npm - @mdguggenbichler/slugbase-core - Versions diffs - 0.0.1 - Mend

@mdguggenbichler/slugbase-core 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (381) hide show

package/backend/dist/utils/email.js ADDED Viewed

@@ -0,0 +1,456 @@
+import nodemailer from 'nodemailer';
+import { queryOne } from '../db/index.js';
+import { decrypt } from './encryption.js';
+/**
+ * Escape HTML to prevent XSS attacks
+ */
+function escapeHtml(unsafe) {
+    return unsafe
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#039;');
+}
+/**
+ * Validate and escape URL for safe use in HTML href attributes
+ * Note: href attributes need the URL as-is (not HTML-escaped) but display text should be escaped
+ */
+function safeUrlForHref(url) {
+    // URL should already be validated before being passed here
+    // For href attributes, we can use the URL directly since it's validated
+    // But we'll double-check it doesn't contain javascript: or data: protocols
+    const lowerUrl = url.toLowerCase().trim();
+    if (lowerUrl.startsWith('javascript:') || lowerUrl.startsWith('data:') || lowerUrl.startsWith('vbscript:')) {
+        // This should never happen if validation is working, but be defensive
+        return '#';
+    }
+    return url;
+}
+/** Primary brand color (blue-600) matching app style */
+const PRIMARY_BLUE = '#2563eb';
+function getFrontendUrl() {
+    return (process.env.FRONTEND_URL || 'http://localhost:3000').replace(/\/$/, '');
+}
+/**
+ * Build a consistent email layout with header (logo + SlugBase), content, and footer.
+ */
+function buildEmailLayout(options) {
+    const { contentHtml, title = 'SlugBase', footerMessage = 'This is an automated message from SlugBase. Please do not reply to this email.', includeLegalFooter = false, } = options;
+    const frontendUrl = getFrontendUrl();
+    const logoUrl = `${frontendUrl}/slugbase_icon_white.svg`;
+    const legalFooterHtml = includeLegalFooter
+        ? ` &middot; <a href="${frontendUrl}/imprint" style="color: #6b7280; text-decoration: underline;">Imprint</a> &middot; <a href="${frontendUrl}/privacy" style="color: #6b7280; text-decoration: underline;">Privacy</a>`
+        : '';
+    return `<!DOCTYPE html>
+<html lang="en" xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <meta http-equiv="X-UA-Compatible" content="IE=edge">
+  <meta name="x-apple-disable-message-reformatting">
+  <title>${escapeHtml(title)}</title>
+  <!--[if mso]>
+  <noscript>
+    <xml>
+      <o:OfficeDocumentSettings>
+        <o:PixelsPerInch>96</o:PixelsPerInch>
+      </o:OfficeDocumentSettings>
+    </xml>
+  </noscript>
+  <![endif]-->
+</head>
+<body style="margin: 0; padding: 0; background-color: #f4f4f4; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif;">
+  <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%" style="background-color: #f4f4f4;">
+    <tr>
+      <td align="center" style="padding: 40px 20px;">
+        <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="600" style="max-width: 600px; background-color: #ffffff; border-radius: 8px; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
+          <!-- Header -->
+          <tr>
+            <td style="padding: 32px 40px; text-align: center; background-color: ${PRIMARY_BLUE}; border-radius: 8px 8px 0 0;">
+              <img src="${logoUrl}" alt="SlugBase" width="40" height="40" style="display: inline-block; vertical-align: middle; margin-right: 10px;" />
+              <h1 style="margin: 0; display: inline-block; vertical-align: middle; color: #ffffff; font-size: 28px; font-weight: 600; letter-spacing: -0.5px;">SlugBase</h1>
+            </td>
+          </tr>
+          <!-- Content -->
+          <tr>
+            <td style="padding: 40px;">
+              ${contentHtml}
+            </td>
+          </tr>
+          <!-- Footer -->
+          <tr>
+            <td style="padding: 30px 40px; background-color: #f9fafb; border-top: 1px solid #e5e7eb; border-radius: 0 0 8px 8px;">
+              <p style="margin: 0; color: #9ca3af; font-size: 12px; line-height: 1.6; text-align: center;">${footerMessage}${legalFooterHtml}</p>
+            </td>
+          </tr>
+        </table>
+      </td>
+    </tr>
+  </table>
+</body>
+</html>`;
+}
+/**
+ * Get SMTP configuration from system settings (SELFHOSTED only).
+ * Returns config object or null with error message.
