@lazyapps/encryption 0.0.0-init.0 → 0.2.0-branch-feature-encryption-20260306195113

package/LICENSE

@@ -0,0 +1,15 @@
+ISC License
+
+Copyright (c) 2026, Oliver Sturm
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/encryption.js

@@ -41,9 +41,10 @@ export const createEncryption = ({
 
                 const shredIfForget = (evt) =>
                   evt.type === 'SUBJECT_FORGOTTEN'
-                    ? cachedKs
+                    ? (envelope.clearCachedDEKs(evt.payload.subjectId),
+                      cachedKs
                         .deleteKeysForSubject(evt.payload.subjectId)
-                        .then(() => evt)
+                        .then(() => evt))
                     : Promise.resolve(evt);
 
                 return fieldEncryptor
@@ -130,6 +131,7 @@ export const createEncryption = ({
 
         forgetSubject: (subjectId) => {
           log.info(`Forgetting subject: ${subjectId}`);
+          envelope.clearCachedDEKs(subjectId);
           return cachedKs.deleteKeysForSubject(subjectId);
         },
 

package/envelopeEncryption.js

@@ -1,35 +1,86 @@
 import { randomBytes } from 'node:crypto';
 
-export const createEnvelopeManager = (keyStore, contexts) => ({
-  getDEK: (subjectId, contextName, version) =>
-    keyStore.getDEK(subjectId, contextName, version).then((storedDEK) => {
-      if (!storedDEK) {
-        const newDEK = randomBytes(32);
-        return keyStore
-          .wrapDEK(contextName, newDEK)
-          .then((wrappedKey) => ({
-            key: newDEK,
-            version: 1,
-            wrappedKey,
-          }))
-          .then((dekInfo) =>
-            keyStore
-              .storeDEK(subjectId, contextName, dekInfo)
-              .then(() => dekInfo),
-          );
-      }
+export const createEnvelopeManager = (keyStore, contexts) => {
+  const dekCache = new Map();
+
+  const cacheKey = (subjectId, contextName) =>
+    `${subjectId}:${contextName}`;
+
+  const cacheDEK = (subjectId, contextName, dekInfo) => {
+    dekCache.set(cacheKey(subjectId, contextName), dekInfo);
+    return dekInfo;
+  };
+
+  return {
+    getDEK: (subjectId, contextName, version, wrappedKey) => {
+      const cached = dekCache.get(cacheKey(subjectId, contextName));
+      if (cached) return Promise.resolve(cached);
+
       return keyStore
-        .unwrapDEK(contextName, storedDEK.wrappedKey)
-        .then((plainDEK) => ({
-          key: plainDEK,
-          version: storedDEK.version,
-        }));
-    }),
+        .getDEK(subjectId, contextName, version)
+        .then((storedDEK) => {
+          if (storedDEK && storedDEK.forgotten) {
+            return Promise.reject(
+              Object.assign(
+                new Error(
+                  `Keys for subject ${subjectId} have been forgotten`,
+                ),
+                { code: 'SUBJECT_FORGOTTEN' },
+              ),
+            );
+          }
+          if (!storedDEK) {
+            if (wrappedKey) {
+              return keyStore
+                .unwrapDEK(contextName, wrappedKey)
+                .then((plainDEK) => ({
+                  key: plainDEK,
+                  version: version || 1,
+                  wrappedKey,
+                }))
+                .then((dekInfo) =>
+                  keyStore
+                    .storeDEK(subjectId, contextName, dekInfo)
+                    .then(() => cacheDEK(subjectId, contextName, dekInfo)),
+                );
+            }
+            const newDEK = randomBytes(32);
+            return keyStore
+              .wrapDEK(contextName, newDEK)
+              .then((wrappedKey) => ({
+                key: newDEK,
+                version: 1,
+                wrappedKey,
+              }))
+              .then((dekInfo) =>
+                keyStore
+                  .storeDEK(subjectId, contextName, dekInfo)
+                  .then(() => cacheDEK(subjectId, contextName, dekInfo)),
+              );
+          }
+          return keyStore
+            .unwrapDEK(contextName, storedDEK.wrappedKey)
+            .then((plainDEK) =>
+              cacheDEK(subjectId, contextName, {
+                key: plainDEK,
+                version: storedDEK.version,
+                wrappedKey: storedDEK.wrappedKey,
+              }),
+            );
+        });
+    },
+
+    clearCachedDEKs: (subjectId) => {
+      for (const key of dekCache.keys()) {
+        if (key.startsWith(`${subjectId}:`)) dekCache.delete(key);
+      }
+    },
 
