@nextage/nx-frame-be 1.0.42 → 1.0.44

package/build/common/__test__/random-string.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/common/__test__/random-string.test.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../utils");
+/**
+ * `randomString` must return a URL-safe token of the requested length. The
+ * base64url alphabet (`A-Za-z0-9-_`) avoids the `+`/`/`/`=` characters that the
+ * previous base64 implementation could emit, so the value is safe in URLs,
+ * tokens and filenames.
+ */
+describe('randomString', () => {
+    const URL_SAFE = /^[A-Za-z0-9_-]+$/;
+    it('returns a string of the requested length (default 21)', () => {
+        expect((0, utils_1.randomString)()).toHaveLength(21);
+        expect((0, utils_1.randomString)(7)).toHaveLength(7);
+        expect((0, utils_1.randomString)(32)).toHaveLength(32);
+    });
+    it('only uses URL-safe characters (no +, /, =)', () => {
+        for (const size of [7, 12, 21, 40]) {
+            const value = (0, utils_1.randomString)(size);
+            expect(value).toMatch(URL_SAFE);
+            expect(value).not.toContain('+');
+            expect(value).not.toContain('/');
+            expect(value).not.toContain('=');
+        }
+    });
+    it('is effectively unique across calls', () => {
+        const values = new Set(Array.from({ length: 500 }, () => (0, utils_1.randomString)(21)));
+        expect(values.size).toBe(500);
+    });
+});

package/build/common/constants.js

@@ -18,7 +18,7 @@ exports.APP = {
     dataScr: process.env.SECRET,
     nxPubSub: new pubsub_manager_1.PubSubManager(),
     shutdownMng: new shutdown_manager_1.ShutdownManager(),
-    config: { endpoint: {}, email: {}, jwt: {}, aws: {}, mongo: {}, logging: {}, invite: {}, msg: {} }
+    config: { endpoint: {}, email: {}, jwt: {}, aws: {}, mongo: {}, logging: {}, invite: {}, msg: {}, app: {} }
 };
 exports.FILE_CONTENT_TYPES = {
     none: '',

package/build/common/crypto/__test__/crypto.utils.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/common/crypto/__test__/crypto.utils.test.js