+ */
+async function getSMTPConfig() {
+    try {
+        const enabled = await queryOne('SELECT value FROM system_config WHERE key = ?', ['smtp_enabled']);
+        if (!enabled || enabled.value !== 'true') {
+            return { config: null, error: 'SMTP is not enabled' };
+        }
+        const host = await queryOne('SELECT value FROM system_config WHERE key = ?', ['smtp_host']);
+        const port = await queryOne('SELECT value FROM system_config WHERE key = ?', ['smtp_port']);
+        const secure = await queryOne('SELECT value FROM system_config WHERE key = ?', ['smtp_secure']);
+        const user = await queryOne('SELECT value FROM system_config WHERE key = ?', ['smtp_user']);
+        const password = await queryOne('SELECT value FROM system_config WHERE key = ?', ['smtp_password']);
+        const from = await queryOne('SELECT value FROM system_config WHERE key = ?', ['smtp_from']);
+        const fromName = await queryOne('SELECT value FROM system_config WHERE key = ?', ['smtp_from_name']);
+        if (!host)
+            return { config: null, error: 'SMTP host is not configured' };
+        if (!port)
+            return { config: null, error: 'SMTP port is not configured' };
+        if (!user)
+            return { config: null, error: 'SMTP user is not configured' };
+        if (!password)
+            return { config: null, error: 'SMTP password is not configured' };
+        if (!from)
+            return { config: null, error: 'SMTP from email is not configured' };
+        const hostValue = String(host.value).trim();
+        const userValue = String(user.value).trim();
+        const passwordValue = String(password.value).trim();
+        const fromValue = String(from.value).trim();
+        if (!hostValue)
+            return { config: null, error: 'SMTP host is empty' };
+        if (!userValue)
+            return { config: null, error: 'SMTP user is empty' };
+        if (!passwordValue)
+            return { config: null, error: 'SMTP password is empty' };
+        if (!fromValue)
+            return { config: null, error: 'SMTP from email is empty' };
+        let decryptedPassword = passwordValue;
+        try {
+            decryptedPassword = decrypt(passwordValue);
+        }
+        catch (error) {
+            console.warn('SMTP password decryption failed, using as plain text:', error.message);
+            decryptedPassword = passwordValue;
+        }
+        const trimmedPassword = decryptedPassword ? decryptedPassword.trim() : '';
+        if (!trimmedPassword) {
+            console.error('SMTP password validation failed: password is empty');
+            return { config: null, error: 'SMTP password is empty. Please set a password in the SMTP settings.' };
+        }
+        return {
+            config: {
+                host: hostValue,
+                port: parseInt(String(port.value)) || 587,
+                secure: secure?.value === 'true' || false,
+                auth: { user: userValue, password: trimmedPassword },
+                from: fromValue,
+                fromName: String(fromName?.value || 'SlugBase'),
+            },
+        };
+    }
+    catch (error) {
+        console.error('Error getting SMTP config:', error);
+        return { config: null, error: `Error retrieving SMTP config: ${error.message}` };
+    }
+}
+/**
+ * Send email using SMTP (self-hosted).
+ */
+export async function sendEmail(to, subject, html, text) {
+    try {
+        const { config, error } = await getSMTPConfig();
+        if (!config) {
+            return { success: false, error: error || 'SMTP not configured or not enabled' };
+        }
+        // Validate auth credentials before creating transporter
+        if (!config.auth || !config.auth.user || !config.auth.password) {
+            return { success: false, error: 'SMTP auth credentials are missing' };
+        }
+        const authUser = config.auth.user.trim();
+        const authPassword = config.auth.password.trim();
+        if (!authUser || !authPassword) {
+            console.error('SMTP auth validation failed: credentials are empty');
+            return { success: false, error: 'SMTP auth credentials are empty' };
+        }
+        const transportConfig = {
+            host: config.host,
+            port: config.port,
+            secure: config.secure,
+            auth: { user: authUser, pass: authPassword },
+        };
+        console.log('Creating SMTP transporter with:', { host: config.host, port: config.port, secure: config.secure });
