@neohm/nestend 4.1.1 → 5.0.1

package/dist/common/services/cache.service.js

@@ -18,76 +18,109 @@ const common_1 = require("@nestjs/common");
 const ioredis_1 = __importDefault(require("ioredis"));
 const encryption_service_1 = require("./encryption.service");
 const cache_types_1 = require("../types/cache.types");
+const cache_default_enum_1 = require("../enums/cache.default.enum");
 let CacheService = CacheService_1 = class CacheService {
-    constructor(encryptionService, connection) {
+    constructor(encryptionService, connection, keyPrefix = process.env.CACHE_KEY_PREFIX ?? '') {
         this.encryptionService = encryptionService;
         this.logger = new common_1.Logger(CacheService_1.name);
-        this.redis = new ioredis_1.default({ lazyConnect: true, ...connection });
-        this.redis.on('error', (err) => this.logger.error('Redis cache error', err));
+        const { keyPrefix: connectionPrefix, ...options } = connection;
+        this.prefix = keyPrefix || connectionPrefix || '';
+        this.redis = new ioredis_1.default({ lazyConnect: true, ...options });
+        this.redis.on('error', (err) => this.logger.error(`Redis cache error: ${err.message}`));
     }
     async set(key, data, options) {
         const encrypt = options?.encrypt ?? false;
         const ttlSecs = (0, cache_types_1.ttlToSeconds)(options?.ttl);
         let storedData = data;
         if (encrypt)
-            storedData = this.encryptionService.encryptObject(data);
+            storedData = this.encryptionService.encryptObject(data, this.k(key));
         const envelope = {
             data: storedData,
             options: { isEncrypted: encrypt },
         };
-        await this.redis.set(key, JSON.stringify(envelope), 'EX', ttlSecs);
+        await this.redis.set(this.k(key), JSON.stringify(envelope), 'EX', ttlSecs);
     }
     async get(key) {
-        const raw = await this.redis.get(key);
+        const raw = await this.redis.get(this.k(key));
         if (!raw)
             return null;
         try {
             const envelope = JSON.parse(raw);
             if (envelope.options?.isEncrypted)
-                return this.encryptionService.decryptObject(envelope.data);
+                return this.decryptCached(envelope.data, key);
             return envelope.data;
         }
-        catch (err) {
-            this.logger.error(`Failed to parse cache value for key "${key}"`, err);
+        catch {
+            this.logger.error(`Failed to read cache value for key "${key}"`);
             return null;
         }
     }
     async del(key) {
-        await this.redis.del(key);
+        await this.redis.del(this.k(key));
     }
     async exists(key) {
-        return (await this.redis.exists(key)) > 0;
+        return (await this.redis.exists(this.k(key))) > 0;
     }
     async ttl(key) {
-        return this.redis.ttl(key);
+        return this.redis.ttl(this.k(key));
     }
     async keys(pattern) {
-        return this.redis.keys(pattern);
+        const found = [];
+        for await (const batch of this.scan(pattern))
+            found.push(...batch.map((key) => key.slice(this.prefix.length)));
+        return found;
     }
     async flushByPattern(pattern) {
-        const keys = await this.redis.keys(pattern);
-        if (keys.length > 0)
-            await this.redis.del(...keys);
+        if (!pattern || (/^\*+$/.test(pattern) && !this.prefix))
+            throw new Error('flushByPattern refuses a match-all pattern without a CACHE_KEY_PREFIX');
+        let removed = 0;
+        for await (const batch of this.scan(pattern)) {
+            if (batch.length)
+                removed += await this.redis.unlink(...batch);
+        }
+        return removed;
     }
     async setRaw(key, value, ttlSeconds) {
-        if (ttlSeconds)
-            await this.redis.set(key, value, 'EX', ttlSeconds);
+        if (ttlSeconds !== undefined)
+            await this.redis.set(this.k(key), value, 'EX', Math.max(1, Math.ceil(ttlSeconds) || 1));
         else
-            await this.redis.set(key, value);
+            await this.redis.set(this.k(key), value);
     }
     async getRaw(key) {
-        return this.redis.get(key);
+        return this.redis.get(this.k(key));
+    }
+    async increment(key, windowSeconds) {
+        const ttl = Math.max(1, Math.ceil(windowSeconds) || 1);
+        const count = await this.redis.eval("local c = redis.call('INCR', KEYS[1]) if c == 1 then redis.call('EXPIRE', KEYS[1], ARGV[1]) end return c", 1, this.k(key), ttl);
+        return Number(count);
     }
     getRedisClient() {
         return this.redis;
     }
+    getKeyPrefix() {
+        return this.prefix;
+    }
     async onModuleDestroy() {
         await this.redis.quit();
     }
+    k(key) {
+        return `${this.prefix}${key}`;
+    }
+    decryptCached(cipherText, key) {
+        return this.encryptionService.decryptObject(cipherText, this.k(key));
+    }
+    async *scan(pattern) {
+        let cursor = '0';
