@metamask/profile-sync-controller 3.0.0 → 3.1.1

package/dist/shared/encryption/cache.cjs

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setCachedKey = exports.getAnyCachedKey = exports.getCachedKeyBySalt = void 0;
+exports.setCachedKey = exports.getCachedKeyGeneratedWithSharedSalt = exports.getCachedKeyBySalt = void 0;
+const constants_1 = require("./constants.cjs");
 const utils_1 = require("./utils.cjs");
 const MAX_PASSWORD_CACHES = 100;
 const MAX_SALT_CACHES = 100;
@@ -31,29 +32,26 @@ function getCachedKeyBySalt(hashedPassword, salt) {
 }
 exports.getCachedKeyBySalt = getCachedKeyBySalt;
 /**
- * Gets any cached key for a given hashed password
+ * Gets the cached key that was generated without a salt, if it exists.
+ * This is unique per hashed password.
  *
  * @param hashedPassword - hashed password for cache lookup
- * @returns any (the first) cached key
+ * @returns the cached key
  */
-function getAnyCachedKey(hashedPassword) {
+function getCachedKeyGeneratedWithSharedSalt(hashedPassword) {
     const cache = getPasswordCache(hashedPassword);
-    // Takes 1 item from an Iterator via Map.entries()
-    const cachedEntry = cache
-        .entries()
-        .next().value;
-    if (!cachedEntry) {
+    const base64Salt = (0, utils_1.byteArrayToBase64)(constants_1.SHARED_SALT);
+    const cachedKey = cache.get(base64Salt);
+    if (!cachedKey) {
         return undefined;
     }
-    const base64Salt = cachedEntry[0];
-    const bytesSalt = (0, utils_1.base64ToByteArray)(base64Salt);
     return {
-        salt: bytesSalt,
+        salt: constants_1.SHARED_SALT,
         base64Salt,
-        key: cachedEntry[1],
+        key: cachedKey,
     };
 }
-exports.getAnyCachedKey = getAnyCachedKey;
+exports.getCachedKeyGeneratedWithSharedSalt = getCachedKeyGeneratedWithSharedSalt;
 /**
  * Sets a key to the in memory cache.
  * We have set an arbitrary size of 10 cached keys per hashed password.

package/dist/shared/encryption/cache.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"cache.cjs","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":";;;AAAA,uCAA+D;AAQ/D,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,eAAe,GAAG,GAAG,CAAC;AAQ5B,IAAI,cAAc,GAAyB,EAAE,CAAC;AAC9C,MAAM,gBAAgB,GAAG,CAAC,cAAsB,EAAE,EAAE;IAClD,cAAc,CAAC,cAAc,MAA7B,cAAc,CAAC,cAAc,IAAM,IAAI,GAAG,EAAE,EAAC;IAC7C,OAAO,cAAc,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAChC,cAAsB,EACtB,IAAgB;IAEhB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE;QACd,OAAO,SAAS,CAAC;KAClB;IAED,OAAO;QACL,IAAI;QACJ,UAAU;QACV,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAhBD,gDAgBC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAC7B,cAAsB;IAEtB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAE/C,kDAAkD;IAClD,MAAM,WAAW,GAAqC,KAAK;SACxD,OAAO,EAAE;SACT,IAAI,EAAE,CAAC,KAAK,CAAC;IAEhB,IAAI,CAAC,WAAW,EAAE;QAChB,OAAO,SAAS,CAAC;KAClB;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAA,yBAAiB,EAAC,UAAU,CAAC,CAAC;IAChD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,UAAU;QACV,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;KACpB,CAAC;AACJ,CAAC;AArBD,0CAqBC;AAED;;;;;;;GAOG;AACH,SAAgB,YAAY,CAC1B,cAAsB,EACtB,IAAgB,EAChB,GAAe;IAEf,sBAAsB;IACtB,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE;QAC5D,cAAc,GAAG,EAAE,CAAC;KACrB;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,CAAC;IAE3C,kBAAkB;IAClB,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,EAAE;QAChC,KAAK,CAAC,KAAK,EAAE,CAAC;KACf;IAED,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAnBD,oCAmBC","sourcesContent":["import { base64ToByteArray, byteArrayToBase64 } from './utils';\n\ntype CachedEntry = {\n  salt: Uint8Array;\n  base64Salt: string;\n  key: Uint8Array;\n};\n\nconst MAX_PASSWORD_CACHES = 100;\nconst MAX_SALT_CACHES = 100;\n\n/**\n * In-Memory Caching derived keys based from a given salt and password.\n */\ntype PasswordMemCachedKDF = {\n  [hashedPassword: string]: Map<string, Uint8Array>;\n};\nlet inMemCachedKDF: PasswordMemCachedKDF = {};\nconst getPasswordCache = (hashedPassword: string) => {\n  inMemCachedKDF[hashedPassword] ??= new Map();\n  return inMemCachedKDF[hashedPassword];\n};\n\n/**\n * Returns a given cached derived key from a hashed password and salt\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - provide salt to receive cached key\n * @returns cached key\n */\nexport function getCachedKeyBySalt(\n  hashedPassword: string,\n  salt: Uint8Array,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n  const cachedKey = cache.get(base64Salt);\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Gets any cached key for a given hashed password\n *\n * @param hashedPassword - hashed password for cache lookup\n * @returns any (the first) cached key\n */\nexport function getAnyCachedKey(\n  hashedPassword: string,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n\n  // Takes 1 item from an Iterator via Map.entries()\n  const cachedEntry: [string, Uint8Array] | undefined = cache\n    .entries()\n    .next().value;\n\n  if (!cachedEntry) {\n    return undefined;\n  }\n\n  const base64Salt = cachedEntry[0];\n  const bytesSalt = base64ToByteArray(base64Salt);\n  return {\n    salt: bytesSalt,\n    base64Salt,\n    key: cachedEntry[1],\n  };\n}\n\n/**\n * Sets a key to the in memory cache.\n * We have set an arbitrary size of 10 cached keys per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - salt to set new derived key\n * @param key - derived key we are setting\n */\nexport function setCachedKey(\n  hashedPassword: string,\n  salt: Uint8Array,\n  key: Uint8Array,\n): void {\n  // Max password caches\n  if (Object.keys(inMemCachedKDF).length > MAX_PASSWORD_CACHES) {\n    inMemCachedKDF = {};\n  }\n\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n\n  // Max salt caches\n  if (cache.size > MAX_SALT_CACHES) {\n    cache.clear();\n  }\n\n  cache.set(base64Salt, key);\n}\n"]}
+{"version":3,"file":"cache.cjs","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":";;;AAAA,+CAA0C;AAC1C,uCAA4C;AAQ5C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,eAAe,GAAG,GAAG,CAAC;AAQ5B,IAAI,cAAc,GAAyB,EAAE,CAAC;AAC9C,MAAM,gBAAgB,GAAG,CAAC,cAAsB,EAAE,EAAE;IAClD,cAAc,CAAC,cAAc,MAA7B,cAAc,CAAC,cAAc,IAAM,IAAI,GAAG,EAAE,EAAC;IAC7C,OAAO,cAAc,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAChC,cAAsB,EACtB,IAAgB;IAEhB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE;QACd,OAAO,SAAS,CAAC;KAClB;IAED,OAAO;QACL,IAAI;QACJ,UAAU;QACV,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAhBD,gDAgBC;AAED;;;;;;GAMG;AACH,SAAgB,mCAAmC,CACjD,cAAsB;IAEtB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAA,yBAAiB,EAAC,uBAAW,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,CAAC,SAAS,EAAE;QACd,OAAO,SAAS,CAAC;KAClB;IAED,OAAO;QACL,IAAI,EAAE,uBAAW;QACjB,UAAU;QACV,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAhBD,kFAgBC;AAED;;;;;;;GAOG;AACH,SAAgB,YAAY,CAC1B,cAAsB,EACtB,IAAgB,EAChB,GAAe;IAEf,sBAAsB;IACtB,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE;QAC5D,cAAc,GAAG,EAAE,CAAC;KACrB;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAA,yBAAiB,EAAC,IAAI,CAAC,CAAC;IAE3C,kBAAkB;IAClB,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,EAAE;QAChC,KAAK,CAAC,KAAK,EAAE,CAAC;KACf;IAED,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAnBD,oCAmBC","sourcesContent":["import { SHARED_SALT } from './constants';\nimport { byteArrayToBase64 } from './utils';\n\ntype CachedEntry = {\n  salt: Uint8Array;\n  base64Salt: string;\n  key: Uint8Array;\n};\n\nconst MAX_PASSWORD_CACHES = 100;\nconst MAX_SALT_CACHES = 100;\n\n/**\n * In-Memory Caching derived keys based from a given salt and password.\n */\ntype PasswordMemCachedKDF = {\n  [hashedPassword: string]: Map<string, Uint8Array>;\n};\nlet inMemCachedKDF: PasswordMemCachedKDF = {};\nconst getPasswordCache = (hashedPassword: string) => {\n  inMemCachedKDF[hashedPassword] ??= new Map();\n  return inMemCachedKDF[hashedPassword];\n};\n\n/**\n * Returns a given cached derived key from a hashed password and salt\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - provide salt to receive cached key\n * @returns cached key\n */\nexport function getCachedKeyBySalt(\n  hashedPassword: string,\n  salt: Uint8Array,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n  const cachedKey = cache.get(base64Salt);\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Gets the cached key that was generated without a salt, if it exists.\n * This is unique per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @returns the cached key\n */\nexport function getCachedKeyGeneratedWithSharedSalt(\n  hashedPassword: string,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(SHARED_SALT);\n  const cachedKey = cache.get(base64Salt);\n\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt: SHARED_SALT,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Sets a key to the in memory cache.\n * We have set an arbitrary size of 10 cached keys per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - salt to set new derived key\n * @param key - derived key we are setting\n */\nexport function setCachedKey(\n  hashedPassword: string,\n  salt: Uint8Array,\n  key: Uint8Array,\n): void {\n  // Max password caches\n  if (Object.keys(inMemCachedKDF).length > MAX_PASSWORD_CACHES) {\n    inMemCachedKDF = {};\n  }\n\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n\n  // Max salt caches\n  if (cache.size > MAX_SALT_CACHES) {\n    cache.clear();\n  }\n\n  cache.set(base64Salt, key);\n}\n"]}