+        const transporter = nodemailer.createTransport(transportConfig);
+        const stripHtml = (htmlContent) => {
+            if (htmlContent.length > 100000)
+                htmlContent = htmlContent.substring(0, 100000);
+            return htmlContent.replace(/<[^>]{0,1000}>/g, '');
+        };
+        const info = await transporter.sendMail({
+            from: `"${config.fromName}" <${config.from}>`,
+            to,
+            subject,
+            text: text || stripHtml(html),
+            html,
+        });
+        console.log('Email sent:', info.messageId);
+        return { success: true };
+    }
+    catch (error) {
+        console.error('Error sending email:', error);
+        return { success: false, error: error.message || 'Unknown error sending email' };
+    }
+}
+/**
+ * Send password reset email
+ */
+export async function sendPasswordResetEmail(email, resetToken, resetUrl) {
+    const safeHrefUrl = safeUrlForHref(resetUrl);
+    const escapedDisplayUrl = escapeHtml(resetUrl);
+    const subject = 'Password Reset Request - SlugBase';
+    const contentHtml = `
+    <h2 style="margin: 0 0 20px; color: #1a1a1a; font-size: 24px; font-weight: 600; line-height: 1.3;">Password Reset Request</h2>
+    <p style="margin: 0 0 20px; color: #4a4a4a; font-size: 16px; line-height: 1.6;">You requested to reset your password for your SlugBase account. Click the button below to create a new password:</p>
+    <table role="presentation" cellspacing="0" cellpadding="0" border="0" style="margin: 30px 0;">
+      <tr>
+        <td align="center" style="padding: 0;">
+          <a href="${safeHrefUrl}" style="display: inline-block; padding: 14px 32px; background-color: ${PRIMARY_BLUE}; color: #ffffff; text-decoration: none; border-radius: 6px; font-size: 16px; font-weight: 600; text-align: center; box-shadow: 0 2px 4px rgba(37, 99, 235, 0.3);">Reset Password</a>
+        </td>
+      </tr>
+    </table>
+    <p style="margin: 20px 0; color: #6b7280; font-size: 14px; line-height: 1.6;">Or copy and paste this link into your browser:</p>
+    <p style="margin: 0 0 30px; padding: 12px; background-color: #f9fafb; border-radius: 4px; word-break: break-all; color: #4a4a4a; font-size: 13px; font-family: 'Courier New', monospace; line-height: 1.5;">${escapedDisplayUrl}</p>
+    <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%" style="margin: 30px 0; background-color: #fef3c7; border-left: 4px solid #f59e0b; border-radius: 4px;">
+      <tr>
+        <td style="padding: 16px;">
+          <p style="margin: 0; color: #92400e; font-size: 14px; line-height: 1.6; font-weight: 500;">⚠️ This link will expire in 1 hour for security reasons.</p>
+        </td>
+      </tr>
+    </table>
+    <p style="margin: 30px 0 0; color: #6b7280; font-size: 14px; line-height: 1.6;">If you did not request a password reset, please ignore this email. Your password will remain unchanged.</p>
+  `;
+    const html = buildEmailLayout({
+        contentHtml,
+        title: 'Password Reset Request',
+        includeLegalFooter: true,
+    });
+    const result = await sendEmail(email, subject, html);
+    return result.success;
+}
+/**
+ * Send email verification email
+ */
+export async function sendEmailVerificationEmail(email, verificationToken, verificationUrl, newEmail) {
+    const safeHrefUrl = safeUrlForHref(verificationUrl);
+    const escapedDisplayUrl = escapeHtml(verificationUrl);
+    const escapedNewEmail = escapeHtml(newEmail);
+    const subject = 'Verify Your New Email Address - SlugBase';
+    const contentHtml = `
+    <h2 style="margin: 0 0 20px; color: #1a1a1a; font-size: 24px; font-weight: 600; line-height: 1.3;">Verify Your New Email Address</h2>
+    <p style="margin: 0 0 20px; color: #4a4a4a; font-size: 16px; line-height: 1.6;">You requested to change your email address to <strong style="color: #1a1a1a;">${escapedNewEmail}</strong>. Click the button below to verify and complete the change:</p>
+    <table role="presentation" cellspacing="0" cellpadding="0" border="0" style="margin: 30px 0;">
+      <tr>
+        <td align="center" style="padding: 0;">
+          <a href="${safeHrefUrl}" style="display: inline-block; padding: 14px 32px; background-color: ${PRIMARY_BLUE}; color: #ffffff; text-decoration: none; border-radius: 6px; font-size: 16px; font-weight: 600; text-align: center; box-shadow: 0 2px 4px rgba(37, 99, 235, 0.3);">Verify Email Address</a>
+        </td>
+      </tr>
+    </table>
+    <p style="margin: 20px 0; color: #6b7280; font-size: 14px; line-height: 1.6;">Or copy and paste this link into your browser:</p>