+        do {
+            const [next, keys] = await this.redis.scan(cursor, 'MATCH', this.k(pattern), 'COUNT', cache_default_enum_1.CacheDefault.SCAN_COUNT);
+            cursor = next;
+            yield keys;
+        } while (cursor !== '0');
+    }
 };
 exports.CacheService = CacheService;
 exports.CacheService = CacheService = CacheService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [encryption_service_1.EncryptionService, Object])
+    __metadata("design:paramtypes", [encryption_service_1.EncryptionService, Object, String])
 ], CacheService);
 //# sourceMappingURL=cache.service.js.map

package/dist/common/services/cache.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.service.js","sourceRoot":"","sources":["../../../src/common/services/cache.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAqE;AACrE,sDAA8C;AAC9C,6DAAyD;AACzD,sDAI8B;AAGvB,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAIvB,YACmB,iBAAoC,EACrD,UAAwB;QADP,sBAAiB,GAAjB,iBAAiB,CAAmB;QAJtC,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;QAUtD,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAK,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAC5C,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,IAAO,EAAE,OAAyB;QAC1D,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAA,0BAAY,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,UAAU,GAAY,IAAI,CAAC;QAC/B,IAAI,OAAO;YAAE,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAkB;YAC9B,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;SAClC,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAClD,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW;gBAC/B,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAI,QAAQ,CAAC,IAAc,CAAC,CAAC;YAC1E,OAAO,QAAQ,CAAC,IAAS,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wCAAwC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;YACvE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,UAAmB;QAC1D,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;;YAC9D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;CACF,CAAA;AA5EY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAM2B,sCAAiB;GAL5C,YAAY,CA4ExB"}
+{"version":3,"file":"cache.service.js","sourceRoot":"","sources":["../../../src/common/services/cache.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAqE;AACrE,sDAA8C;AAC9C,6DAAyD;AACzD,sDAI8B;AAC9B,oEAA2D;AAOpD,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAKvB,YACmB,iBAAoC,EACrD,UAAwB,EACxB,YAAoB,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE;QAFrC,sBAAiB,GAAjB,iBAAiB,CAAmB;QALtC,WAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;QAWtD,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,OAAO,EAAE,GAAG,UAAU,CAAC;QAC/D,IAAI,CAAC,MAAM,GAAG,SAAS,IAAI,gBAAgB,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAK,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW,EAAE,IAAO,EAAE,OAAyB;QAC1D,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAA,0BAAY,EAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,UAAU,GAAY,IAAI,CAAC;QAC/B,IAAI,OAAO;YACT,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAkB;YAC9B,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;SAClC,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,GAAW;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;YAClD,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW;gBAC/B,OAAO,IAAI,CAAC,aAAa,CAAI,QAAQ,CAAC,IAAc,EAAE,GAAG,CAAC,CAAC;YAC7D,OAAO,QAAQ,CAAC,IAAS,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,GAAG,GAAG,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAGD,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,UAAmB;QAC1D,IAAI,UAAU,KAAK,SAAS;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EACX,KAAK,EACL,IAAI,EACJ,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CACxC,CAAC;;YACC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IAGD,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,aAAqB;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACjC,0GAA0G,EAC1G,CAAC,EACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EACX,GAAG,CACJ,CAAC;QACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAGD,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,CAAC,CAAC,GAAW;QACnB,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;IAChC,CAAC;IAGO,aAAa,CAAI,UAAkB,EAAE,GAAW;QACtD,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAI,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,CAAC,IAAI,CAAC,OAAe;QACjC,IAAI,MAAM,GAAG,GAAG,CAAC;QACjB,GAAG,CAAC;YACF,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACxC,MAAM,EACN,OAAO,EACP,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EACf,OAAO,EACP,iCAAY,CAAC,UAAU,CACxB,CAAC;YACF,MAAM,GAAG,IAAI,CAAC;YACd,MAAM,IAAI,CAAC;QACb,CAAC,QAAQ,MAAM,KAAK,GAAG,EAAE;IAC3B,CAAC;CACF,CAAA;AA7IY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAO2B,sCAAiB;GAN5C,YAAY,CA6IxB"}

package/dist/common/services/encryption.service.d.ts

@@ -1,9 +1,25 @@
+import type { EncryptionOptions } from '../types/encryption.types';