package/dist/shared/encryption/cache.d.cts

@@ -12,12 +12,13 @@ type CachedEntry = {
  */
 export declare function getCachedKeyBySalt(hashedPassword: string, salt: Uint8Array): CachedEntry | undefined;
 /**
- * Gets any cached key for a given hashed password
+ * Gets the cached key that was generated without a salt, if it exists.
+ * This is unique per hashed password.
  *
  * @param hashedPassword - hashed password for cache lookup
- * @returns any (the first) cached key
+ * @returns the cached key
  */
-export declare function getAnyCachedKey(hashedPassword: string): CachedEntry | undefined;
+export declare function getCachedKeyGeneratedWithSharedSalt(hashedPassword: string): CachedEntry | undefined;
 /**
  * Sets a key to the in memory cache.
  * We have set an arbitrary size of 10 cached keys per hashed password.

package/dist/shared/encryption/cache.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.cts","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":"AAEA,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAiBF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,GACf,WAAW,GAAG,SAAS,CAazB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,cAAc,EAAE,MAAM,GACrB,WAAW,GAAG,SAAS,CAmBzB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,GACd,IAAI,CAeN"}
+{"version":3,"file":"cache.d.cts","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":"AAGA,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAiBF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,GACf,WAAW,GAAG,SAAS,CAazB;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,GACrB,WAAW,GAAG,SAAS,CAczB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,GACd,IAAI,CAeN"}

package/dist/shared/encryption/cache.d.mts

@@ -12,12 +12,13 @@ type CachedEntry = {
  */
 export declare function getCachedKeyBySalt(hashedPassword: string, salt: Uint8Array): CachedEntry | undefined;
 /**
- * Gets any cached key for a given hashed password
+ * Gets the cached key that was generated without a salt, if it exists.
+ * This is unique per hashed password.
  *
  * @param hashedPassword - hashed password for cache lookup
- * @returns any (the first) cached key
+ * @returns the cached key
  */
-export declare function getAnyCachedKey(hashedPassword: string): CachedEntry | undefined;
+export declare function getCachedKeyGeneratedWithSharedSalt(hashedPassword: string): CachedEntry | undefined;
 /**
  * Sets a key to the in memory cache.
  * We have set an arbitrary size of 10 cached keys per hashed password.

package/dist/shared/encryption/cache.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cache.d.mts","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":"AAEA,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAiBF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,GACf,WAAW,GAAG,SAAS,CAazB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,cAAc,EAAE,MAAM,GACrB,WAAW,GAAG,SAAS,CAmBzB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,GACd,IAAI,CAeN"}
+{"version":3,"file":"cache.d.mts","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":"AAGA,KAAK,WAAW,GAAG;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,UAAU,CAAC;CACjB,CAAC;AAiBF;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,GACf,WAAW,GAAG,SAAS,CAazB;AAED;;;;;;GAMG;AACH,wBAAgB,mCAAmC,CACjD,cAAc,EAAE,MAAM,GACrB,WAAW,GAAG,SAAS,CAczB;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,GACd,IAAI,CAeN"}

package/dist/shared/encryption/cache.mjs

@@ -1,4 +1,5 @@
-import { base64ToByteArray, byteArrayToBase64 } from "./utils.mjs";
+import { SHARED_SALT } from "./constants.mjs";
+import { byteArrayToBase64 } from "./utils.mjs";
 const MAX_PASSWORD_CACHES = 100;
 const MAX_SALT_CACHES = 100;
 let inMemCachedKDF = {};
@@ -27,26 +28,23 @@ export function getCachedKeyBySalt(hashedPassword, salt) {
     };
 }
 /**
- * Gets any cached key for a given hashed password
+ * Gets the cached key that was generated without a salt, if it exists.
+ * This is unique per hashed password.
  *
  * @param hashedPassword - hashed password for cache lookup
- * @returns any (the first) cached key
+ * @returns the cached key
  */
-export function getAnyCachedKey(hashedPassword) {
+export function getCachedKeyGeneratedWithSharedSalt(hashedPassword) {
     const cache = getPasswordCache(hashedPassword);
-    // Takes 1 item from an Iterator via Map.entries()
-    const cachedEntry = cache
-        .entries()
-        .next().value;
-    if (!cachedEntry) {
+    const base64Salt = byteArrayToBase64(SHARED_SALT);
+    const cachedKey = cache.get(base64Salt);
+    if (!cachedKey) {
         return undefined;
     }
-    const base64Salt = cachedEntry[0];
-    const bytesSalt = base64ToByteArray(base64Salt);
     return {
-        salt: bytesSalt,
+        salt: SHARED_SALT,
         base64Salt,
-        key: cachedEntry[1],
+        key: cachedKey,
     };
 }
 /**

package/dist/shared/encryption/cache.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cache.mjs","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,oBAAgB;AAQ/D,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,eAAe,GAAG,GAAG,CAAC;AAQ5B,IAAI,cAAc,GAAyB,EAAE,CAAC;AAC9C,MAAM,gBAAgB,GAAG,CAAC,cAAsB,EAAE,EAAE;IAClD,cAAc,CAAC,cAAc,MAA7B,cAAc,CAAC,cAAc,IAAM,IAAI,GAAG,EAAE,EAAC;IAC7C,OAAO,cAAc,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAAsB,EACtB,IAAgB;IAEhB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE;QACd,OAAO,SAAS,CAAC;KAClB;IAED,OAAO;QACL,IAAI;QACJ,UAAU;QACV,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,cAAsB;IAEtB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAE/C,kDAAkD;IAClD,MAAM,WAAW,GAAqC,KAAK;SACxD,OAAO,EAAE;SACT,IAAI,EAAE,CAAC,KAAK,CAAC;IAEhB,IAAI,CAAC,WAAW,EAAE;QAChB,OAAO,SAAS,CAAC;KAClB;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAChD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,UAAU;QACV,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;KACpB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,cAAsB,EACtB,IAAgB,EAChB,GAAe;IAEf,sBAAsB;IACtB,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE;QAC5D,cAAc,GAAG,EAAE,CAAC;KACrB;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE3C,kBAAkB;IAClB,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,EAAE;QAChC,KAAK,CAAC,KAAK,EAAE,CAAC;KACf;IAED,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC","sourcesContent":["import { base64ToByteArray, byteArrayToBase64 } from './utils';\n\ntype CachedEntry = {\n  salt: Uint8Array;\n  base64Salt: string;\n  key: Uint8Array;\n};\n\nconst MAX_PASSWORD_CACHES = 100;\nconst MAX_SALT_CACHES = 100;\n\n/**\n * In-Memory Caching derived keys based from a given salt and password.\n */\ntype PasswordMemCachedKDF = {\n  [hashedPassword: string]: Map<string, Uint8Array>;\n};\nlet inMemCachedKDF: PasswordMemCachedKDF = {};\nconst getPasswordCache = (hashedPassword: string) => {\n  inMemCachedKDF[hashedPassword] ??= new Map();\n  return inMemCachedKDF[hashedPassword];\n};\n\n/**\n * Returns a given cached derived key from a hashed password and salt\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - provide salt to receive cached key\n * @returns cached key\n */\nexport function getCachedKeyBySalt(\n  hashedPassword: string,\n  salt: Uint8Array,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n  const cachedKey = cache.get(base64Salt);\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Gets any cached key for a given hashed password\n *\n * @param hashedPassword - hashed password for cache lookup\n * @returns any (the first) cached key\n */\nexport function getAnyCachedKey(\n  hashedPassword: string,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n\n  // Takes 1 item from an Iterator via Map.entries()\n  const cachedEntry: [string, Uint8Array] | undefined = cache\n    .entries()\n    .next().value;\n\n  if (!cachedEntry) {\n    return undefined;\n  }\n\n  const base64Salt = cachedEntry[0];\n  const bytesSalt = base64ToByteArray(base64Salt);\n  return {\n    salt: bytesSalt,\n    base64Salt,\n    key: cachedEntry[1],\n  };\n}\n\n/**\n * Sets a key to the in memory cache.\n * We have set an arbitrary size of 10 cached keys per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - salt to set new derived key\n * @param key - derived key we are setting\n */\nexport function setCachedKey(\n  hashedPassword: string,\n  salt: Uint8Array,\n  key: Uint8Array,\n): void {\n  // Max password caches\n  if (Object.keys(inMemCachedKDF).length > MAX_PASSWORD_CACHES) {\n    inMemCachedKDF = {};\n  }\n\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n\n  // Max salt caches\n  if (cache.size > MAX_SALT_CACHES) {\n    cache.clear();\n  }\n\n  cache.set(base64Salt, key);\n}\n"]}
+{"version":3,"file":"cache.mjs","sourceRoot":"","sources":["../../../src/shared/encryption/cache.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,wBAAoB;AAC1C,OAAO,EAAE,iBAAiB,EAAE,oBAAgB;AAQ5C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,eAAe,GAAG,GAAG,CAAC;AAQ5B,IAAI,cAAc,GAAyB,EAAE,CAAC;AAC9C,MAAM,gBAAgB,GAAG,CAAC,cAAsB,EAAE,EAAE;IAClD,cAAc,CAAC,cAAc,MAA7B,cAAc,CAAC,cAAc,IAAM,IAAI,GAAG,EAAE,EAAC;IAC7C,OAAO,cAAc,CAAC,cAAc,CAAC,CAAC;AACxC,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,cAAsB,EACtB,IAAgB;IAEhB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS,EAAE;QACd,OAAO,SAAS,CAAC;KAClB;IAED,OAAO;QACL,IAAI;QACJ,UAAU;QACV,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mCAAmC,CACjD,cAAsB;IAEtB,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAExC,IAAI,CAAC,SAAS,EAAE;QACd,OAAO,SAAS,CAAC;KAClB;IAED,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,UAAU;QACV,GAAG,EAAE,SAAS;KACf,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,cAAsB,EACtB,IAAgB,EAChB,GAAe;IAEf,sBAAsB;IACtB,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE;QAC5D,cAAc,GAAG,EAAE,CAAC;KACrB;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAE3C,kBAAkB;IAClB,IAAI,KAAK,CAAC,IAAI,GAAG,eAAe,EAAE;QAChC,KAAK,CAAC,KAAK,EAAE,CAAC;KACf;IAED,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC","sourcesContent":["import { SHARED_SALT } from './constants';\nimport { byteArrayToBase64 } from './utils';\n\ntype CachedEntry = {\n  salt: Uint8Array;\n  base64Salt: string;\n  key: Uint8Array;\n};\n\nconst MAX_PASSWORD_CACHES = 100;\nconst MAX_SALT_CACHES = 100;\n\n/**\n * In-Memory Caching derived keys based from a given salt and password.\n */\ntype PasswordMemCachedKDF = {\n  [hashedPassword: string]: Map<string, Uint8Array>;\n};\nlet inMemCachedKDF: PasswordMemCachedKDF = {};\nconst getPasswordCache = (hashedPassword: string) => {\n  inMemCachedKDF[hashedPassword] ??= new Map();\n  return inMemCachedKDF[hashedPassword];\n};\n\n/**\n * Returns a given cached derived key from a hashed password and salt\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - provide salt to receive cached key\n * @returns cached key\n */\nexport function getCachedKeyBySalt(\n  hashedPassword: string,\n  salt: Uint8Array,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n  const cachedKey = cache.get(base64Salt);\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Gets the cached key that was generated without a salt, if it exists.\n * This is unique per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @returns the cached key\n */\nexport function getCachedKeyGeneratedWithSharedSalt(\n  hashedPassword: string,\n): CachedEntry | undefined {\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(SHARED_SALT);\n  const cachedKey = cache.get(base64Salt);\n\n  if (!cachedKey) {\n    return undefined;\n  }\n\n  return {\n    salt: SHARED_SALT,\n    base64Salt,\n    key: cachedKey,\n  };\n}\n\n/**\n * Sets a key to the in memory cache.\n * We have set an arbitrary size of 10 cached keys per hashed password.\n *\n * @param hashedPassword - hashed password for cache lookup\n * @param salt - salt to set new derived key\n * @param key - derived key we are setting\n */\nexport function setCachedKey(\n  hashedPassword: string,\n  salt: Uint8Array,\n  key: Uint8Array,\n): void {\n  // Max password caches\n  if (Object.keys(inMemCachedKDF).length > MAX_PASSWORD_CACHES) {\n    inMemCachedKDF = {};\n  }\n\n  const cache = getPasswordCache(hashedPassword);\n  const base64Salt = byteArrayToBase64(salt);\n\n  // Max salt caches\n  if (cache.size > MAX_SALT_CACHES) {\n    cache.clear();\n  }\n\n  cache.set(base64Salt, key);\n}\n"]}

