@lowerdeck/encryption 1.0.0

package/.turbo/turbo-test.log

@@ -0,0 +1,11 @@
+
+$ vitest run --passWithNoTests
+[?25l
+ RUN  v3.2.4 /Users/tobias/code/metorial/metorial-enterprise/oss/src/packages/backend/encryption
+
+No test files found, exiting with code 0
+
+include: **/*.{test,spec}.?(c|m)[jt]s?(x)
+exclude:  **/node_modules/**, **/dist/**, **/cypress/**, **/.{idea,git,cache,output,temp}/**, **/{karma,rollup,webpack,vite,vitest,jest,ava,babel,nyc,cypress,tsup,build,eslint,prettier}.config.*
+
+[?25h

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@lowerdeck/encryption",
+  "version": "1.0.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "author": "Tobias Herber",
+  "license": "Apache 2",
+  "type": "module",
+  "source": "src/index.ts",
+  "exports": {
+    "types": "./dist/index.d.ts",
+    "require": "./dist/index.cjs",
+    "import": "./dist/index.module.js",
+    "default": "./dist/index.modern.js"
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.module.js",
+  "types": "dist/index.d.ts",
+  "unpkg": "./dist/index.umd.js",
+  "scripts": {
+    "test": "vitest run --passWithNoTests",
+    "lint": "prettier src/**/*.ts --check",
+    "build": "microbundle"
+  },
+  "dependencies": {
+    "@lowerdeck/base62": "^1.0.0",
+    "@lowerdeck/id": "^1.0.0",
+    "base-x": "^5.0.0"
+  },
+  "devDependencies": {
+    "@lowerdeck/tsconfig": "^1.0.0",
+    "typescript": "5.8.2",
+    "vitest": "^3.1.2"
+  }
+}

package/src/base86.ts

@@ -0,0 +1,11 @@
+import baseX from 'base-x';
+
+let internal = baseX(
+  '!#$%()*+-.0123456789:;=?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_abcdefghijklmnopqrstuvwxyz{|}~§'
+);
+
+export let base86 = {
+  encode: (input: string | Uint8Array) =>
+    internal.encode(typeof input == 'string' ? new TextEncoder().encode(input) : input),
+  decode: (input: string) => internal.decode(input)
+};

package/src/crypto.ts

@@ -0,0 +1,71 @@
+import { base62 } from '@metorial/base62';
+import { base86 } from './base86';
+
+let enc = new TextEncoder();
+let dec = new TextDecoder();
+
+let getPasswordKey = (password: string) =>
+  crypto.subtle.importKey('raw', enc.encode(password), 'PBKDF2', false, ['deriveKey']);
+
+let deriveKey = (passwordKey: CryptoKey, keyUsage: ('encrypt' | 'decrypt')[]) =>
+  crypto.subtle.deriveKey(
+    {
+      name: 'PBKDF2',
+      iterations: 250000,
+      hash: 'SHA-256'
+    },
+    passwordKey,
+    { name: 'AES-GCM', length: 256 },
+    false,
+    keyUsage
+  );
+
+let encryptData = async (secretData: string, password: string) => {
+  let iv = crypto.getRandomValues(new Uint8Array(12));
+  let passwordKey = await getPasswordKey(password);
+  let aesKey = await deriveKey(passwordKey, ['encrypt']);
+  let encryptedContent = await crypto.subtle.encrypt(
+    {
+      name: 'AES-GCM',
+      iv
+    },
+    aesKey,
+    enc.encode(secretData)
+  );
+
+  let encryptedContentArr = new Uint8Array(encryptedContent);
+  let buff = new Uint8Array(iv.byteLength + encryptedContentArr.byteLength);
+  buff.set(iv, 0);
+  buff.set(encryptedContentArr, iv.byteLength);
+
+  return base86.encode(buff);
+};
+
+let decryptData = async (encryptedData: string, password: string) => {
+  let encryptedDataBuff = base86.decode(encryptedData);
+  let iv = encryptedDataBuff.slice(0, 16);
+  let data = encryptedDataBuff.slice(16);
+  let passwordKey = await getPasswordKey(password);
+  let aesKey = await deriveKey(passwordKey, ['decrypt']);
+  let decryptedContent = await crypto.subtle.decrypt(
+    {
+      name: 'AES-GCM',
+      iv
+    },
+    aesKey,
+    data
+  );
+
+  return dec.decode(decryptedContent);
+};
+
+let sha512 = async (data: string) => {
+  let hashBuffer = await crypto.subtle.digest('SHA-512', enc.encode(data));
+  return base62.encode(new Uint8Array(hashBuffer));
+};
+
+export let secretsCrypto = {
+  encrypt: encryptData,
+  decrypt: decryptData,
+  sha512
+};

package/src/index.ts

@@ -0,0 +1,28 @@
+import { generatePlainId } from '@metorial/id';
+import { secretsCrypto } from './crypto';
+
+export class Encryption {
+  constructor(private readonly password: string) {}
+
+  private async getPassword(entityId: string) {
+    return (await secretsCrypto.sha512(`${entityId}${this.password!}`)).slice(0, 50);
+  }
+
+  async encrypt(input: { secret: string; entityId: string }) {
+    return await secretsCrypto.encrypt(
+      JSON.stringify({
+        id: generatePlainId(10),
+        key: input.secret
+      }),
+      await this.getPassword(input.entityId)
+    );
+  }
+
+  async decrypt(info: { encrypted: string; entityId: string }) {
+    let content = JSON.parse(
+      await secretsCrypto.decrypt(info.encrypted, await this.getPassword(info.entityId))
+    );
+
+    return content.key;
+  }
+}

package/tsconfig.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "extends": "@metorial/tsconfig/base.json",
+  "exclude": ["dist"],
+  "compilerOptions": {
+    "outDir": "dist"
+  }
+}