+export declare class EncryptionException extends Error {
+    constructor(message?: string);
+}
 export declare class EncryptionService {
     private readonly logger;
-    private get secret();
-    encrypt(plainText: string): string;
-    decrypt(cipherText: string): string;
-    encryptObject<T>(data: T): string;
-    decryptObject<T>(cipherText: string): T;
+    private readonly current;
+    private readonly keys;
+    private readonly legacyKeyCache;
+    constructor(options?: EncryptionOptions);
+    encrypt(plainText: string, aad?: string): string;
+    decrypt(cipherText: string, aad?: string): string;
+    encryptObject<T>(data: T, aad?: string): string;
+    decryptObject<T>(cipherText: string, aad?: string): T;
+    needsReencryption(cipherText: string): boolean;
+    reencrypt(cipherText: string, aad?: string): string;
+    private static deriveMaster;
+    private messageKey;
+    private decryptV1;
+    private decryptLegacy;
+    private legacyKey;
+    private split;
+    private open;
 }
 //# sourceMappingURL=encryption.service.d.ts.map

package/dist/common/services/encryption.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.service.d.ts","sourceRoot":"","sources":["../../../src/common/services/encryption.service.ts"],"names":[],"mappings":"AAYA,qBACa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAE7D,OAAO,KAAK,MAAM,GAKjB;IAED,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAoBlC,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IA6BnC,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM;IAIjC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,CAAC;CAGxC"}
+{"version":3,"file":"encryption.service.d.ts","sourceRoot":"","sources":["../../../src/common/services/encryption.service.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,iBAAiB,EAAa,MAAM,2BAA2B,CAAC;AAG9E,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,SAAgC;CAIpD;AAQD,qBACa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAc;IAEnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6B;gBAGlB,OAAO,CAAC,EAAE,iBAAiB;IAkBrE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM;IA0BhD,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM;IAYjD,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM;IAI/C,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC;IAKrD,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAO9C,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM;IAInD,OAAO,CAAC,MAAM,CAAC,YAAY;IAa3B,OAAO,CAAC,UAAU;IAYlB,OAAO,CAAC,SAAS;IASjB,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,SAAS;IAejB,OAAO,CAAC,KAAK;IAab,OAAO,CAAC,IAAI;CAkBb"}

package/dist/common/services/encryption.service.js

@@ -5,73 +5,165 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 var EncryptionService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EncryptionService = void 0;
+exports.EncryptionService = exports.EncryptionException = void 0;
 const common_1 = require("@nestjs/common");
 const crypto_1 = require("crypto");
 const encryption_enum_1 = require("../enums/encryption.enum");
+class EncryptionException extends Error {
+    constructor(message = 'Encryption operation failed') {
+        super(message);
+        this.name = 'EncryptionException';
+    }
+}
+exports.EncryptionException = EncryptionException;
 let EncryptionService = EncryptionService_1 = class EncryptionService {
-    constructor() {
+    constructor(options) {
         this.logger = new common_1.Logger(EncryptionService_1.name);
-    }
-    get secret() {
-        const secret = process.env.ENCRYPTION_SECRET;
+        this.legacyKeyCache = new Map();
+        const secret = options?.secret ?? process.env.ENCRYPTION_SECRET;
+        const previousSecret = options?.previousSecret ?? process.env.ENCRYPTION_SECRET_PREVIOUS;
         if (!secret)
-            throw new Error('ENCRYPTION_SECRET environment variable is not set');
-        return secret;
+            throw new Error('ENCRYPTION_SECRET is not set');
+        if (Buffer.byteLength(secret, 'utf8') < encryption_enum_1.EncryptionConfig.MIN_SECRET_BYTES)
+            throw new Error(`ENCRYPTION_SECRET must be at least ${encryption_enum_1.EncryptionConfig.MIN_SECRET_BYTES} bytes`);
+        this.current = EncryptionService_1.deriveMaster(secret);
+        this.keys = [this.current];
+        if (previousSecret && previousSecret !== secret)
+            this.keys.push(EncryptionService_1.deriveMaster(previousSecret));
     }
-    encrypt(plainText) {
+    encrypt(plainText, aad) {
         try {
             const salt = (0, crypto_1.randomBytes)(encryption_enum_1.EncryptionConfig.SALT_LENGTH);
             const iv = (0, crypto_1.randomBytes)(encryption_enum_1.EncryptionConfig.IV_LENGTH);
-            const key = (0, crypto_1.scryptSync)(this.secret, salt, encryption_enum_1.EncryptionConfig.KEY_LENGTH);
+            const key = this.messageKey(this.current.key, salt);
             const cipher = (0, crypto_1.createCipheriv)(encryption_enum_1.EncryptionAlgorithm.AES_256_GCM, key, iv, {