package/dist/shared/encryption/constants.cjs

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHARED_SALT = exports.SCRYPT_p = exports.SCRYPT_r = exports.SCRYPT_N = exports.SCRYPT_SALT_SIZE = exports.ALGORITHM_KEY_SIZE = exports.ALGORITHM_NONCE_SIZE = void 0;
+// Nonce/Key Sizes
+exports.ALGORITHM_NONCE_SIZE = 12; // 12 bytes
+exports.ALGORITHM_KEY_SIZE = 16; // 16 bytes
+// Scrypt settings
+// see: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#scrypt
+exports.SCRYPT_SALT_SIZE = 16; // 16 bytes
+exports.SCRYPT_N = 2 ** 17; // CPU/memory cost parameter (must be a power of 2, > 1)
+// eslint-disable-next-line @typescript-eslint/naming-convention
+exports.SCRYPT_r = 8; // Block size parameter
+// eslint-disable-next-line @typescript-eslint/naming-convention
+exports.SCRYPT_p = 1; // Parallelization parameter
+exports.SHARED_SALT = new Uint8Array([
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+]);
+//# sourceMappingURL=constants.cjs.map

package/dist/shared/encryption/constants.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.cjs","sourceRoot":"","sources":["../../../src/shared/encryption/constants.ts"],"names":[],"mappings":";;;AAAA,kBAAkB;AACL,QAAA,oBAAoB,GAAG,EAAE,CAAC,CAAC,WAAW;AACtC,QAAA,kBAAkB,GAAG,EAAE,CAAC,CAAC,WAAW;AAEjD,kBAAkB;AAClB,+FAA+F;AAClF,QAAA,gBAAgB,GAAG,EAAE,CAAC,CAAC,WAAW;AAClC,QAAA,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,wDAAwD;AACzF,gEAAgE;AACnD,QAAA,QAAQ,GAAG,CAAC,CAAC,CAAC,uBAAuB;AAClD,gEAAgE;AACnD,QAAA,QAAQ,GAAG,CAAC,CAAC,CAAC,4BAA4B;AAE1C,QAAA,WAAW,GAAG,IAAI,UAAU,CAAC;IACxC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;CACrD,CAAC,CAAC","sourcesContent":["// Nonce/Key Sizes\nexport const ALGORITHM_NONCE_SIZE = 12; // 12 bytes\nexport const ALGORITHM_KEY_SIZE = 16; // 16 bytes\n\n// Scrypt settings\n// see: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#scrypt\nexport const SCRYPT_SALT_SIZE = 16; // 16 bytes\nexport const SCRYPT_N = 2 ** 17; // CPU/memory cost parameter (must be a power of 2, > 1)\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport const SCRYPT_r = 8; // Block size parameter\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport const SCRYPT_p = 1; // Parallelization parameter\n\nexport const SHARED_SALT = new Uint8Array([\n  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,\n]);\n"]}

package/dist/shared/encryption/constants.d.cts

@@ -0,0 +1,8 @@
+export declare const ALGORITHM_NONCE_SIZE = 12;
+export declare const ALGORITHM_KEY_SIZE = 16;
+export declare const SCRYPT_SALT_SIZE = 16;
+export declare const SCRYPT_N: number;
+export declare const SCRYPT_r = 8;
+export declare const SCRYPT_p = 1;
+export declare const SHARED_SALT: Uint8Array;
+//# sourceMappingURL=constants.d.cts.map

package/dist/shared/encryption/constants.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.cts","sourceRoot":"","sources":["../../../src/shared/encryption/constants.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAIrC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,QAAQ,QAAU,CAAC;AAEhC,eAAO,MAAM,QAAQ,IAAI,CAAC;AAE1B,eAAO,MAAM,QAAQ,IAAI,CAAC;AAE1B,eAAO,MAAM,WAAW,YAEtB,CAAC"}

package/dist/shared/encryption/constants.d.mts

@@ -0,0 +1,8 @@
+export declare const ALGORITHM_NONCE_SIZE = 12;
+export declare const ALGORITHM_KEY_SIZE = 16;
+export declare const SCRYPT_SALT_SIZE = 16;
+export declare const SCRYPT_N: number;
+export declare const SCRYPT_r = 8;
+export declare const SCRYPT_p = 1;
+export declare const SHARED_SALT: Uint8Array;
+//# sourceMappingURL=constants.d.mts.map

package/dist/shared/encryption/constants.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/shared/encryption/constants.ts"],"names":[],"mappings":"AACA,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAIrC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,eAAO,MAAM,QAAQ,QAAU,CAAC;AAEhC,eAAO,MAAM,QAAQ,IAAI,CAAC;AAE1B,eAAO,MAAM,QAAQ,IAAI,CAAC;AAE1B,eAAO,MAAM,WAAW,YAEtB,CAAC"}

package/dist/shared/encryption/constants.mjs

@@ -0,0 +1,15 @@
+// Nonce/Key Sizes
+export const ALGORITHM_NONCE_SIZE = 12; // 12 bytes
+export const ALGORITHM_KEY_SIZE = 16; // 16 bytes
+// Scrypt settings
+// see: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#scrypt
+export const SCRYPT_SALT_SIZE = 16; // 16 bytes
+export const SCRYPT_N = 2 ** 17; // CPU/memory cost parameter (must be a power of 2, > 1)
+// eslint-disable-next-line @typescript-eslint/naming-convention
+export const SCRYPT_r = 8; // Block size parameter
+// eslint-disable-next-line @typescript-eslint/naming-convention
+export const SCRYPT_p = 1; // Parallelization parameter
+export const SHARED_SALT = new Uint8Array([
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
+]);
+//# sourceMappingURL=constants.mjs.map