-  rotateKEK: (contextName) =>
-    keyStore.rotateKEK
-      ? keyStore.rotateKEK(contextName)
-      : Promise.reject(
-          new Error('KEK rotation not supported by this key store tier'),
-        ),
-});
+    rotateKEK: (contextName) =>
+      keyStore.rotateKEK
+        ? keyStore.rotateKEK(contextName)
+        : Promise.reject(
+            new Error('KEK rotation not supported by this key store tier'),
+          ),
+  };
+};

package/fieldEncryption.js

@@ -56,6 +56,7 @@ export const createFieldEncryptor = (envelope, schema) => ({
               ctx: fieldConfig.context,
               kid: subjectId,
               kv: dek.version,
+              wk: dek.wrappedKey,
             };
             return setNestedValue(evt, fieldPath, encryptedField);
           });
@@ -86,10 +87,12 @@ export const createFieldEncryptor = (envelope, schema) => ({
             }
           }
 
-          return envelope.getDEK(value.kid, value.ctx, value.kv).then((dek) => {
-            const plaintext = decryptValue(dek.key, value);
-            return setNestedValue(evt, fieldPath, plaintext);
-          });
+          return envelope
+            .getDEK(value.kid, value.ctx, value.kv, value.wk)
+            .then((dek) => {
+              const plaintext = decryptValue(dek.key, value);
+              return setNestedValue(evt, fieldPath, plaintext);
+            });
         }),
       Promise.resolve(decrypted),
     );

package/keystores/inmemory.js

@@ -12,6 +12,7 @@ export const inMemoryKeyStore = (initialKEKs = {}) => ({
       ]),
     );
     const deks = new Map();
+    const forgotten = new Set();
 
     const wrapLocal = (kek, plainDEK) => {
       const iv = randomBytes(IV_LENGTH);
@@ -61,6 +62,8 @@ export const inMemoryKeyStore = (initialKEKs = {}) => ({
             ),
 
       getDEK: (subjectId, contextName) => {
+        if (forgotten.has(subjectId))
+          return Promise.resolve({ forgotten: true });
         const key = `${subjectId}:${contextName}`;
         return Promise.resolve(deks.get(key) || null);
       },
@@ -84,6 +87,7 @@ export const inMemoryKeyStore = (initialKEKs = {}) => ({
         for (const key of deks.keys()) {
           if (key.startsWith(`${subjectId}:`)) deks.delete(key);
         }
+        forgotten.add(subjectId);
         return Promise.resolve();
       },
 

package/keystores/mongo.js

@@ -53,6 +53,8 @@ export const mongoKeyStore = ({
       ? rootSecret
       : Buffer.from(rootSecret, 'base64');
 
+    const forgottenCollection = `${dekCollection}-forgotten`;
+
     return MongoClient.connect(url).then((client) => {
       const db = client.db(database);
       log.info(`Key store connected to ${database}`);
@@ -65,21 +67,30 @@ export const mongoKeyStore = ({
             unwrapLocal(deriveKEK(secret, contextName), wrappedDEK),
           ),
 
-        getDEK: (subjectId, contextName, version) => {
-          const filter = { subjectId, context: contextName };
-          if (version) filter.version = version;
-          return db
-            .collection(dekCollection)
-            .findOne(filter, { sort: { version: -1 } })
-            .then((doc) =>
-              doc
-                ? {
-                    wrappedKey: { iv: doc.iv, data: doc.data, tag: doc.tag },
-                    version: doc.version,
-                  }
-                : null,
-            );
-        },
+        getDEK: (subjectId, contextName, version) =>
+          db
+            .collection(forgottenCollection)
+            .findOne({ subjectId })
+            .then((forgotten) => {
+              if (forgotten) return { forgotten: true };
+              const filter = { subjectId, context: contextName };
+              if (version) filter.version = version;
+              return db
+                .collection(dekCollection)
+                .findOne(filter, { sort: { version: -1 } })
+                .then((doc) =>
+                  doc
+                    ? {
+                        wrappedKey: {
+                          iv: doc.iv,
+                          data: doc.data,
+                          tag: doc.tag,
+                        },
+                        version: doc.version,
+                      }
+                    : null,
+                );
+            }),
 
         storeDEK: (subjectId, contextName, dekInfo) =>
           db.collection(dekCollection).insertOne({
@@ -109,8 +120,13 @@ export const mongoKeyStore = ({
           const ksLog = getLogger('Encryption/KS', 'ADMIN');
           ksLog.info(`Deleting all keys for subject: ${subjectId}`);
           return db
-            .collection(dekCollection)
-            .deleteMany({ subjectId })
+            .collection(forgottenCollection)
+            .updateOne(
+              { subjectId },
+              { $set: { subjectId, deletedAt: Date.now() } },
+              { upsert: true },
+            )
+            .then(() => db.collection(dekCollection).deleteMany({ subjectId }))
             .then((result) => {
               ksLog.info(
                 `Deleted ${result.deletedCount} keys for ${subjectId}`,