                 authTagLength: encryption_enum_1.EncryptionConfig.AUTH_TAG_LENGTH,
             });
+            if (aad !== undefined)
+                cipher.setAAD(Buffer.from(aad, 'utf8'));
             const encrypted = Buffer.concat([
                 cipher.update(plainText, 'utf8'),
                 cipher.final(),
             ]);
-            const authTag = cipher.getAuthTag();
-            return Buffer.concat([salt, iv, authTag, encrypted]).toString('base64');
+            const blob = Buffer.concat([
+                salt,
+                iv,
+                cipher.getAuthTag(),
+                encrypted,
+            ]).toString('base64');
+            return `${encryption_enum_1.EncryptionFormat.V1}:${this.current.id}:${blob}`;
         }
-        catch (err) {
-            this.logger.error('Encryption failed', err);
-            throw err;
+        catch {
+            this.logger.error('Encryption failed');
+            throw new EncryptionException();
         }
     }
-    decrypt(cipherText) {
+    decrypt(cipherText, aad) {
         try {
-            const buf = Buffer.from(cipherText, 'base64');
-            const s = encryption_enum_1.EncryptionConfig.SALT_LENGTH;
-            const i = encryption_enum_1.EncryptionConfig.IV_LENGTH;
-            const a = encryption_enum_1.EncryptionConfig.AUTH_TAG_LENGTH;
-            const salt = buf.subarray(0, s);
-            const iv = buf.subarray(s, s + i);
-            const authTag = buf.subarray(s + i, s + i + a);
-            const encrypted = buf.subarray(s + i + a);
-            const key = (0, crypto_1.scryptSync)(this.secret, salt, encryption_enum_1.EncryptionConfig.KEY_LENGTH);
-            const decipher = (0, crypto_1.createDecipheriv)(encryption_enum_1.EncryptionAlgorithm.AES_256_GCM, key, iv, {
-                authTagLength: a,
-            });
-            decipher.setAuthTag(authTag);
-            return (decipher.update(encrypted, undefined, 'utf8') + decipher.final('utf8'));
+            if (typeof cipherText !== 'string')
+                throw new Error('not a string');
+            if (cipherText.startsWith(`${encryption_enum_1.EncryptionFormat.V1}:`))
+                return this.decryptV1(cipherText, aad);
+            return this.decryptLegacy(cipherText);
+        }
+        catch {
+            this.logger.warn('Decryption failed');
+            throw new EncryptionException('Decryption failed');
+        }
+    }
+    encryptObject(data, aad) {
+        return this.encrypt(JSON.stringify(data), aad);
+    }
+    decryptObject(cipherText, aad) {
+        return JSON.parse(this.decrypt(cipherText, aad));
+    }
+    needsReencryption(cipherText) {
+        return !cipherText?.startsWith(`${encryption_enum_1.EncryptionFormat.V1}:${this.current.id}:`);
+    }
+    reencrypt(cipherText, aad) {
+        return this.encrypt(this.decrypt(cipherText, aad), aad);
+    }
+    static deriveMaster(secret) {
+        const key = (0, crypto_1.scryptSync)(secret, encryption_enum_1.EncryptionKdf.MASTER_SALT, encryption_enum_1.EncryptionConfig.KEY_LENGTH);
+        const id = (0, crypto_1.createHash)('sha256')
+            .update(key)
+            .digest('hex')
+            .slice(0, encryption_enum_1.EncryptionConfig.KEY_ID_LENGTH);
+        return { id, secret, key };
+    }
+    messageKey(master, salt) {
+        return Buffer.from((0, crypto_1.hkdfSync)('sha256', master, salt, encryption_enum_1.EncryptionKdf.HKDF_INFO, encryption_enum_1.EncryptionConfig.KEY_LENGTH));
+    }
+    decryptV1(cipherText, aad) {
+        const [, keyId, blob] = cipherText.split(':');
+        const master = this.keys.find((candidate) => candidate.id === keyId);
+        if (!master || !blob)
+            throw new Error('unknown key');
+        const parts = this.split(Buffer.from(blob, 'base64'));
+        return this.open(this.messageKey(master.key, parts.salt), parts, aad);
+    }
+    decryptLegacy(cipherText) {
+        const parts = this.split(Buffer.from(cipherText, 'base64'));
+        let lastError;
+        for (const master of this.keys) {
+            try {
+                return this.open(this.legacyKey(master, parts.salt), parts);
+            }
+            catch (error) {
+                lastError = error;
+            }
         }
-        catch (err) {
-            this.logger.error('Decryption failed', err);
-            throw err;
+        throw lastError;
+    }
+    legacyKey(master, salt) {
+        const cacheKey = `${master.id}:${salt.toString('base64')}`;
+        const cached = this.legacyKeyCache.get(cacheKey);
+        if (cached) {
+            this.legacyKeyCache.delete(cacheKey);
+            this.legacyKeyCache.set(cacheKey, cached);
+            return cached;
         }
+        const key = (0, crypto_1.scryptSync)(master.secret, salt, encryption_enum_1.EncryptionConfig.KEY_LENGTH);
+        this.legacyKeyCache.set(cacheKey, key);
+        if (this.legacyKeyCache.size > encryption_enum_1.EncryptionConfig.LEGACY_KEY_CACHE_SIZE)