package/dist/shared/encryption/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","sourceRoot":"","sources":["../../../src/shared/encryption/constants.ts"],"names":[],"mappings":"AAAA,kBAAkB;AAClB,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC,CAAC,WAAW;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC,CAAC,WAAW;AAEjD,kBAAkB;AAClB,+FAA+F;AAC/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC,CAAC,WAAW;AAC/C,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,wDAAwD;AACzF,gEAAgE;AAChE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,uBAAuB;AAClD,gEAAgE;AAChE,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,4BAA4B;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,UAAU,CAAC;IACxC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;CACrD,CAAC,CAAC","sourcesContent":["// Nonce/Key Sizes\nexport const ALGORITHM_NONCE_SIZE = 12; // 12 bytes\nexport const ALGORITHM_KEY_SIZE = 16; // 16 bytes\n\n// Scrypt settings\n// see: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#scrypt\nexport const SCRYPT_SALT_SIZE = 16; // 16 bytes\nexport const SCRYPT_N = 2 ** 17; // CPU/memory cost parameter (must be a power of 2, > 1)\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport const SCRYPT_r = 8; // Block size parameter\n// eslint-disable-next-line @typescript-eslint/naming-convention\nexport const SCRYPT_p = 1; // Parallelization parameter\n\nexport const SHARED_SALT = new Uint8Array([\n  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,\n]);\n"]}

package/dist/shared/encryption/encryption.cjs

@@ -13,18 +13,8 @@ const scrypt_1 = require("@noble/hashes/scrypt");
 const sha256_1 = require("@noble/hashes/sha256");
 const utils_1 = require("@noble/hashes/utils");
 const cache_1 = require("./cache.cjs");
+const constants_1 = require("./constants.cjs");
 const utils_2 = require("./utils.cjs");
-// Nonce/Key Sizes
-const ALGORITHM_NONCE_SIZE = 12; // 12 bytes
-const ALGORITHM_KEY_SIZE = 16; // 16 bytes
-// Scrypt settings
-// see: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#scrypt
-const SCRYPT_SALT_SIZE = 16; // 16 bytes
-const SCRYPT_N = 2 ** 17; // CPU/memory cost parameter (must be a power of 2, > 1)
-// eslint-disable-next-line @typescript-eslint/naming-convention
-const SCRYPT_r = 8; // Block size parameter
-// eslint-disable-next-line @typescript-eslint/naming-convention
-const SCRYPT_p = 1; // Parallelization parameter
 class EncryptorDecryptor {
     constructor() {
         _EncryptorDecryptor_instances.add(this);
@@ -53,13 +43,47 @@ class EncryptorDecryptor {
             throw new Error(`Unable to decrypt string - ${errorMessage}`);
         }
     }
+    getSalt(encryptedDataStr) {
+        try {
+            const encryptedData = JSON.parse(encryptedDataStr);
+            if (encryptedData.v === '1') {
+                if (encryptedData.t === 'scrypt') {
+                    const { d: base64CiphertextAndNonceAndSalt, saltLen } = encryptedData;
+                    // Decode the base64.
+                    const ciphertextAndNonceAndSalt = (0, utils_2.base64ToByteArray)(base64CiphertextAndNonceAndSalt);
+                    // Create buffers of salt and ciphertextAndNonce.
+                    const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);
+                    return salt;
+                }
+            }
+            throw new Error(`Unsupported encrypted data payload - ${encryptedDataStr}`);
+        }
+        catch (e) {
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);
+            throw new Error(`Unable to get salt - ${errorMessage}`);
+        }
+    }
+    getIfEntriesHaveDifferentSalts(entries) {
+        const salts = entries
+            .map((e) => {
+            try {
+                return this.getSalt(e);
+            }
+            catch {
+                return undefined;
+            }
+        })
+            .filter((s) => s !== undefined);
+        const strSet = new Set(salts.map((arr) => arr.toString()));
+        return strSet.size === salts.length;
+    }
 }
 _EncryptorDecryptor_instances = new WeakSet(), _EncryptorDecryptor_encryptStringV1 = async function _EncryptorDecryptor_encryptStringV1(plaintext, password, nativeScryptCrypto) {
     const { key, salt } = await __classPrivateFieldGet(this, _EncryptorDecryptor_instances, "m", _EncryptorDecryptor_getOrGenerateScryptKey).call(this, password, {
-        N: SCRYPT_N,
-        r: SCRYPT_r,
-        p: SCRYPT_p,
-        dkLen: ALGORITHM_KEY_SIZE,
+        N: constants_1.SCRYPT_N,
+        r: constants_1.SCRYPT_r,
+        p: constants_1.SCRYPT_p,
+        dkLen: constants_1.ALGORITHM_KEY_SIZE,
     }, undefined, nativeScryptCrypto);
     // Encrypt and prepend salt.
     const plaintextRaw = (0, utils_1.utf8ToBytes)(plaintext);
@@ -71,12 +95,12 @@ _EncryptorDecryptor_instances = new WeakSet(), _EncryptorDecryptor_encryptString
         t: 'scrypt',
         d: encryptedData,
         o: {
-            N: SCRYPT_N,
-            r: SCRYPT_r,
-            p: SCRYPT_p,
-            dkLen: ALGORITHM_KEY_SIZE,
+            N: constants_1.SCRYPT_N,
+            r: constants_1.SCRYPT_r,
+            p: constants_1.SCRYPT_p,
+            dkLen: constants_1.ALGORITHM_KEY_SIZE,
         },
-        saltLen: SCRYPT_SALT_SIZE,
+        saltLen: constants_1.SCRYPT_SALT_SIZE,
     };
     return JSON.stringify(encryptedPayload);
 }, _EncryptorDecryptor_decryptStringV1 = async function _EncryptorDecryptor_decryptStringV1(data, password, nativeScryptCrypto) {
@@ -96,28 +120,28 @@ _EncryptorDecryptor_instances = new WeakSet(), _EncryptorDecryptor_encryptString
     // Decrypt and return result.
     return (0, utils_2.bytesToUtf8)(__classPrivateFieldGet(this, _EncryptorDecryptor_instances, "m", _EncryptorDecryptor_decrypt).call(this, ciphertextAndNonce, key));
 }, _EncryptorDecryptor_encrypt = function _EncryptorDecryptor_encrypt(plaintext, key) {
-    const nonce = (0, webcrypto_1.randomBytes)(ALGORITHM_NONCE_SIZE);
+    const nonce = (0, webcrypto_1.randomBytes)(constants_1.ALGORITHM_NONCE_SIZE);
     // Encrypt and prepend nonce.
     const ciphertext = (0, aes_1.gcm)(key, nonce).encrypt(plaintext);
     return (0, utils_1.concatBytes)(nonce, ciphertext);
 }, _EncryptorDecryptor_decrypt = function _EncryptorDecryptor_decrypt(ciphertextAndNonce, key) {
     // Create buffers of nonce and ciphertext.
-    const nonce = ciphertextAndNonce.slice(0, ALGORITHM_NONCE_SIZE);
-    const ciphertext = ciphertextAndNonce.slice(ALGORITHM_NONCE_SIZE, ciphertextAndNonce.length);
+    const nonce = ciphertextAndNonce.slice(0, constants_1.ALGORITHM_NONCE_SIZE);
+    const ciphertext = ciphertextAndNonce.slice(constants_1.ALGORITHM_NONCE_SIZE, ciphertextAndNonce.length);
     // Decrypt and return result.
     return (0, aes_1.gcm)(key, nonce).decrypt(ciphertext);
 }, _EncryptorDecryptor_getOrGenerateScryptKey = async function _EncryptorDecryptor_getOrGenerateScryptKey(password, o, salt, nativeScryptCrypto) {
     const hashedPassword = createSHA256Hash(password);
     const cachedKey = salt
         ? (0, cache_1.getCachedKeyBySalt)(hashedPassword, salt)
-        : (0, cache_1.getAnyCachedKey)(hashedPassword);
+        : (0, cache_1.getCachedKeyGeneratedWithSharedSalt)(hashedPassword);
     if (cachedKey) {
         return {
             key: cachedKey.key,
             salt: cachedKey.salt,
         };
     }
-    const newSalt = salt ?? (0, webcrypto_1.randomBytes)(SCRYPT_SALT_SIZE);
+    const newSalt = salt ?? constants_1.SHARED_SALT;
     let newKey;
     if (nativeScryptCrypto) {
         newKey = await nativeScryptCrypto((0, utils_2.stringToByteArray)(password), newSalt, o.N, o.r, o.p, o.dkLen);