+    <p style="margin: 0 0 30px; padding: 12px; background-color: #f9fafb; border-radius: 4px; word-break: break-all; color: #4a4a4a; font-size: 13px; font-family: 'Courier New', monospace; line-height: 1.5;">${escapedDisplayUrl}</p>
+    <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%" style="margin: 30px 0; background-color: #dbeafe; border-left: 4px solid ${PRIMARY_BLUE}; border-radius: 4px;">
+      <tr>
+        <td style="padding: 16px;">
+          <p style="margin: 0; color: #1e40af; font-size: 14px; line-height: 1.6; font-weight: 500;">ℹ️ This link will expire in 24 hours for security reasons.</p>
+        </td>
+      </tr>
+    </table>
+    <p style="margin: 30px 0 0; color: #6b7280; font-size: 14px; line-height: 1.6;">If you did not request this email change, please ignore this email. Your email address will remain unchanged.</p>
+  `;
+    const html = buildEmailLayout({
+        contentHtml,
+        title: 'Verify Your New Email Address',
+        includeLegalFooter: true,
+    });
+    const result = await sendEmail(email, subject, html);
+    return result.success;
+}
+/**
+ * Send contact form confirmation to the customer
+ */
+export async function sendContactConfirmationEmail(email, name) {
+    const escapedName = escapeHtml(name);
+    const escapedEmail = escapeHtml(email);
+    const subject = 'We received your message - SlugBase';
+    const contentHtml = `
+    <h2 style="margin: 0 0 20px; color: #1a1a1a; font-size: 24px; font-weight: 600;">We received your message</h2>
+    <p style="margin: 0 0 20px; color: #4a4a4a; font-size: 16px; line-height: 1.6;">Hi ${escapedName},</p>
+    <p style="margin: 0 0 20px; color: #4a4a4a; font-size: 16px; line-height: 1.6;">Thank you for reaching out! We have received your message and will get back to you at ${escapedEmail} as soon as possible.</p>
+    <p style="margin: 30px 0 0; color: #6b7280; font-size: 14px; line-height: 1.6;">Best regards,<br>The SlugBase Team</p>
+  `;
+    const html = buildEmailLayout({
+        contentHtml,
+        title: 'Message Received',
+        footerMessage: 'This is an automated confirmation from SlugBase.',
+        includeLegalFooter: true,
+    });
+    const result = await sendEmail(email, subject, html);
+    return result.success;
+}
+/**
+ * Send contact form submission to the configured recipient
+ */
+export async function sendContactFormNotification(recipient, data) {
+    const escapedName = escapeHtml(data.name);
+    const escapedEmail = escapeHtml(data.email);
+    const escapedMessage = escapeHtml(data.message).replace(/\n/g, '<br>');
+    const subject = `Contact Form: Message from ${escapedName}`;
+    const contentHtml = `
+    <h2 style="margin: 0 0 20px; color: #1a1a1a; font-size: 24px; font-weight: 600;">New Contact Form Submission</h2>
+    <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%" style="margin: 0 0 20px; background-color: #f9fafb; border-radius: 6px; border: 1px solid #e5e7eb;">
+      <tr>
+        <td style="padding: 16px;">
+          <p style="margin: 0 0 8px; color: #6b7280; font-size: 12px; font-weight: 600; text-transform: uppercase;">Name</p>
+          <p style="margin: 0; color: #1a1a1a; font-size: 16px;">${escapedName}</p>
+        </td>
+      </tr>
+      <tr>
+        <td style="padding: 16px; border-top: 1px solid #e5e7eb;">
+          <p style="margin: 0 0 8px; color: #6b7280; font-size: 12px; font-weight: 600; text-transform: uppercase;">Email</p>
+          <p style="margin: 0;"><a href="mailto:${escapedEmail}" style="color: ${PRIMARY_BLUE}; text-decoration: none;">${escapedEmail}</a></p>
+        </td>
+      </tr>
+      <tr>
+        <td style="padding: 16px; border-top: 1px solid #e5e7eb;">
+          <p style="margin: 0 0 8px; color: #6b7280; font-size: 12px; font-weight: 600; text-transform: uppercase;">Message</p>
+          <p style="margin: 0; color: #1a1a1a; font-size: 16px; line-height: 1.6; white-space: pre-wrap;">${escapedMessage}</p>
+        </td>
+      </tr>
+    </table>
+    <p style="margin: 20px 0 0; color: #9ca3af; font-size: 12px;">Submitted via SlugBase contact form</p>
+  `;
+    const html = buildEmailLayout({
+        contentHtml,
+        title: 'Contact Form Submission',
+        footerMessage: 'This is an automated notification from SlugBase.',
+        includeLegalFooter: false,
+    });
+    const result = await sendEmail(recipient, subject, html);
+    return result.success;
+}
+/**
+ * Send signup verification email.