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const constants_1 = require("../../constants");
+const crypto_legacy_1 = require("../crypto-legacy");
+const crypto_constants_1 = require("../crypto.constants");
+/**
+ * `CryptoUtils` migrated off `crypto-js` onto `node:crypto`.
+ *
+ * These tests pin two contracts:
+ *  1. the hash/PBKDF2 helpers stay BYTE-COMPATIBLE with the previous CryptoJS
+ *     output (oracle vectors captured while crypto-js was still installed), so
+ *     existing blind indexes keep matching;
+ *  2. field encryption uses authenticated AES-256-GCM (`v1:` scheme) while still
+ *     decrypting the legacy OpenSSL `Salted__` format for backward compatibility.
+ */
+describe('CryptoUtils (node:crypto)', () => {
+    // Oracle vectors produced by crypto-js 4.2.0 before its removal.
+    const ORACLE = {
+        md5: '5d41402abc4b2a76b9719d911017c592',
+        sha256: '2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824',
+        sha512: '9b71d224bd62f3785d96d46ad3ea3d73319bfbc2890caadae2dff72519673ca72323c3d99ba5c11d7c7acc6e14b8c5da0c4663475c2e5c3adef46f73bcdec043',
+        pbkdf2: '64747239499f1befef7f59618f443dd8f2ec330698a919978a6b4d90b14aa915',
+        // AES.encrypt('secret-data-àéì', 'passphrase-123')
+        legacy: 'U2FsdGVkX18FAy7zi7VFY7AD1ebKT3xBwKo9UavXDMgWA1DKBQ4RHgnYaWlV7gof',
+    };
+    describe('hashes stay byte-compatible with crypto-js', () => {
+        it('md5', () => expect(constants_1.cryptoUtils.md5('hello')).toBe(ORACLE.md5));
+        it('sha256', () => expect(constants_1.cryptoUtils.sha256('hello')).toBe(ORACLE.sha256));
+        it('sha512', () => expect(constants_1.cryptoUtils.sha512('hello')).toBe(ORACLE.sha512));
+        it('pbkdf2 blind index (256-bit, sha256, 10000)', () => {
+            expect(constants_1.cryptoUtils.pbkdf2('value', 'salt')).toBe(ORACLE.pbkdf2);
+        });
+        it('empty input returns empty string', () => {
+            expect(constants_1.cryptoUtils.md5('')).toBe('');
+            expect(constants_1.cryptoUtils.sha256('')).toBe('');
+            expect(constants_1.cryptoUtils.sha512('')).toBe('');
+            expect(constants_1.cryptoUtils.pbkdf2('', 'salt')).toBe('');
+        });
+    });
+    describe('field encryption (AES-256-GCM v1)', () => {
+        const secret = 'test-secret-passphrase';
+        it('round-trips a value and stamps the v1 prefix', () => {
+            const plain = 'user@example.com';
+            const enc = constants_1.cryptoUtils.encryptText(plain, secret);
+            expect(enc.startsWith(crypto_constants_1.FIELD_ENC_PREFIX)).toBe(true);
+            expect(enc).not.toContain(plain);
+            expect(constants_1.cryptoUtils.decryptText(enc, secret)).toBe(plain);
+        });
+        it('produces a different ciphertext each time (random IV)', () => {
+            const a = constants_1.cryptoUtils.encryptText('same', secret);
+            const b = constants_1.cryptoUtils.encryptText('same', secret);
+            expect(a).not.toBe(b);
+            expect(constants_1.cryptoUtils.decryptText(a, secret)).toBe('same');
+            expect(constants_1.cryptoUtils.decryptText(b, secret)).toBe('same');
+        });
+        it('handles unicode', () => {
+            const plain = 'àéìòù — 日本語 — €';
+            const enc = constants_1.cryptoUtils.encryptText(plain, secret);
+            expect(constants_1.cryptoUtils.decryptText(enc, secret)).toBe(plain);
+        });
+        it('returns empty string on empty input', () => {
+            expect(constants_1.cryptoUtils.encryptText('', secret)).toBe('');
+            expect(constants_1.cryptoUtils.decryptText('', secret)).toBe('');
+            expect(constants_1.cryptoUtils.encryptText('x', '')).toBe('');
+        });
+        it('fails closed on a tampered ciphertext (GCM auth)', () => {
+            const enc = constants_1.cryptoUtils.encryptText('sensitive', secret);
+            // Flip a character in the base64 body → auth tag no longer verifies.
+            const body = enc.slice(crypto_constants_1.FIELD_ENC_PREFIX.length);
+            const tampered = crypto_constants_1.FIELD_ENC_PREFIX + (body[0] === 'A' ? 'B' : 'A') + body.slice(1);
+            expect(constants_1.cryptoUtils.decryptText(tampered, secret)).toBe('');
+        });
+        it('wrong secret does not decrypt', () => {
+            const enc = constants_1.cryptoUtils.encryptText('sensitive', secret);
+            expect(constants_1.cryptoUtils.decryptText(enc, 'other-secret')).toBe('');
+        });
+        it('re-rotation: decrypt with old secret, re-encrypt with new secret', () => {
+            const plain = 'rotate-me';
+            const v1old = constants_1.cryptoUtils.encryptText(plain, 'old-secret');
+            // Simulate the migration engine's rotation step.
+            const roundTrip = constants_1.cryptoUtils.decryptText(v1old, 'old-secret');
+            const v1new = constants_1.cryptoUtils.encryptText(roundTrip, 'new-secret');
+            expect(constants_1.cryptoUtils.decryptText(v1new, 'new-secret')).toBe(plain);
+            expect(constants_1.cryptoUtils.decryptText(v1new, 'old-secret')).toBe('');
+        });
+    });
+    describe('legacy CryptoJS compatibility', () => {
+        it('detects a legacy Salted__ ciphertext', () => {
+            expect((0, crypto_legacy_1.isLegacyCiphertext)(ORACLE.legacy)).toBe(true);
+            expect((0, crypto_legacy_1.isLegacyCiphertext)('v1:abc')).toBe(false);
+            expect((0, crypto_legacy_1.isLegacyCiphertext)('plain text')).toBe(false);
+            expect((0, crypto_legacy_1.isLegacyCiphertext)('')).toBe(false);
+        });
+        it('decrypts a real crypto-js ciphertext via node:crypto', () => {
+            expect((0, crypto_legacy_1.decryptLegacyAes)(ORACLE.legacy, 'passphrase-123')).toBe('secret-data-àéì');
+        });
+        it('decryptText transparently reads legacy values', () => {
+            expect(constants_1.cryptoUtils.decryptText(ORACLE.legacy, 'passphrase-123')).toBe('secret-data-àéì');
+        });
+    });
+});

package/build/common/crypto/__test__/migrate-encrypted-fields.test.d.ts

@@ -0,0 +1 @@
+export {};