package/dist/shared/encryption/encryption.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.cjs","sourceRoot":"","sources":["../../../src/shared/encryption/encryption.ts"],"names":[],"mappings":";;;;;;;;;AAAA,4CAAyC;AACzC,wDAAuD;AACvD,iDAAmD;AACnD,iDAA8C;AAC9C,+CAA2E;AAG3E,uCAA4E;AAC5E,uCAKiB;AAyBjB,kBAAkB;AAClB,MAAM,oBAAoB,GAAG,EAAE,CAAC,CAAC,WAAW;AAC5C,MAAM,kBAAkB,GAAG,EAAE,CAAC,CAAC,WAAW;AAE1C,kBAAkB;AAClB,+FAA+F;AAC/F,MAAM,gBAAgB,GAAG,EAAE,CAAC,CAAC,WAAW;AACxC,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,wDAAwD;AAClF,gEAAgE;AAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,uBAAuB;AAC3C,gEAAgE;AAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,4BAA4B;AAEhD,MAAM,kBAAkB;IAAxB;;IA6LA,CAAC;IA5LC,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,QAAgB,EAChB,kBAAiC;QAEjC,IAAI;YACF,OAAO,MAAM,uBAAA,IAAI,0EAAiB,MAArB,IAAI,EACf,SAAS,EACT,QAAQ,EACR,kBAAkB,CACnB,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;SAC/D;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,gBAAwB,EACxB,QAAgB,EAChB,kBAAiC;QAEjC,IAAI;YACF,MAAM,aAAa,GAAqB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACrE,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE;gBAC3B,IAAI,aAAa,CAAC,CAAC,KAAK,QAAQ,EAAE;oBAChC,OAAO,MAAM,uBAAA,IAAI,0EAAiB,MAArB,IAAI,EACf,aAAa,EACb,QAAQ,EACR,kBAAkB,CACnB,CAAC;iBACH;aACF;YACD,MAAM,IAAI,KAAK,CACb,wCAAwC,gBAAgB,EAAE,CAC3D,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;SAC/D;IACH,CAAC;CAoJF;qFAlJC,KAAK,8CACH,SAAiB,EACjB,QAAgB,EAChB,kBAAiC;IAEjC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,uBAAA,IAAI,iFAAwB,MAA5B,IAAI,EAC9B,QAAQ,EACR;QACE,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,KAAK,EAAE,kBAAkB;KAC1B,EACD,SAAS,EACT,kBAAkB,CACnB,CAAC;IAEF,4BAA4B;IAC5B,MAAM,YAAY,GAAG,IAAA,mBAAW,EAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,yBAAyB,GAAG,IAAA,mBAAW,EAC3C,IAAI,EACJ,uBAAA,IAAI,kEAAS,MAAb,IAAI,EAAU,YAAY,EAAE,GAAG,CAAC,CACjC,CAAC;IAEF,oBAAoB;IACpB,MAAM,aAAa,GAAG,IAAA,yBAAiB,EAAC,yBAAyB,CAAC,CAAC;IAEnE,MAAM,gBAAgB,GAAqB;QACzC,CAAC,EAAE,GAAG;QACN,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,aAAa;QAChB,CAAC,EAAE;YACD,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,KAAK,EAAE,kBAAkB;SAC1B;QACD,OAAO,EAAE,gBAAgB;KAC1B,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC,wCAED,KAAK,8CACH,IAAsB,EACtB,QAAgB,EAChB,kBAAiC;IAEjC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,+BAA+B,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAEhE,qBAAqB;IACrB,MAAM,yBAAyB,GAAG,IAAA,yBAAiB,EACjD,+BAA+B,CAChC,CAAC;IAEF,iDAAiD;IACjD,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,KAAK,CACxD,OAAO,EACP,yBAAyB,CAAC,MAAM,CACjC,CAAC;IAEF,kBAAkB;IAClB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,uBAAA,IAAI,iFAAwB,MAA5B,IAAI,EACxB,QAAQ,EACR;QACE,CAAC,EAAE,CAAC,CAAC,CAAC;QACN,CAAC,EAAE,CAAC,CAAC,CAAC;QACN,CAAC,EAAE,CAAC,CAAC,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,EACD,IAAI,EACJ,kBAAkB,CACnB,CAAC;IAEF,6BAA6B;IAC7B,OAAO,IAAA,mBAAW,EAAC,uBAAA,IAAI,kEAAS,MAAb,IAAI,EAAU,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC,qEAEQ,SAAqB,EAAE,GAAe;IAC7C,MAAM,KAAK,GAAG,IAAA,uBAAW,EAAC,oBAAoB,CAAC,CAAC;IAEhD,6BAA6B;IAC7B,MAAM,UAAU,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,OAAO,IAAA,mBAAW,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC,qEAEQ,kBAA8B,EAAE,GAAe;IACtD,0CAA0C;IAC1C,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CACzC,oBAAoB,EACpB,kBAAkB,CAAC,MAAM,CAC1B,CAAC;IAEF,6BAA6B;IAC7B,OAAO,IAAA,SAAG,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC,+CAED,KAAK,qDACH,QAAgB,EAChB,CAAwB,EACxB,IAAiB,EACjB,kBAAiC;IAEjC,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,IAAA,0BAAkB,EAAC,cAAc,EAAE,IAAI,CAAC;QAC1C,CAAC,CAAC,IAAA,uBAAe,EAAC,cAAc,CAAC,CAAC;IAEpC,IAAI,SAAS,EAAE;QACb,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC;KACH;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,IAAA,uBAAW,EAAC,gBAAgB,CAAC,CAAC;IAEtD,IAAI,MAAkB,CAAC;IAEvB,IAAI,kBAAkB,EAAE;QACtB,MAAM,GAAG,MAAM,kBAAkB,CAC/B,IAAA,yBAAiB,EAAC,QAAQ,CAAC,EAC3B,OAAO,EACP,CAAC,CAAC,CAAC,EACH,CAAC,CAAC,CAAC,EACH,CAAC,CAAC,CAAC,EACH,CAAC,CAAC,KAAK,CACR,CAAC;KACH;SAAM;QACL,MAAM,GAAG,MAAM,IAAA,oBAAW,EAAC,QAAQ,EAAE,OAAO,EAAE;YAC5C,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;KACJ;IACD,IAAA,oBAAY,EAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE9C,OAAO;QACL,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,OAAO;KACd,CAAC;AACJ,CAAC;AAGH,MAAM,UAAU,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAC5C,kBAAe,UAAU,CAAC;AAE1B;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,MAAM,UAAU,GAAG,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAA,kBAAU,EAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAHD,4CAGC","sourcesContent":["import { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { scryptAsync } from '@noble/hashes/scrypt';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { utf8ToBytes, concatBytes, bytesToHex } from '@noble/hashes/utils';\n\nimport type { NativeScrypt } from '../types/encryption';\nimport { getAnyCachedKey, getCachedKeyBySalt, setCachedKey } from './cache';\nimport {\n  base64ToByteArray,\n  byteArrayToBase64,\n  bytesToUtf8,\n  stringToByteArray,\n} from './utils';\n\nexport type EncryptedPayload = {\n  // version\n  v: '1';\n\n  // key derivation function algorithm - scrypt\n  t: 'scrypt';\n\n  // data\n  d: string;\n\n  // encryption options - scrypt\n  o: {\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    N: number;\n    r: number;\n    p: number;\n    dkLen: number;\n  };\n\n  // Salt options\n  saltLen: number;\n};\n\n// Nonce/Key Sizes\nconst ALGORITHM_NONCE_SIZE = 12; // 12 bytes\nconst ALGORITHM_KEY_SIZE = 16; // 16 bytes\n\n// Scrypt settings\n// see: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#scrypt\nconst SCRYPT_SALT_SIZE = 16; // 16 bytes\nconst SCRYPT_N = 2 ** 17; // CPU/memory cost parameter (must be a power of 2, > 1)\n// eslint-disable-next-line @typescript-eslint/naming-convention\nconst SCRYPT_r = 8; // Block size parameter\n// eslint-disable-next-line @typescript-eslint/naming-convention\nconst SCRYPT_p = 1; // Parallelization parameter\n\nclass EncryptorDecryptor {\n  async encryptString(\n    plaintext: string,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    try {\n      return await this.#encryptStringV1(\n        plaintext,\n        password,\n        nativeScryptCrypto,\n      );\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to encrypt string - ${errorMessage}`);\n    }\n  }\n\n  async decryptString(\n    encryptedDataStr: string,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    try {\n      const encryptedData: EncryptedPayload = JSON.parse(encryptedDataStr);\n      if (encryptedData.v === '1') {\n        if (encryptedData.t === 'scrypt') {\n          return await this.#decryptStringV1(\n            encryptedData,\n            password,\n            nativeScryptCrypto,\n          );\n        }\n      }\n      throw new Error(\n        `Unsupported encrypted data payload - ${encryptedDataStr}`,\n      );\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to decrypt string - ${errorMessage}`);\n    }\n  }\n\n  async #encryptStringV1(\n    plaintext: string,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    const { key, salt } = await this.#getOrGenerateScryptKey(\n      password,\n      {\n        N: SCRYPT_N,\n        r: SCRYPT_r,\n        p: SCRYPT_p,\n        dkLen: ALGORITHM_KEY_SIZE,\n      },\n      undefined,\n      nativeScryptCrypto,\n    );\n\n    // Encrypt and prepend salt.\n    const plaintextRaw = utf8ToBytes(plaintext);\n    const ciphertextAndNonceAndSalt = concatBytes(\n      salt,\n      this.