+ */
+export async function sendSignupVerificationEmail(email, verificationUrl) {
+    const safeHrefUrl = safeUrlForHref(verificationUrl);
+    const escapedDisplayUrl = escapeHtml(verificationUrl);
+    const subject = 'Verify your SlugBase account';
+    const contentHtml = `
+    <h2 style="margin: 0 0 20px; color: #1a1a1a; font-size: 24px; font-weight: 600;">Verify your account</h2>
+    <p style="margin: 0 0 20px; color: #4a4a4a; font-size: 16px; line-height: 1.6;">Thanks for signing up. Click the button below to verify your email and start using SlugBase:</p>
+    <table role="presentation" cellspacing="0" cellpadding="0" border="0" style="margin: 30px 0;">
+      <tr>
+        <td align="center" style="padding: 0;">
+          <a href="${safeHrefUrl}" style="display: inline-block; padding: 14px 32px; background-color: ${PRIMARY_BLUE}; color: #ffffff; text-decoration: none; border-radius: 6px; font-size: 16px; font-weight: 600;">Verify email</a>
+        </td>
+      </tr>
+    </table>
+    <p style="margin: 20px 0; color: #6b7280; font-size: 14px;">Or copy and paste this link into your browser:</p>
+    <p style="margin: 0 0 30px; padding: 12px; background-color: #f9fafb; border-radius: 4px; word-break: break-all; color: #4a4a4a; font-size: 13px; font-family: monospace;">${escapedDisplayUrl}</p>
+    <p style="margin: 0; color: #6b7280; font-size: 14px;">This link expires in 24 hours. If you did not sign up for SlugBase, you can ignore this email.</p>
+  `;
+    const html = buildEmailLayout({
+        contentHtml,
+        title: 'Verify your SlugBase account',
+        includeLegalFooter: true,
+    });
+    const result = await sendEmail(email, subject, html);
+    return result.success;
+}
+/**
+ * Test SMTP configuration
+ */
+export async function testSMTPConfig(testEmail) {
+    try {
+        const { config, error } = await getSMTPConfig();
+        if (!config) {
+            return { success: false, error: error || 'SMTP not configured or not enabled' };
+        }
+        const escapedTestEmail = escapeHtml(testEmail);
+        const subject = 'SMTP Test Email - SlugBase';
+        const sentDate = new Date().toLocaleString('en-US', {
+            weekday: 'long',
+            year: 'numeric',
+            month: 'long',
+            day: 'numeric',
+            hour: '2-digit',
+            minute: '2-digit',
+            timeZoneName: 'short',
+        });
+        const contentHtml = `
+    <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%" style="margin: 0 0 30px; background-color: #d1fae5; border-left: 4px solid #10b981; border-radius: 4px;">
+      <tr>
+        <td style="padding: 20px; text-align: center;">
+          <p style="margin: 0; color: #065f46; font-size: 48px; line-height: 1;">✓</p>
+        </td>
+      </tr>
+    </table>
+    <h2 style="margin: 0 0 20px; color: #1a1a1a; font-size: 24px; font-weight: 600; line-height: 1.3; text-align: center;">SMTP Configuration Test</h2>
+    <p style="margin: 0 0 30px; color: #4a4a4a; font-size: 16px; line-height: 1.6; text-align: center;">If you received this email, your SMTP configuration is working correctly!</p>
+    <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%" style="margin: 30px 0; background-color: #f9fafb; border-radius: 6px; border: 1px solid #e5e7eb;">
+      <tr>
+        <td style="padding: 20px;">
+          <table role="presentation" cellspacing="0" cellpadding="0" border="0" width="100%">
+            <tr>
+              <td style="padding: 0 0 12px; color: #6b7280; font-size: 12px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.5px;">Test Details</td>
+            </tr>
+            <tr>
+              <td style="padding: 0 0 8px; color: #1a1a1a; font-size: 14px; line-height: 1.6;">
+                <strong style="color: #4a4a4a;">Sent at:</strong> ${sentDate}
+              </td>
+            </tr>
+            <tr>
+              <td style="padding: 0; color: #1a1a1a; font-size: 14px; line-height: 1.6;">
+                <strong style="color: #4a4a4a;">Recipient:</strong> ${escapedTestEmail}
+              </td>
+            </tr>
+          </table>
+        </td>
+      </tr>
+    </table>
+    <p style="margin: 30px 0 0; color: #6b7280; font-size: 14px; line-height: 1.6; text-align: center;">Your email server is properly configured and ready to send emails from SlugBase.</p>
+    `;
+        const html = buildEmailLayout({
+            contentHtml,
+            title: 'SMTP Test Email',
+            footerMessage: 'This is a test email from SlugBase. Your SMTP configuration is working correctly.',
+            includeLegalFooter: false,