+            this.legacyKeyCache.delete(this.legacyKeyCache.keys().next().value);
+        return key;
     }
-    encryptObject(data) {
-        return this.encrypt(JSON.stringify(data));
+    split(buf) {
+        const s = encryption_enum_1.EncryptionConfig.SALT_LENGTH;
+        const i = encryption_enum_1.EncryptionConfig.IV_LENGTH;
+        const a = encryption_enum_1.EncryptionConfig.AUTH_TAG_LENGTH;
+        if (buf.length < s + i + a)
+            throw new Error('truncated');
+        return {
+            salt: buf.subarray(0, s),
+            iv: buf.subarray(s, s + i),
+            authTag: buf.subarray(s + i, s + i + a),
+            encrypted: buf.subarray(s + i + a),
+        };
     }
-    decryptObject(cipherText) {
-        return JSON.parse(this.decrypt(cipherText));
+    open(key, parts, aad) {
+        const decipher = (0, crypto_1.createDecipheriv)(encryption_enum_1.EncryptionAlgorithm.AES_256_GCM, key, parts.iv, { authTagLength: encryption_enum_1.EncryptionConfig.AUTH_TAG_LENGTH });
+        if (aad !== undefined)
+            decipher.setAAD(Buffer.from(aad, 'utf8'));
+        decipher.setAuthTag(parts.authTag);
+        return (decipher.update(parts.encrypted, undefined, 'utf8') +
+            decipher.final('utf8'));
     }
 };
 exports.EncryptionService = EncryptionService;
 exports.EncryptionService = EncryptionService = EncryptionService_1 = __decorate([
-    (0, common_1.Injectable)()
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Optional)()),
+    __param(0, (0, common_1.Inject)(encryption_enum_1.ENCRYPTION_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
 ], EncryptionService);
 //# sourceMappingURL=encryption.service.js.map

package/dist/common/services/encryption.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"encryption.service.js","sourceRoot":"","sources":["../../../src/common/services/encryption.service.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAoD;AACpD,mCAKgB;AAChB,8DAGkC;AAG3B,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAAvB;QACY,WAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAiE/D,CAAC;IA/DC,IAAY,MAAM;QAChB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC7C,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,kCAAgB,CAAC,WAAW,CAAC,CAAC;YACvD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,kCAAgB,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,kCAAgB,CAAC,UAAU,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,qCAAmB,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE;gBACtE,aAAa,EAAE,kCAAgB,CAAC,eAAe;aAChD,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;gBAChC,MAAM,CAAC,KAAK,EAAE;aACf,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,UAAkB;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,kCAAgB,CAAC,WAAW,CAAC;YACvC,MAAM,CAAC,GAAG,kCAAgB,CAAC,SAAS,CAAC;YACrC,MAAM,CAAC,GAAG,kCAAgB,CAAC,eAAe,CAAC;YAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAChC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,kCAAgB,CAAC,UAAU,CAAC,CAAC;YACvE,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAC/B,qCAAmB,CAAC,WAAW,EAC/B,GAAG,EACH,EAAE,EACF;gBACE,aAAa,EAAE,CAAC;aACjB,CACF,CAAC;YACF,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,CACL,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CACvE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;YAC5C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,aAAa,CAAI,IAAO;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,aAAa,CAAI,UAAkB;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAM,CAAC;IACnD,CAAC;CACF,CAAA;AAlEY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAkE7B"}
+{"version":3,"file":"encryption.service.js","sourceRoot":"","sources":["../../../src/common/services/encryption.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAsE;AACtE,mCAOgB;AAChB,8DAMkC;AAIlC,MAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAO,GAAG,6BAA6B;QACjD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC;AASM,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAO5B,YAC0C,OAA2B;QAPpD,WAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;QAI5C,mBAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;QAK1D,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAChE,MAAM,cAAc,GAClB,OAAO,EAAE,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,kCAAgB,CAAC,gBAAgB;YACvE,MAAM,IAAI,KAAK,CACb,sCAAsC,kCAAgB,CAAC,gBAAgB,QAAQ,CAChF,CAAC;QACJ,IAAI,CAAC,OAAO,GAAG,mBAAiB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE3B,IAAI,cAAc,IAAI,cAAc,KAAK,MAAM;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAiB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC;IACnE,CAAC;IAGD,OAAO,CAAC,SAAiB,EAAE,GAAY;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,kCAAgB,CAAC,WAAW,CAAC,CAAC;YACvD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,kCAAgB,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,qCAAmB,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE;gBACtE,aAAa,EAAE,kCAAgB,CAAC,eAAe;aAChD,CAAC,CAAC;YACH,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