#encrypt(plaintextRaw, key),\n    );\n\n    // Convert to Base64\n    const encryptedData = byteArrayToBase64(ciphertextAndNonceAndSalt);\n\n    const encryptedPayload: EncryptedPayload = {\n      v: '1',\n      t: 'scrypt',\n      d: encryptedData,\n      o: {\n        N: SCRYPT_N,\n        r: SCRYPT_r,\n        p: SCRYPT_p,\n        dkLen: ALGORITHM_KEY_SIZE,\n      },\n      saltLen: SCRYPT_SALT_SIZE,\n    };\n\n    return JSON.stringify(encryptedPayload);\n  }\n\n  async #decryptStringV1(\n    data: EncryptedPayload,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    const { o, d: base64CiphertextAndNonceAndSalt, saltLen } = data;\n\n    // Decode the base64.\n    const ciphertextAndNonceAndSalt = base64ToByteArray(\n      base64CiphertextAndNonceAndSalt,\n    );\n\n    // Create buffers of salt and ciphertextAndNonce.\n    const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);\n    const ciphertextAndNonce = ciphertextAndNonceAndSalt.slice(\n      saltLen,\n      ciphertextAndNonceAndSalt.length,\n    );\n\n    // Derive the key.\n    const { key } = await this.#getOrGenerateScryptKey(\n      password,\n      {\n        N: o.N,\n        r: o.r,\n        p: o.p,\n        dkLen: o.dkLen,\n      },\n      salt,\n      nativeScryptCrypto,\n    );\n\n    // Decrypt and return result.\n    return bytesToUtf8(this.#decrypt(ciphertextAndNonce, key));\n  }\n\n  #encrypt(plaintext: Uint8Array, key: Uint8Array): Uint8Array {\n    const nonce = randomBytes(ALGORITHM_NONCE_SIZE);\n\n    // Encrypt and prepend nonce.\n    const ciphertext = gcm(key, nonce).encrypt(plaintext);\n\n    return concatBytes(nonce, ciphertext);\n  }\n\n  #decrypt(ciphertextAndNonce: Uint8Array, key: Uint8Array): Uint8Array {\n    // Create buffers of nonce and ciphertext.\n    const nonce = ciphertextAndNonce.slice(0, ALGORITHM_NONCE_SIZE);\n    const ciphertext = ciphertextAndNonce.slice(\n      ALGORITHM_NONCE_SIZE,\n      ciphertextAndNonce.length,\n    );\n\n    // Decrypt and return result.\n    return gcm(key, nonce).decrypt(ciphertext);\n  }\n\n  async #getOrGenerateScryptKey(\n    password: string,\n    o: EncryptedPayload['o'],\n    salt?: Uint8Array,\n    nativeScryptCrypto?: NativeScrypt,\n  ) {\n    const hashedPassword = createSHA256Hash(password);\n    const cachedKey = salt\n      ? getCachedKeyBySalt(hashedPassword, salt)\n      : getAnyCachedKey(hashedPassword);\n\n    if (cachedKey) {\n      return {\n        key: cachedKey.key,\n        salt: cachedKey.salt,\n      };\n    }\n\n    const newSalt = salt ?? randomBytes(SCRYPT_SALT_SIZE);\n\n    let newKey: Uint8Array;\n\n    if (nativeScryptCrypto) {\n      newKey = await nativeScryptCrypto(\n        stringToByteArray(password),\n        newSalt,\n        o.N,\n        o.r,\n        o.p,\n        o.dkLen,\n      );\n    } else {\n      newKey = await scryptAsync(password, newSalt, {\n        N: o.N,\n        r: o.r,\n        p: o.p,\n        dkLen: o.dkLen,\n      });\n    }\n    setCachedKey(hashedPassword, newSalt, newKey);\n\n    return {\n      key: newKey,\n      salt: newSalt,\n    };\n  }\n}\n\nconst encryption = new EncryptorDecryptor();\nexport default encryption;\n\n/**\n * Receive a SHA256 hash from a given string\n * @param data - input\n * @returns sha256 hash\n */\nexport function createSHA256Hash(data: string): string {\n  const hashedData = sha256(data);\n  return bytesToHex(hashedData);\n}\n"]}
+{"version":3,"file":"encryption.cjs","sourceRoot":"","sources":["../../../src/shared/encryption/encryption.ts"],"names":[],"mappings":";;;;;;;;;AAAA,4CAAyC;AACzC,wDAAuD;AACvD,iDAAmD;AACnD,iDAA8C;AAC9C,+CAA2E;AAG3E,uCAIiB;AACjB,+CAQqB;AACrB,uCAKiB;AAyBjB,MAAM,kBAAkB;IAAxB;;IAuOA,CAAC;IAtOC,KAAK,CAAC,aAAa,CACjB,SAAiB,EACjB,QAAgB,EAChB,kBAAiC;QAEjC,IAAI;YACF,OAAO,MAAM,uBAAA,IAAI,0EAAiB,MAArB,IAAI,EACf,SAAS,EACT,QAAQ,EACR,kBAAkB,CACnB,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;SAC/D;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,gBAAwB,EACxB,QAAgB,EAChB,kBAAiC;QAEjC,IAAI;YACF,MAAM,aAAa,GAAqB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACrE,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE;gBAC3B,IAAI,aAAa,CAAC,CAAC,KAAK,QAAQ,EAAE;oBAChC,OAAO,MAAM,uBAAA,IAAI,0EAAiB,MAArB,IAAI,EACf,aAAa,EACb,QAAQ,EACR,kBAAkB,CACnB,CAAC;iBACH;aACF;YACD,MAAM,IAAI,KAAK,CACb,wCAAwC,gBAAgB,EAAE,CAC3D,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;SAC/D;IACH,CAAC;IAiFD,OAAO,CAAC,gBAAwB;QAC9B,IAAI;YACF,MAAM,aAAa,GAAqB,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YACrE,IAAI,aAAa,CAAC,CAAC,KAAK,GAAG,EAAE;gBAC3B,IAAI,aAAa,CAAC,CAAC,KAAK,QAAQ,EAAE;oBAChC,MAAM,EAAE,CAAC,EAAE,+BAA+B,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC;oBAEtE,qBAAqB;oBACrB,MAAM,yBAAyB,GAAG,IAAA,yBAAiB,EACjD,+BAA+B,CAChC,CAAC;oBAEF,iDAAiD;oBACjD,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;oBACzD,OAAO,IAAI,CAAC;iBACb;aACF;YACD,MAAM,IAAI,KAAK,CACb,wCAAwC,gBAAgB,EAAE,CAC3D,CAAC;SACH;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,YAAY,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;SACzD;IACH,CAAC;IAED,8BAA8B,CAAC,OAAiB;QAC9C,MAAM,KAAK,GAAG,OAAO;aAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,IAAI;gBACF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;aACxB;YAAC,MAAM;gBACN,OAAO,SAAS,CAAC;aAClB;QACH,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,CAAC;IACtC,CAAC;CAsEF;qFA5LC,KAAK,8CACH,SAAiB,EACjB,QAAgB,EAChB,kBAAiC;IAEjC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,MAAM,uBAAA,IAAI,iFAAwB,MAA5B,IAAI,EAC9B,QAAQ,EACR;QACE,CAAC,EAAE,oBAAQ;QACX,CAAC,EAAE,oBAAQ;QACX,CAAC,EAAE,oBAAQ;QACX,KAAK,EAAE,8BAAkB;KAC1B,EACD,SAAS,EACT,kBAAkB,CACnB,CAAC;IAEF,4BAA4B;IAC5B,MAAM,YAAY,GAAG,IAAA,mBAAW,EAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,yBAAyB,GAAG,IAAA,mBAAW,EAC3C,IAAI,EACJ,uBAAA,IAAI,kEAAS,MAAb,IAAI,EAAU,YAAY,EAAE,GAAG,CAAC,CACjC,CAAC;IAEF,oBAAoB;IACpB,MAAM,aAAa,GAAG,IAAA,yBAAiB,EAAC,yBAAyB,CAAC,CAAC;IAEnE,MAAM,gBAAgB,GAAqB;QACzC,CAAC,EAAE,GAAG;QACN,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,aAAa;QAChB,CAAC,EAAE;YACD,CAAC,EAAE,oBAAQ;YACX,CAAC,EAAE,oBAAQ;YACX,CAAC,EAAE,oBAAQ;YACX,KAAK,EAAE,8BAAkB;SAC1B;QACD,OAAO,EAAE,4BAAgB;KAC1B,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;AAC1C,CAAC,wCAED,KAAK,8CACH,IAAsB,EACtB,QAAgB,EAChB,kBAAiC;IAEjC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,+BAA+B,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAEhE,qBAAqB;IACrB,MAAM,yBAAyB,GAAG,IAAA,yBAAiB,EACjD,+BAA+B,CAChC,CAAC;IAEF,iDAAiD;IACjD,MAAM,IAAI,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,kBAAkB,GAAG,yBAAyB,CAAC,KAAK,CACxD,OAAO,EACP,yBAAyB,CAAC,MAAM,CACjC,CAAC;IAEF,kBAAkB;IAClB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,uBAAA,IAAI,iFAAwB,MAA5B,IAAI,EACxB,QAAQ,EACR;QACE,CAAC,EAAE,CAAC,CAAC,CAAC;QACN,CAAC,EAAE,CAAC,CAAC,CAAC;QACN,CAAC,EAAE,CAAC,CAAC,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,EACD,IAAI,EACJ,kBAAkB,CACnB,CAAC;IAEF,6BAA6B;IAC7B,OAAO,IAAA,mBAAW,EAAC,uBAAA,IAAI,kEAAS,MAAb,IAAI,EAAU,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC,qEA2CQ,SAAqB,EAAE,GAAe;IAC7C,MAAM,KAAK,GAAG,IAAA,uBAAW,EAAC,gCAAoB,CAAC,CAAC;IAEhD,6BAA6B;IAC7B,MAAM,UAAU,GAAG,IAAA,SAAG,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,OAAO,IAAA,mBAAW,EAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC,qEAEQ,kBAA8B,EAAE,GAAe;IACtD,0CAA0C;IAC1C,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,EAAE,gCAAoB,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,kBAAkB,CAAC,KAAK,CACzC,gCAAoB,EACpB,kBAAkB,CAAC,MAAM,CAC1B,CAAC;IAEF,6BAA6B;IAC7B,OAAO,IAAA,SAAG,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC7C,CAAC,+CAED,KAAK,qDACH,QAAgB,EAChB,CAAwB,EACxB,IAAiB,EACjB,kBAAiC;IAEjC,MAAM,cAAc,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,IAAA,0BAAkB,EAAC,cAAc,EAAE,IAAI,CAAC;QAC1C,CAAC,CAAC,IAAA,2CAAmC,EAAC,cAAc,CAAC,CAAC;IAExD,IAAI,SAAS,EAAE;QACb,OAAO;YACL,GAAG,EAAE,SAAS,CAAC,GAAG;YAClB,IAAI,EAAE,SAAS,CAAC,IAAI;SACrB,CAAC;KACH;IAED,MAAM,OAAO,GAAG,IAAI,IAAI,uBAAW,CAAC;IAEpC,IAAI,MAAkB,CAAC;IAEvB,IAAI,kBAAkB,EAAE;QACtB,MAAM,GAAG,MAAM,kBAAkB,CAC/B,IAAA,yBAAiB,EAAC,QAAQ,CAAC,EAC3B,OAAO,EACP,CAAC,CAAC,CAAC,EACH,CAAC,CAAC,CAAC,EACH,CAAC,CAAC,CAAC,EACH,CAAC,CAAC,KAAK,CACR,CAAC;KACH;SAAM;QACL,MAAM,GAAG,MAAM,IAAA,oBAAW,EAAC,QAAQ,EAAE,OAAO,EAAE;YAC5C,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,CAAC,EAAE,CAAC,CAAC,CAAC;YACN,KAAK,EAAE,CAAC,CAAC,KAAK;SACf,CAAC,CAAC;KACJ;IAED,IAAA,oBAAY,EAAC,cAAc,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE9C,OAAO;QACL,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,OAAO;KACd,CAAC;AACJ,CAAC;AAGH,MAAM,UAAU,GAAG,IAAI,kBAAkB,EAAE,CAAC;AAC5C,kBAAe,UAAU,CAAC;AAE1B;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,MAAM,UAAU,GAAG,IAAA,eAAM,EAAC,IAAI,CAAC,CAAC;IAChC,OAAO,IAAA,kBAAU,EAAC,UAAU,CAAC,CAAC;AAChC,CAAC;AAHD,4CAGC","sourcesContent":["import { gcm } from '@noble/ciphers/aes';\nimport { randomBytes } from '@noble/ciphers/webcrypto';\nimport { scryptAsync } from '@noble/hashes/scrypt';\nimport { sha256 } from '@noble/hashes/sha256';\nimport { utf8ToBytes, concatBytes, bytesToHex } from '@noble/hashes/utils';\n\nimport type { NativeScrypt } from '../types/encryption';\nimport {\n  getCachedKeyBySalt,\n  getCachedKeyGeneratedWithSharedSalt,\n  setCachedKey,\n} from './cache';\nimport {\n  ALGORITHM_KEY_SIZE,\n  ALGORITHM_NONCE_SIZE,\n  SCRYPT_N,\n  SCRYPT_p,\n  SCRYPT_r,\n  SCRYPT_SALT_SIZE,\n  SHARED_SALT,\n} from './constants';\nimport {\n  base64ToByteArray,\n  byteArrayToBase64,\n  bytesToUtf8,\n  stringToByteArray,\n} from './utils';\n\nexport type EncryptedPayload = {\n  // version\n  v: '1';\n\n  // key derivation function algorithm - scrypt\n  t: 'scrypt';\n\n  // data\n  d: string;\n\n  // encryption options - scrypt\n  o: {\n    // eslint-disable-next-line @typescript-eslint/naming-convention\n    N: number;\n    r: number;\n    p: number;\n    dkLen: number;\n  };\n\n  // Salt options\n  saltLen: number;\n};\n\nclass EncryptorDecryptor {\n  async encryptString(\n    plaintext: string,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    try {\n      return await this.#encryptStringV1(\n        plaintext,\n        password,\n        nativeScryptCrypto,\n      );\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to encrypt string - ${errorMessage}`);\n    }\n  }\n\n  async decryptString(\n    encryptedDataStr: string,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    try {\n      const encryptedData: EncryptedPayload = JSON.parse(encryptedDataStr);\n      if (encryptedData.v === '1') {\n        if (encryptedData.t === 'scrypt') {\n          return await this.#decryptStringV1(\n            encryptedData,\n            password,\n            nativeScryptCrypto,\n          );\n        }\n      }\n      throw new Error(\n        `Unsupported encrypted data payload - ${encryptedDataStr}`,\n      );\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to decrypt string - ${errorMessage}`);\n    }\n  }\n\n  async #encryptStringV1(\n    plaintext: string,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    const { key, salt } = await this.#getOrGenerateScryptKey(\n      password,\n      {\n        N: SCRYPT_N,\n        r: SCRYPT_r,\n        p: SCRYPT_p,\n        dkLen: ALGORITHM_KEY_SIZE,\n      },\n      undefined,\n      nativeScryptCrypto,\n    );\n\n    // Encrypt and prepend salt.\n    const plaintextRaw = utf8ToBytes(plaintext);\n    const ciphertextAndNonceAndSalt = concatBytes(\n      salt,\n      this.#encrypt(plaintextRaw, key),\n    );\n\n    // Convert to Base64\n    const encryptedData = byteArrayToBase64(ciphertextAndNonceAndSalt);\n\n    const encryptedPayload: EncryptedPayload = {\n      v: '1',\n      t: 'scrypt',\n      d: encryptedData,\n      o: {\n        N: SCRYPT_N,\n        r: SCRYPT_r,\n        p: SCRYPT_p,\n        dkLen: ALGORITHM_KEY_SIZE,\n      },\n      saltLen: SCRYPT_SALT_SIZE,\n    };\n\n    return JSON.stringify(encryptedPayload);\n  }\n\n  async #decryptStringV1(\n    data: EncryptedPayload,\n    password: string,\n    nativeScryptCrypto?: NativeScrypt,\n  ): Promise<string> {\n    const { o, d: base64CiphertextAndNonceAndSalt, saltLen } = data;\n\n    // Decode the base64.\n    const ciphertextAndNonceAndSalt = base64ToByteArray(\n      base64CiphertextAndNonceAndSalt,\n    );\n\n    // Create buffers of salt and ciphertextAndNonce.\n    const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);\n    const ciphertextAndNonce = ciphertextAndNonceAndSalt.slice(\n      saltLen,\n      ciphertextAndNonceAndSalt.length,\n    );\n\n    // Derive the key.\n    const { key } = await this.#getOrGenerateScryptKey(\n      password,\n      {\n        N: o.N,\n        r: o.r,\n        p: o.p,\n        dkLen: o.dkLen,\n      },\n      salt,\n      nativeScryptCrypto,\n    );\n\n    // Decrypt and return result.\n    return bytesToUtf8(this.#decrypt(ciphertextAndNonce, key));\n  }\n\n  getSalt(encryptedDataStr: string) {\n    try {\n      const encryptedData: EncryptedPayload = JSON.parse(encryptedDataStr);\n      if (encryptedData.v === '1') {\n        if (encryptedData.t === 'scrypt') {\n          const { d: base64CiphertextAndNonceAndSalt, saltLen } = encryptedData;\n\n          // Decode the base64.\n          const ciphertextAndNonceAndSalt = base64ToByteArray(\n            base64CiphertextAndNonceAndSalt,\n          );\n\n          // Create buffers of salt and ciphertextAndNonce.\n          const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);\n          return salt;\n        }\n      }\n      throw new Error(\n        `Unsupported encrypted data payload - ${encryptedDataStr}`,\n      );\n    } catch (e) {\n      const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);\n      throw new Error(`Unable to get salt - ${errorMessage}`);\n    }\n  }\n\n  getIfEntriesHaveDifferentSalts(entries: string[]): boolean {\n    const salts = entries\n      .map((e) => {\n        try {\n          return this.getSalt(e);\n        } catch {\n          return undefined;\n        }\n      })\n      .filter((s): s is Uint8Array => s !== undefined);\n\n    const strSet = new Set(salts.map((arr) => arr.toString()));\n    return strSet.size === salts.length;\n  }\n\n  #encrypt(plaintext: Uint8Array, key: Uint8Array): Uint8Array {\n    const nonce = randomBytes(ALGORITHM_NONCE_SIZE);\n\n    // Encrypt and prepend nonce.\n    const ciphertext = gcm(key, nonce).encrypt(plaintext);\n\n    return concatBytes(nonce, ciphertext);\n  }\n\n  #decrypt(ciphertextAndNonce: Uint8Array, key: Uint8Array): Uint8Array {\n    // Create buffers of nonce and ciphertext.\n    const nonce = ciphertextAndNonce.slice(0, ALGORITHM_NONCE_SIZE);\n    const ciphertext = ciphertextAndNonce.slice(\n      ALGORITHM_NONCE_SIZE,\n      ciphertextAndNonce.length,\n    );\n\n    // Decrypt and return result.\n    return gcm(key, nonce).decrypt(ciphertext);\n  }\n\n  async #getOrGenerateScryptKey(\n    password: string,\n    o: EncryptedPayload['o'],\n    salt?: Uint8Array,\n    nativeScryptCrypto?: NativeScrypt,\n  ) {\n    const hashedPassword = createSHA256Hash(password);\n    const cachedKey = salt\n      ? getCachedKeyBySalt(hashedPassword, salt)\n      : getCachedKeyGeneratedWithSharedSalt(hashedPassword);\n\n    if (cachedKey) {\n      return {\n        key: cachedKey.key,\n        salt: cachedKey.salt,\n      };\n    }\n\n    const newSalt = salt ?? SHARED_SALT;\n\n    let newKey: Uint8Array;\n\n    if (nativeScryptCrypto) {\n      newKey = await nativeScryptCrypto(\n        stringToByteArray(password),\n        newSalt,\n        o.N,\n        o.r,\n        o.p,\n        o.dkLen,\n      );\n    } else {\n      newKey = await scryptAsync(password, newSalt, {\n        N: o.N,\n        r: o.r,\n        p: o.p,\n        dkLen: o.dkLen,\n      });\n    }\n\n    setCachedKey(hashedPassword, newSalt, newKey);\n\n    return {\n      key: newKey,\n      salt: newSalt,\n    };\n  }\n}\n\nconst encryption = new EncryptorDecryptor();\nexport default encryption;\n\n/**\n * Receive a SHA256 hash from a given string\n * @param data - input\n * @returns sha256 hash\n */\nexport function createSHA256Hash(data: string): string {\n  const hashedData = sha256(data);\n  return bytesToHex(hashedData);\n}\n"]}