+        });
+        const result = await sendEmail(testEmail, subject, html);
+        if (result.success) {
+            return { success: true };
+        }
+        else {
+            return { success: false, error: result.error || 'Failed to send test email' };
+        }
+    }
+    catch (error) {
+        return { success: false, error: error.message || 'Unknown error' };
+    }
+}
+//# sourceMappingURL=email.js.map

package/backend/dist/utils/email.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/utils/email.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE1C;;GAEG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,MAAM;SACV,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,2DAA2D;IAC3D,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3G,sEAAsE;QACtE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,MAAM,YAAY,GAAG,SAAS,CAAC;AAE/B,SAAS,cAAc;IACrB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AASD;;GAEG;AACH,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,EACJ,WAAW,EACX,KAAK,GAAG,UAAU,EAClB,aAAa,GAAG,gFAAgF,EAChG,kBAAkB,GAAG,KAAK,GAC3B,GAAG,OAAO,CAAC;IACZ,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,WAAW,0BAA0B,CAAC;IAEzD,MAAM,eAAe,GAAG,kBAAkB;QACxC,CAAC,CAAC,sBAAsB,WAAW,+FAA+F,WAAW,2EAA2E;QACxN,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO;;;;;;;WAOE,UAAU,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;mFAkBuD,YAAY;0BACrE,OAAO;;;;;;;gBAOjB,WAAW;;;;;;6GAMkF,aAAa,GAAG,eAAe;;;;;;;;QAQpI,CAAC;AACT,CAAC;AAcD;;;GAGG;AACH,KAAK,UAAU,aAAa;IAC1B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,+CAA+C,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,OAAO,IAAK,OAAe,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;YAClD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,+CAA+C,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,+CAA+C,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,+CAA+C,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,+CAA+C,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,+CAA+C,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QACpG,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,+CAA+C,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,+CAA+C,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAErG,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QACzE,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QACzE,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACjF,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QAE/E,MAAM,SAAS,GAAG,MAAM,CAAE,IAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,MAAM,CAAE,IAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,aAAa,GAAG,MAAM,CAAE,QAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAE,IAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAErD,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACrE,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;QACrE,IAAI,CAAC,aAAa;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC;QAC7E,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;QAE3E,IAAI,iBAAiB,GAAG,aAAa,CAAC;QACtC,IAAI,CAAC;YACH,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,OAAO,CAAC,IAAI,CAAC,uDAAuD,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrF,iBAAiB,GAAG,aAAa,CAAC;QACpC,CAAC;QAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACpE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,qEAAqE,EAAE,CAAC;QACxG,CAAC;QAED,OAAO;YACL,MAAM,EAAE;gBACN,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAE,IAAY,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG;gBAClD,MAAM,EAAG,MAAc,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK;gBAClD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE;gBACpD,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,MAAM,CAAE,QAAgB,EAAE,KAAK,IAAI,UAAU,CAAC;aACzD;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,iCAAiC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAU,EAAE,OAAe,EAAE,IAAY,EAAE,IAAa;IACtF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,oCAAoC,EAAE,CAAC;QAClF,CAAC;QAED,wDAAwD;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,mCAAmC,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEjD,IAAI,CAAC,QAAQ,IAAI,CAAC,YAAY,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACpE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC;QACtE,CAAC;QAED,MAAM,eAAe,GAAG;YACtB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE;SAC7C,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,iCAAiC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,MAAM,WAAW,GAAG,UAAU,CAAC,eAAe,CAAC,eAAe,CAAC,CAAC;QAEhE,MAAM,SAAS,GAAG,CAAC,WAAmB,EAAU,EAAE;YAChD,IAAI,WAAW,CAAC,MAAM,GAAG,MAAM;gBAAE,WAAW,