.5.0

package/src/compliance/hipaa.ts

@@ -14,7 +14,7 @@
  * Administrative and physical safeguards must be implemented organizationally.
  */
 
-import { createHash, createCipheriv, createDecipheriv, randomBytes, scrypt } from 'crypto';
+import { createHash, createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'crypto';
 import { EventEmitter } from 'events';
 
 // ═══════════════════════════════════════════════════════════════════════════════
@@ -1240,26 +1240,18 @@ export class HIPAAComplianceService extends EventEmitter {
     return `KEY-${Date.now()}-${randomBytes(4).toString('hex')}`;
   }
 
-  private async initializeEncryptionKey(keyId?: string): Promise<void> {
+  private initializeEncryptionKey(keyId?: string): void {
     const id = keyId || this.activeKeyId;
 
     // In production, this would use a proper key management system (KMS)
     // For now, derive from a master secret
     const masterSecret = process.env.HIPAA_MASTER_KEY || 'DEFAULT_DEV_KEY_CHANGE_IN_PRODUCTION';
+    const derivedKey = scryptSync(masterSecret, id, 32);
 
-    return new Promise((resolve, reject) => {
-      scrypt(masterSecret, id, 32, (err, derivedKey) => {
-        if (err) {
-          reject(err);
-        } else {
-          this.encryptionKeys.set(id, {
-            key: derivedKey,
-            createdAt: new Date(),
-            active: true
-          });
-          resolve();
-        }
-      });
+    this.encryptionKeys.set(id, {
+      key: derivedKey,
+      createdAt: new Date(),
+      active: true
     });
   }