;gBAChC,MAAM,CAAC,KAAK,EAAE;aACf,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;gBACzB,IAAI;gBACJ,EAAE;gBACF,MAAM,CAAC,UAAU,EAAE;gBACnB,SAAS;aACV,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO,GAAG,kCAAgB,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,MAAM,IAAI,mBAAmB,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,UAAkB,EAAE,GAAY;QACtC,IAAI,CAAC;YACH,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YACpE,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,kCAAgB,CAAC,EAAE,GAAG,CAAC;gBAClD,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACzC,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACtC,MAAM,IAAI,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,aAAa,CAAI,IAAO,EAAE,GAAY;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,aAAa,CAAI,UAAkB,EAAE,GAAY;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAM,CAAC;IACxD,CAAC;IAGD,iBAAiB,CAAC,UAAkB;QAClC,OAAO,CAAC,UAAU,EAAE,UAAU,CAC5B,GAAG,kCAAgB,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,CAC7C,CAAC;IACJ,CAAC;IAGD,SAAS,CAAC,UAAkB,EAAE,GAAY;QACxC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAEO,MAAM,CAAC,YAAY,CAAC,MAAc;QACxC,MAAM,GAAG,GAAG,IAAA,mBAAU,EACpB,MAAM,EACN,+BAAa,CAAC,WAAW,EACzB,kCAAgB,CAAC,UAAU,CAC5B,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;aAC5B,MAAM,CAAC,GAAG,CAAC;aACX,MAAM,CAAC,KAAK,CAAC;aACb,KAAK,CAAC,CAAC,EAAE,kCAAgB,CAAC,aAAa,CAAC,CAAC;QAC5C,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC7B,CAAC;IAEO,UAAU,CAAC,MAAc,EAAE,IAAY;QAC7C,OAAO,MAAM,CAAC,IAAI,CAChB,IAAA,iBAAQ,EACN,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,+BAAa,CAAC,SAAS,EACvB,kCAAgB,CAAC,UAAU,CAC5B,CACF,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,UAAkB,EAAE,GAAY;QAChD,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAGO,aAAa,CAAC,UAAkB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5D,IAAI,SAAkB,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,SAAS,GAAG,KAAK,CAAC;YACpB,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC;IAClB,CAAC;IAEO,SAAS,CAAC,MAAiB,EAAE,IAAY;QAC/C,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC1C,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,kCAAgB,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,kCAAgB,CAAC,qBAAqB;YACnE,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,MAAM,CAAC,GAAG,kCAAgB,CAAC,WAAW,CAAC;QACvC,MAAM,CAAC,GAAG,kCAAgB,CAAC,SAAS,CAAC;QACrC,MAAM,CAAC,GAAG,kCAAgB,CAAC,eAAe,CAAC;QAC3C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QACzD,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvC,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SACnC,CAAC;IACJ,CAAC;IAEO,IAAI,CACV,GAAW,EACX,KAAyD,EACzD,GAAY;QAEZ,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAC/B,qCAAmB,CAAC,WAAW,EAC/B,GAAG,EACH,KAAK,CAAC,EAAE,EACR,EAAE,aAAa,EAAE,kCAAgB,CAAC,eAAe,EAAE,CACpD,CAAC;QACF,IAAI,GAAG,KAAK,SAAS;YAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QACjE,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,CACL,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;YACnD,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CACvB,CAAC;IACJ,CAAC;CACF,CAAA;AAjLY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,iBAAQ,GAAE,CAAA;IAAE,WAAA,IAAA,eAAM,EAAC,oCAAkB,CAAC,CAAA;;GAR9B,iBAAiB,CAiL7B"}

package/dist/common/services/list.filter.service.d.ts

@@ -7,6 +7,8 @@ export declare class ListFilterService {
     private constructFinalQuery;
     private constructOrderByStatement;
     private constructFilterConditions;
+    private bindParams;
+    private assertPayloadShape;
     private constructSoftDeleteCondition;
     private constructSearchCondition;
     private resolveColumn;

package/dist/common/services/list.filter.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.filter.service.d.ts","sourceRoot":"","sources":["../../../src/common/services/list.filter.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAEL,gBAAgB,EAEhB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AAiD7B,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,UAAU;IAE7C,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAuCpE,OAAO,CAAC,mBAAmB;IAyC3B,OAAO,CAAC,yBAAyB;IAgCjC,OAAO,CAAC,yBAAyB;IAkCjC,OAAO,CAAC,4BAA4B;IAoBpC,OAAO,CAAC,wBAAwB;IAuBhC,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,oBAAoB;IA4B5B,OAAO,CAAC,gBAAgB;IAaxB,OAAO,CAAC,eAAe;CAuDxB"}
+{"version":3,"file":"list.filter.service.d.ts","sourceRoot":"","sources":["../../../src/common/services/list.filter.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAEL,gBAAgB,EAEhB,iBAAiB,EAElB,MAAM,qBAAqB,CAAC;AAuC7B,qBACa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,UAAU;IAE7C,OAAO,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6CpE,OAAO,CAAC,mBAAmB;IAyC3B,OAAO,CAAC,yBAAyB;IAgCjC,OAAO,CAAC,yBAAyB;IA+BjC,OAAO,CAAC,UAAU;IAWlB,OAAO,CAAC,kBAAkB;IA4C1B,OAAO,CAAC,4BAA4B;IAqBpC,OAAO,CAAC,wBAAwB;IAyBhC,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,oBAAoB;IAgC5B,OAAO,CAAC,gBAAgB;IAaxB,OAAO,CAAC,eAAe;CA0DxB"}