package/keystores/vault.js

@@ -31,8 +31,10 @@ const authenticateAppRole = (vaultUrl, roleId, secretId) =>
 
 const initDekInMemory = () => {
   const deks = new Map();
+  const forgotten = new Set();
   return Promise.resolve({
     getDEK: (subjectId, contextName) => {
+      if (forgotten.has(subjectId)) return Promise.resolve({ forgotten: true });
       const key = `${subjectId}:${contextName}`;
       return Promise.resolve(deks.get(key) || null);
     },
@@ -53,6 +55,7 @@ const initDekInMemory = () => {
       for (const key of deks.keys()) {
         if (key.startsWith(`${subjectId}:`)) deks.delete(key);
       }
+      forgotten.add(subjectId);
       return Promise.resolve();
     },
     close: () => Promise.resolve(),
@@ -64,16 +67,22 @@ const initDekMongo = ({ url, database, collection }) =>
     MongoClient.connect(url).then((client) => {
       const db = client.db(database);
       const coll = db.collection(collection);
+      const forgottenColl = db.collection(`${collection}-forgotten`);
       return {
         getDEK: (subjectId, contextName) =>
-          coll
-            .findOne(
-              { subjectId, context: contextName },
-              { sort: { version: -1 } },
-            )
-            .then((doc) =>
-              doc ? { wrappedKey: doc.wrappedKey, version: doc.version } : null,
-            ),
+          forgottenColl.findOne({ subjectId }).then((forgotten) => {
+            if (forgotten) return { forgotten: true };
+            return coll
+              .findOne(
+                { subjectId, context: contextName },
+                { sort: { version: -1 } },
+              )
+              .then((doc) =>
+                doc
+                  ? { wrappedKey: doc.wrappedKey, version: doc.version }
+                  : null,
+              );
+          }),
         storeDEK: (subjectId, contextName, dekInfo) =>
           coll.insertOne({
             subjectId,
@@ -94,7 +103,14 @@ const initDekMongo = ({ url, database, collection }) =>
               })),
             ),
         deleteKeysForSubject: (subjectId) =>
-          coll.deleteMany({ subjectId }).then(() => {}),
+          forgottenColl
+            .updateOne(
+              { subjectId },
+              { $set: { subjectId, deletedAt: Date.now() } },
+              { upsert: true },
+            )
+            .then(() => coll.deleteMany({ subjectId }))
+            .then(() => {}),
         close: () => client.close(),
       };
     }),

package/package.json

@@ -1,15 +1,12 @@
 {
   "name": "@lazyapps/encryption",
-  "version": "0.0.0-init.0",
+  "version": "0.2.0-branch-feature-encryption-20260306195113",
   "description": "Field-level PII encryption with crypto-shredding for LazyApps event-sourcing",
   "main": "index.js",
   "files": [
     "*.js",
     "keystores/"
   ],
-  "scripts": {
-    "test": "vitest"
-  },
   "keywords": [
     "event-sourcing",
     "cqrs",
@@ -34,7 +31,7 @@
     "node": ">=18.20.3 || >=20.18.0"
   },
   "dependencies": {
-    "@lazyapps/logger": "workspace:^"
+    "@lazyapps/logger": "^0.2.0"
   },
   "peerDependencies": {
     "mongodb": "^6.0.0"
@@ -48,5 +45,8 @@
     "eslint": "^8.46.0",
     "vitest": "^4.0.18"
   },
-  "type": "module"
-}
+  "type": "module",
+  "scripts": {
+    "test": "vitest"
+  }
+}

package/queryDecryptor.js

@@ -38,7 +38,12 @@ export const createQueryDecryptor = (
             }
 
             return envelope
-              .getDEK(fieldValue.kid, fieldValue.ctx, fieldValue.kv)
+              .getDEK(
+                fieldValue.kid,
+                fieldValue.ctx,
+                fieldValue.kv,
+                fieldValue.wk,
+              )
               .then((dek) => ({
                 ...d,
                 [fieldName]: decryptValue(dek.key, fieldValue),

package/storageEncryption.js

@@ -29,6 +29,7 @@ export const createStorageEncryptor = (
                 ctx: fieldConfig.context,
                 kid: subjectId,
                 kv: dek.version,
+                wk: dek.wrappedKey,
               },
             }));
         }),