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAChF,OAAO,WAAW,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC;YACtC,IAAI,EAAE,IAAI,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,IAAI,GAAG;YAC7C,EAAE;YACF,OAAO;YACP,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC;YAC7B,IAAI;SACL,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,6BAA6B,EAAE,CAAC;IACnF,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAgB;IAC9F,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,iBAAiB,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAE/C,MAAM,OAAO,GAAG,mCAAmC,CAAC;IACpD,MAAM,WAAW,GAAG;;;;;;;qBAOD,WAAW,yEAAyE,YAAY;;;;;;kNAM6F,iBAAiB;;;;;;;;;;;GAWhO,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,WAAW;QACX,KAAK,EAAE,wBAAwB;QAC/B,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAAa,EAAE,iBAAyB,EAAE,eAAuB,EAAE,QAAgB;IAClI,MAAM,WAAW,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,0CAA0C,CAAC;IAC3D,MAAM,WAAW,GAAG;;oKAE8I,eAAe;;;;;qBAK9J,WAAW,yEAAyE,YAAY;;;;;;kNAM6F,iBAAiB;;kKAEjE,YAAY;;;;;;;;;GAS3K,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,WAAW;QACX,KAAK,EAAE,+BAA+B;QACtC,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAQD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAAa,EAAE,IAAY;IAC5E,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAEvC,MAAM,OAAO,GAAG,qCAAqC,CAAC;IACtD,MAAM,WAAW,GAAG;;yFAEmE,WAAW;4KACwE,YAAY;;GAErL,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,WAAW;QACX,KAAK,EAAE,kBAAkB;QACzB,aAAa,EAAE,kDAAkD;QACjE,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,SAAiB,EAAE,IAAqB;IACxF,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEvE,MAAM,OAAO,GAAG,8BAA8B,WAAW,EAAE,CAAC;IAC5D,MAAM,WAAW,GAAG;;;;;;mEAM6C,WAAW;;;;;;kDAM5B,YAAY,mBAAmB,YAAY,6BAA6B,YAAY;;;;;;4GAM1B,cAAc;;;;;GAKvH,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,WAAW;QACX,KAAK,EAAE,yBAAyB;QAChC,aAAa,EAAE,kDAAkD;QACjE,kBAAkB,EAAE,KAAK;KAC1B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAAa,EAAE,eAAuB;IACtF,MAAM,WAAW,GAAG,cAAc,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,8BAA8B,CAAC;IAC/C,MAAM,WAAW,GAAG;;;;;;qBAMD,WAAW,yEAAyE,YAAY;;;;;iLAK4D,iBAAiB;;GAE/L,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,WAAW;QACX,KAAK,EAAE,8BAA8B;QACrC,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAiB;IACpD,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,oCAAoC,EAAE,CAAC;QAClF,CAAC;QAED,MAAM,gBAAgB,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,4BAA4B,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE;YAClD,OAAO,EAAE,MAAM;YACf,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,MAAM;YACb,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;oEAqB4C,QAAQ;;;;;sEAKN,gBAAgB;;;;;;;;;KASjF,CAAC;QAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC;YAC5B,WAAW;YACX,KAAK,EAAE,iBAAiB;YACxB,aAAa,EAAE,mFAAmF;YAClG,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,2BAA2B,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,IAAI,eAAe,EAAE,CAAC;IACrE,CAAC;AACH,CAAC"}

package/backend/dist/utils/encryption.d.ts ADDED Viewed

@@ -0,0 +1,18 @@
+/**
+ * Encrypt sensitive data
+ * @param text - Plain text to encrypt
+ * @returns Encrypted string in format: salt:iv:tag:encryptedData (all hex encoded)
+ */
+export declare function encrypt(text: string): string;
+/**
+ * Decrypt sensitive data
+ * @param encryptedText - Encrypted string in format: salt:iv:tag:encryptedData
+ * @returns Decrypted plain text
+ */
+export declare function decrypt(encryptedText: string): string;
+/**
+ * Generate a secure encryption key (for use in ENCRYPTION_KEY env var)
+ * @returns Hex-encoded 32-byte key
+ */
+export declare function generateEncryptionKey(): string;
+//# sourceMappingURL=encryption.d.ts.map

package/backend/dist/utils/encryption.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../src/utils/encryption.ts"],"names":[],"mappings":"AAoCA;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAqB5C;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAkCrD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C"}

package/backend/dist/utils/encryption.js ADDED Viewed

@@ -0,0 +1,95 @@
+import crypto from 'crypto';
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16;
+const SALT_LENGTH = 64;
+const TAG_LENGTH = 16;
+const KEY_LENGTH = 32;
+/**
+ * Get encryption key from environment variable
+ * ENCRYPTION_KEY is validated at startup via validateEnvironmentVariables()
+ * This will throw if not set, preventing insecure defaults
+ */
+function getEncryptionKey() {
+    const key = process.env.ENCRYPTION_KEY;
+    if (!key) {
+        throw new Error('ENCRYPTION_KEY environment variable is required. Please set it before starting the server.');