package/dist/common/services/list.filter.service.js

@@ -19,13 +19,7 @@ const sql_default_enum_1 = require("../enums/sql.default.enum");
 const sql_service_1 = require("./sql.service");
 const filter_operator_registry_1 = require("../libraries/filter.operator.registry");
 const filter_operator_defaults_1 = require("../libraries/filter.operator.defaults");
-const SEARCH_PARAM = 'search_str';
-const SOFT_DELETE_COLUMN = 'deleted_at';
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function escapeLikePattern(value) {
-    return value.replace(/[\\%_]/g, (character) => `\\${character}`);
-}
-const CALENDAR_DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+const list_filter_default_enum_1 = require("../enums/list.filter.default.enum");
 function isRealCalendarDate(value) {
     const [year, month, day] = value.split('-').map(Number);
     const parsed = new Date(Date.UTC(year, month - 1, day));
@@ -38,6 +32,7 @@ let ListFilterService = class ListFilterService {
         this.sqlService = sqlService;
     }
     async execute(request) {
+        this.assertPayloadShape(request.payload);
         const context = {
             ...request,
             conditions: [],
@@ -48,7 +43,9 @@ let ListFilterService = class ListFilterService {
         this.constructSoftDeleteCondition(context);
         const finalQuery = this.constructFinalQuery(context);
         const page = Math.max(context.payload?.page ?? sql_default_enum_1.SqlDefault.PAGE, 1);
-        const limit = Math.min(Math.max(context.payload?.limit ?? sql_default_enum_1.SqlDefault.LIMIT, 1), context.config.maxLimit ?? sql_default_enum_1.SqlDefault.MAX_LIMIT);
+        if (page > sql_default_enum_1.SqlDefault.MAX_PAGE)
+            throw new operation_exception_1.OperationException(`page must not exceed ${sql_default_enum_1.SqlDefault.MAX_PAGE}`);
+        const limit = Math.min(Math.max(context.payload?.limit ?? sql_default_enum_1.SqlDefault.LIMIT, 1), Math.min(context.config.maxLimit ?? sql_default_enum_1.SqlDefault.MAX_LIMIT, sql_default_enum_1.SqlDefault.MAX_LIMIT));
         const result = await this.sqlService.paginate(finalQuery, context.filterParams, { page, limit });
         return {
             records: result.data,
@@ -102,22 +99,68 @@ let ListFilterService = class ListFilterService {
         context.filterParams = { ...context.predicates.bindings };
         for (const [index, filter] of (context.payload?.filters ?? []).entries()) {
             const column = this.resolveColumn(context, filter.identifier);
-            const buildClause = filter_operator_registry_1.FILTER_OPERATORS[filter.operator];
+            const buildClause = Object.prototype.hasOwnProperty.call(filter_operator_registry_1.FILTER_OPERATORS, filter.operator)
+                ? filter_operator_registry_1.FILTER_OPERATORS[filter.operator]
+                : undefined;
             if (!buildClause)
                 throw new operation_exception_1.OperationException(`Unsupported filter operator: ${filter.operator}`);
             this.assertOperatorAllowed(column, filter.operator);
             const { clause, params } = buildClause(column.identifier, `filter_${index}`, this.transformFilterValue(filter, column));
             context.conditions.push(clause);
-            Object.assign(context.filterParams, params);
+            this.bindParams(context.filterParams, params);
+        }
+    }
+    bindParams(target, params) {
+        for (const [name, value] of Object.entries(params)) {
+            if (Object.prototype.hasOwnProperty.call(target, name))
+                throw new operation_exception_1.OperationException(`Bind parameter "${name}" collides with a server predicate`);
+            target[name] = value;
+        }
+    }
+    assertPayloadShape(payload) {
+        if (payload == null)
+            return;
+        if (typeof payload !== 'object')
+            throw new operation_exception_1.OperationException('Invalid list payload');
+        const { page, limit, str, filters, sorts } = payload;
+        if (page !== undefined && page !== null && !Number.isInteger(page))
+            throw new operation_exception_1.OperationException('page must be an integer');
+        if (limit !== undefined && limit !== null && !Number.isInteger(limit))
+            throw new operation_exception_1.OperationException('limit must be an integer');
+        if (str !== undefined && str !== null) {
+            if (typeof str !== 'string')
+                throw new operation_exception_1.OperationException('str must be a string');
+            if (str.length > sql_default_enum_1.SqlDefault.MAX_SEARCH_LENGTH)
+                throw new operation_exception_1.OperationException('str is too long');
+        }
+        if (filters !== undefined && filters !== null) {
+            if (!Array.isArray(filters) || filters.length > sql_default_enum_1.SqlDefault.MAX_FILTERS)
+                throw new operation_exception_1.OperationException('Invalid filters');
+            for (const filter of filters)