package/dist/shared/encryption/encryption.d.cts

@@ -15,6 +15,8 @@ declare class EncryptorDecryptor {
     #private;
     encryptString(plaintext: string, password: string, nativeScryptCrypto?: NativeScrypt): Promise<string>;
     decryptString(encryptedDataStr: string, password: string, nativeScryptCrypto?: NativeScrypt): Promise<string>;
+    getSalt(encryptedDataStr: string): Uint8Array;
+    getIfEntriesHaveDifferentSalts(entries: string[]): boolean;
 }
 declare const encryption: EncryptorDecryptor;
 export default encryption;

package/dist/shared/encryption/encryption.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.cts","sourceRoot":"","sources":["../../../src/shared/encryption/encryption.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,gCAA4B;AASxD,MAAM,MAAM,gBAAgB,GAAG;IAE7B,CAAC,EAAE,GAAG,CAAC;IAGP,CAAC,EAAE,QAAQ,CAAC;IAGZ,CAAC,EAAE,MAAM,CAAC;IAGV,CAAC,EAAE;QAED,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IAGF,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAeF,cAAM,kBAAkB;;IAChB,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,CAAC,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAaZ,aAAa,CACjB,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,CAAC,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;CAuKnB;AAED,QAAA,MAAM,UAAU,oBAA2B,CAAC;AAC5C,eAAe,UAAU,CAAC;AAE1B;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD"}
+{"version":3,"file":"encryption.d.cts","sourceRoot":"","sources":["../../../src/shared/encryption/encryption.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,gCAA4B;AAsBxD,MAAM,MAAM,gBAAgB,GAAG;IAE7B,CAAC,EAAE,GAAG,CAAC;IAGP,CAAC,EAAE,QAAQ,CAAC;IAGZ,CAAC,EAAE,MAAM,CAAC;IAGV,CAAC,EAAE;QAED,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IAGF,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,cAAM,kBAAkB;;IAChB,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,CAAC,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAaZ,aAAa,CACjB,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,CAAC,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAoGlB,OAAO,CAAC,gBAAgB,EAAE,MAAM;IA0BhC,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO;CAmF3D;AAED,QAAA,MAAM,UAAU,oBAA2B,CAAC;AAC5C,eAAe,UAAU,CAAC;AAE1B;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD"}

package/dist/shared/encryption/encryption.d.mts

@@ -15,6 +15,8 @@ declare class EncryptorDecryptor {
     #private;
     encryptString(plaintext: string, password: string, nativeScryptCrypto?: NativeScrypt): Promise<string>;
     decryptString(encryptedDataStr: string, password: string, nativeScryptCrypto?: NativeScrypt): Promise<string>;
+    getSalt(encryptedDataStr: string): Uint8Array;
+    getIfEntriesHaveDifferentSalts(entries: string[]): boolean;
 }
 declare const encryption: EncryptorDecryptor;
 export default encryption;

package/dist/shared/encryption/encryption.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.d.mts","sourceRoot":"","sources":["../../../src/shared/encryption/encryption.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,gCAA4B;AASxD,MAAM,MAAM,gBAAgB,GAAG;IAE7B,CAAC,EAAE,GAAG,CAAC;IAGP,CAAC,EAAE,QAAQ,CAAC;IAGZ,CAAC,EAAE,MAAM,CAAC;IAGV,CAAC,EAAE;QAED,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IAGF,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAeF,cAAM,kBAAkB;;IAChB,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,CAAC,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAaZ,aAAa,CACjB,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,CAAC,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;CAuKnB;AAED,QAAA,MAAM,UAAU,oBAA2B,CAAC;AAC5C,eAAe,UAAU,CAAC;AAE1B;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD"}
+{"version":3,"file":"encryption.d.mts","sourceRoot":"","sources":["../../../src/shared/encryption/encryption.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,gCAA4B;AAsBxD,MAAM,MAAM,gBAAgB,GAAG;IAE7B,CAAC,EAAE,GAAG,CAAC;IAGP,CAAC,EAAE,QAAQ,CAAC;IAGZ,CAAC,EAAE,MAAM,CAAC;IAGV,CAAC,EAAE;QAED,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,CAAC,EAAE,MAAM,CAAC;QACV,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IAGF,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,cAAM,kBAAkB;;IAChB,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,CAAC,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAaZ,aAAa,CACjB,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,MAAM,EAChB,kBAAkB,CAAC,EAAE,YAAY,GAChC,OAAO,CAAC,MAAM,CAAC;IAoGlB,OAAO,CAAC,gBAAgB,EAAE,MAAM;IA0BhC,8BAA8B,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO;CAmF3D;AAED,QAAA,MAAM,UAAU,oBAA2B,CAAC;AAC5C,eAAe,UAAU,CAAC;AAE1B;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGrD"}

package/dist/shared/encryption/encryption.mjs

@@ -9,19 +9,9 @@ import { randomBytes } from "@noble/ciphers/webcrypto";
 import { scryptAsync } from "@noble/hashes/scrypt";
 import { sha256 } from "@noble/hashes/sha256";
 import { utf8ToBytes, concatBytes, bytesToHex } from "@noble/hashes/utils";
-import { getAnyCachedKey, getCachedKeyBySalt, setCachedKey } from "./cache.mjs";
+import { getCachedKeyBySalt, getCachedKeyGeneratedWithSharedSalt, setCachedKey } from "./cache.mjs";
+import { ALGORITHM_KEY_SIZE, ALGORITHM_NONCE_SIZE, SCRYPT_N, SCRYPT_p, SCRYPT_r, SCRYPT_SALT_SIZE, SHARED_SALT } from "./constants.mjs";
 import { base64ToByteArray, byteArrayToBase64, bytesToUtf8, stringToByteArray } from "./utils.mjs";
-// Nonce/Key Sizes
-const ALGORITHM_NONCE_SIZE = 12; // 12 bytes
-const ALGORITHM_KEY_SIZE = 16; // 16 bytes
-// Scrypt settings
-// see: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#scrypt
-const SCRYPT_SALT_SIZE = 16; // 16 bytes
-const SCRYPT_N = 2 ** 17; // CPU/memory cost parameter (must be a power of 2, > 1)
-// eslint-disable-next-line @typescript-eslint/naming-convention
-const SCRYPT_r = 8; // Block size parameter
-// eslint-disable-next-line @typescript-eslint/naming-convention
-const SCRYPT_p = 1; // Parallelization parameter
 class EncryptorDecryptor {
     constructor() {
         _EncryptorDecryptor_instances.add(this);
@@ -50,6 +40,40 @@ class EncryptorDecryptor {
             throw new Error(`Unable to decrypt string - ${errorMessage}`);
         }
     }
+    getSalt(encryptedDataStr) {
+        try {
+            const encryptedData = JSON.parse(encryptedDataStr);
+            if (encryptedData.v === '1') {
+                if (encryptedData.t === 'scrypt') {
+                    const { d: base64CiphertextAndNonceAndSalt, saltLen } = encryptedData;
+                    // Decode the base64.
+                    const ciphertextAndNonceAndSalt = base64ToByteArray(base64CiphertextAndNonceAndSalt);
+                    // Create buffers of salt and ciphertextAndNonce.
+                    const salt = ciphertextAndNonceAndSalt.slice(0, saltLen);
+                    return salt;
+                }
+            }
+            throw new Error(`Unsupported encrypted data payload - ${encryptedDataStr}`);
+        }
+        catch (e) {
+            const errorMessage = e instanceof Error ? e.message : JSON.stringify(e);
+            throw new Error(`Unable to get salt - ${errorMessage}`);
+        }
+    }
+    getIfEntriesHaveDifferentSalts(entries) {
+        const salts = entries
+            .map((e) => {
+            try {
+                return this.getSalt(e);
+            }
+            catch {
+                return undefined;
+            }
+        })
+            .filter((s) => s !== undefined);
+        const strSet = new Set(salts.map((arr) => arr.toString()));
+        return strSet.size === salts.length;
+    }
 }
 _EncryptorDecryptor_instances = new WeakSet(), _EncryptorDecryptor_encryptStringV1 = async function _EncryptorDecryptor_encryptStringV1(plaintext, password, nativeScryptCrypto) {
     const { key, salt } = await __classPrivateFieldGet(this, _EncryptorDecryptor_instances, "m", _EncryptorDecryptor_getOrGenerateScryptKey).call(this, password, {
@@ -107,14 +131,14 @@ _EncryptorDecryptor_instances = new WeakSet(), _EncryptorDecryptor_encryptString
     const hashedPassword = createSHA256Hash(password);
     const cachedKey = salt
         ? getCachedKeyBySalt(hashedPassword, salt)
-        : getAnyCachedKey(hashedPassword);
+        : getCachedKeyGeneratedWithSharedSalt(hashedPassword);
     if (cachedKey) {
         return {
             key: cachedKey.key,
             salt: cachedKey.salt,
         };
     }
-    const newSalt = salt ?? randomBytes(SCRYPT_SALT_SIZE);
+    const newSalt = salt ?? SHARED_SALT;
     let newKey;
     if (nativeScryptCrypto) {
         newKey = await nativeScryptCrypto(stringToByteArray(password), newSalt, o.N, o.r, o.p, o.dkLen);