+    }
+    // If key is provided as hex string (64 chars = 32 bytes), convert it
+    if (key.length === 64) {
+        try {
+            return Buffer.from(key, 'hex');
+        }
+        catch (error) {
+            throw new Error('ENCRYPTION_KEY must be a valid hex string (64 characters) or a string of at least 32 characters');
+        }
+    }
+    // Otherwise, derive key from the provided string
+    if (key.length < 32) {
+        throw new Error('ENCRYPTION_KEY must be at least 32 characters long');
+    }
+    return crypto.scryptSync(key, 'slugbase-salt', KEY_LENGTH);
+}
+/**
+ * Encrypt sensitive data
+ * @param text - Plain text to encrypt
+ * @returns Encrypted string in format: salt:iv:tag:encryptedData (all hex encoded)
+ */
+export function encrypt(text) {
+    if (!text) {
+        return text;
+    }
+    const key = getEncryptionKey();
+    const iv = crypto.randomBytes(IV_LENGTH);
+    const salt = crypto.randomBytes(SALT_LENGTH);
+    // Derive key from master key and salt
+    const derivedKey = crypto.scryptSync(key, salt, KEY_LENGTH);
+    const cipher = crypto.createCipheriv(ALGORITHM, derivedKey, iv);
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    const tag = cipher.getAuthTag();
+    // Return format: salt:iv:tag:encryptedData
+    return `${salt.toString('hex')}:${iv.toString('hex')}:${tag.toString('hex')}:${encrypted}`;
+}
+/**
+ * Decrypt sensitive data
+ * @param encryptedText - Encrypted string in format: salt:iv:tag:encryptedData
+ * @returns Decrypted plain text
+ */
+export function decrypt(encryptedText) {
+    if (!encryptedText) {
+        return encryptedText;
+    }
+    // Check if this is already decrypted (for migration purposes)
+    // Encrypted strings have the format: salt:iv:tag:data (all hex, separated by colons)
+    const parts = encryptedText.split(':');
+    if (parts.length !== 4) {
+        // Assume it's plain text (for backward compatibility during migration)
+        return encryptedText;
+    }
+    try {
+        const [saltHex, ivHex, tagHex, encrypted] = parts;
+        const salt = Buffer.from(saltHex, 'hex');
+        const iv = Buffer.from(ivHex, 'hex');
+        const tag = Buffer.from(tagHex, 'hex');
+        const key = getEncryptionKey();
+        const derivedKey = crypto.scryptSync(key, salt, KEY_LENGTH);
+        const decipher = crypto.createDecipheriv(ALGORITHM, derivedKey, iv);
+        decipher.setAuthTag(tag);
+        let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    catch (error) {
+        // If decryption fails, assume it's plain text (for migration)
+        console.warn('Decryption failed, assuming plain text:', error);
+        return encryptedText;
+    }
+}
+/**
+ * Generate a secure encryption key (for use in ENCRYPTION_KEY env var)
+ * @returns Hex-encoded 32-byte key
+ */
+export function generateEncryptionKey() {
+    return crypto.randomBytes(KEY_LENGTH).toString('hex');
+}
+//# sourceMappingURL=encryption.js.map

package/backend/dist/utils/encryption.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/utils/encryption.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;GAIG;AACH,SAAS,gBAAgB;IACvB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACvC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IAED,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAE7C,sCAAsC;IACtC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAE5D,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAEhE,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEjC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEhC,2CAA2C;IAC3C,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,aAAqB;IAC3C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,8DAA8D;IAC9D,qFAAqF;IACrF,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,uEAAuE;QACvE,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEvC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAEzB,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,8DAA8D;QAC9D,OAAO,CAAC,IAAI,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC"}

package/backend/dist/utils/env-validation.d.ts ADDED Viewed

@@ -0,0 +1,6 @@
+/**
+ * Environment variable validation
+ * Ensures all required security-related environment variables are set
+ */
+export declare function validateEnvironmentVariables(): void;
+//# sourceMappingURL=env-validation.d.ts.map

package/backend/dist/utils/env-validation.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"env-validation.d.ts","sourceRoot":"","sources":["../../src/utils/env-validation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAgB,4BAA4B,IAAI,IAAI,CAgDnD"}