+                if (!filter ||
+                    typeof filter.identifier !== 'string' ||
+                    typeof filter.operator !== 'string' ||
+                    (filter.value !== undefined &&
+                        filter.value !== null &&
+                        typeof filter.value !== 'string') ||
+                    (filter.value?.length ?? 0) > sql_default_enum_1.SqlDefault.MAX_FILTER_VALUE_LENGTH)
+                    throw new operation_exception_1.OperationException('Invalid filter');
+        }
+        if (sorts !== undefined && sorts !== null) {
+            if (!Array.isArray(sorts) || sorts.length > sql_default_enum_1.SqlDefault.MAX_SORTS)
+                throw new operation_exception_1.OperationException('Invalid sorts');
+            for (const sort of sorts)
+                if (!sort || typeof sort.identifier !== 'string')
+                    throw new operation_exception_1.OperationException('Invalid sort');
         }
     }
     constructSoftDeleteCondition(context) {
         if (context.config.includeDeleted)
             return;
-        const column = context.config.columns.find((candidate) => candidate.identifier === SOFT_DELETE_COLUMN);
+        const column = context.config.columns.find((candidate) => candidate.identifier === list_filter_default_enum_1.ListFilterDefault.SOFT_DELETE_COLUMN);
         if (!column)
             return;
-        context.conditions.push(`${SOFT_DELETE_COLUMN} IS NULL`);
+        context.conditions.push(`${list_filter_default_enum_1.ListFilterDefault.SOFT_DELETE_COLUMN} IS NULL`);
     }
     constructSearchCondition(context) {
         const term = context.payload?.str?.trim();
@@ -127,10 +170,12 @@ let ListFilterService = class ListFilterService {
         if (!columns.length)
             throw new operation_exception_1.OperationException('This list does not support free-text search');
         const clause = columns
-            .map((column) => `CAST(${column.identifier} AS TEXT) ILIKE :${SEARCH_PARAM} ESCAPE '\\'`)
+            .map((column) => `CAST(${column.identifier} AS TEXT) ILIKE :${list_filter_default_enum_1.ListFilterDefault.SEARCH_PARAM} ESCAPE '\\'`)
             .join(' or ');
         context.conditions.push(clause);
-        context.filterParams[SEARCH_PARAM] = `%${escapeLikePattern(term)}%`;
+        this.bindParams(context.filterParams, {
+            [list_filter_default_enum_1.ListFilterDefault.SEARCH_PARAM]: `%${(0, filter_operator_registry_1.escapeLikePattern)(term)}%`,
+        });
     }
     resolveColumn(context, identifier) {
         const column = context.config.columns.find((candidate) => candidate.identifier === identifier);
@@ -153,8 +198,12 @@ let ListFilterService = class ListFilterService {
         switch (filter.operator) {
             case filter_operator_enum_1.FilterOperatorEnum.IS_NULL:
                 return !['false', '0', ''].includes((filter.value ?? '').trim().toLowerCase());
-            case filter_operator_enum_1.FilterOperatorEnum.IN:
-                return this.splitFilterValue(filter).map((part) => this.castFilterValue(part, column));
+            case filter_operator_enum_1.FilterOperatorEnum.IN: {
+                const parts = this.splitFilterValue(filter);
+                if (parts.length > sql_default_enum_1.SqlDefault.MAX_IN_VALUES)
+                    throw new operation_exception_1.OperationException(`Filter on ${filter.identifier} accepts at most ${sql_default_enum_1.SqlDefault.MAX_IN_VALUES} values`);
+                return parts.map((part) => this.castFilterValue(part, column));
+            }
             case filter_operator_enum_1.FilterOperatorEnum.BETWEEN: {
                 const parts = this.splitFilterValue(filter);
                 if (parts.length !== 2)
@@ -178,7 +227,7 @@ let ListFilterService = class ListFilterService {
         const valueType = column.type ?? filter_value_type_enum_1.FilterValueTypeEnum.STRING;
         switch (valueType) {
             case filter_value_type_enum_1.FilterValueTypeEnum.UUID: {
-                if (!UUID_PATTERN.test(raw?.trim() ?? ''))
+                if (!list_filter_default_enum_1.ListFilterPattern.UUID.test(raw?.trim() ?? ''))
                     throw new operation_exception_1.OperationException(`Invalid uuid filter value on ${column.identifier}`);
                 return raw.trim();
             }
@@ -192,7 +241,8 @@ let ListFilterService = class ListFilterService {
             }
             case filter_value_type_enum_1.FilterValueTypeEnum.DATE: {
                 const value = raw?.trim() ?? '';
-                if (!CALENDAR_DATE_PATTERN.test(value) || !isRealCalendarDate(value))
+                if (!list_filter_default_enum_1.ListFilterPattern.CALENDAR_DATE.test(value) ||
+                    !isRealCalendarDate(value))
                     throw new operation_exception_1.OperationException(`Invalid date filter value on ${column.identifier}: expected YYYY-MM-DD`);
                 return value;
             }