package/build/common/crypto/__test__/migrate-encrypted-fields.test.js

@@ -0,0 +1,105 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const user_model_1 = require("../../models/user.model");
+const constants_1 = require("../../constants");
+const migrate_encrypted_fields_1 = require("../migrate-encrypted-fields");
+const crypto_constants_1 = require("../crypto.constants");
+/**
+ * `reEncryptLegacyFields` bulk-migrates legacy CryptoJS field ciphertexts to the
+ * current AES-256-GCM scheme, operating at the native driver level so it neither
+ * re-runs getters (read) nor setters (write). These tests seed a raw legacy value
+ * (produced by crypto-js 4.2.0 with secret 'aaa'), migrate it, and assert the
+ * value becomes readable `v1:` — and that a second run is a no-op (idempotent).
+ */
+describe('reEncryptLegacyFields', () => {
+    const SECRET = 'aaa'; // matches src/test/env.ts
+    // crypto-js AES.encrypt('mario.rossi@example.com', 'aaa') captured pre-removal.
+    const LEGACY_EMAIL = 'U2FsdGVkX18wA04OcAdQSqF5R07te9XD+nuXAMAbCaI8kSXFdK7bNBdSjKPyIvrX';
+    const LEGACY_PLAINTEXT = 'mario.rossi@example.com';
+    it('migrates a legacy value to the v1 GCM scheme and stays idempotent', () => __awaiter(void 0, void 0, void 0, function* () {
+        const collection = user_model_1.users.mgModel.collection;
+        // Seed a raw document with a legacy-encrypted email (bypassing setters).
+        const { insertedId } = yield collection.insertOne({
+            username: 'mario',
+            email: LEGACY_EMAIL,
+            version: 0,
+        });
+        // --- first run: should migrate the field ---
+        const res1 = yield (0, migrate_encrypted_fields_1.reEncryptLegacyFields)({
+            targets: [{ model: user_model_1.users, fields: ['email'] }],
+            secret: SECRET,
+        });
+        expect(res1.migrated).toBe(1);
+        expect(res1.errors).toBe(0);
+        const migrated = yield collection.findOne({ _id: insertedId });
+        expect(migrated.email.startsWith(crypto_constants_1.FIELD_ENC_PREFIX)).toBe(true);
+        expect(constants_1.cryptoUtils.decryptText(migrated.email, SECRET)).toBe(LEGACY_PLAINTEXT);
+        // --- second run: nothing left to migrate ---
+        const res2 = yield (0, migrate_encrypted_fields_1.reEncryptLegacyFields)({
+            targets: [{ model: user_model_1.users, fields: ['email'] }],
+            secret: SECRET,
+        });
+        expect(res2.migrated).toBe(0);
+        expect(res2.skipped).toBe(1);
+    }));
+    it('dry-run reports the work without writing', () => __awaiter(void 0, void 0, void 0, function* () {
+        const collection = user_model_1.users.mgModel.collection;
+        const { insertedId } = yield collection.insertOne({
+            username: 'anna',
+            email: LEGACY_EMAIL,
+            version: 0,
+        });
+        const res = yield (0, migrate_encrypted_fields_1.reEncryptLegacyFields)({
+            targets: [{ model: user_model_1.users, fields: ['email'] }],
+            secret: SECRET,
+            dryRun: true,
+        });
+        expect(res.migrated).toBe(1);
+        const untouched = yield collection.findOne({ _id: insertedId });
+        expect(untouched.email).toBe(LEGACY_EMAIL); // unchanged on disk
+    }));
+    it('skips empty and already-migrated values', () => __awaiter(void 0, void 0, void 0, function* () {
+        const collection = user_model_1.users.mgModel.collection;
+        yield collection.insertOne({ username: 'empty', email: '', version: 0 });
+        yield collection.insertOne({
+            username: 'fresh',
+            email: constants_1.cryptoUtils.encryptText('fresh@example.com', SECRET),
+            version: 0,
+        });
+        const res = yield (0, migrate_encrypted_fields_1.reEncryptLegacyFields)({
+            targets: [{ model: user_model_1.users, fields: ['email'] }],
+            secret: SECRET,
+        });
+        expect(res.migrated).toBe(0);
+        expect(res.skipped).toBe(2);
+    }));
+    it('migrates a nested field without wiping its siblings', () => __awaiter(void 0, void 0, void 0, function* () {
+        const collection = user_model_1.users.mgModel.collection;
+        // Only `profile.email` is legacy; firstname/lastname are plain siblings that
+        // MUST survive (a nested-object $set would replace the whole `profile`).
+        const { insertedId } = yield collection.insertOne({
+            username: 'nested',
+            profile: { email: LEGACY_EMAIL, firstname: 'Mario', lastname: 'Rossi' },
+            version: 0,
+        });
+        const res = yield (0, migrate_encrypted_fields_1.reEncryptLegacyFields)({
+            targets: [{ model: user_model_1.users, fields: ['profile.email'] }],
+            secret: SECRET,
+        });
+        expect(res.migrated).toBe(1);
+        const doc = yield collection.findOne({ _id: insertedId });
+        expect(doc.profile.firstname).toBe('Mario'); // sibling preserved
+        expect(doc.profile.lastname).toBe('Rossi'); // sibling preserved
+        expect(doc.profile.email.startsWith(crypto_constants_1.FIELD_ENC_PREFIX)).toBe(true);
+        expect(constants_1.cryptoUtils.decryptText(doc.profile.email, SECRET)).toBe(LEGACY_PLAINTEXT);
+    }));
+});

package/build/common/crypto/crypto-legacy.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Detects whether a stored value is a legacy CryptoJS/OpenSSL ciphertext.
+ *
+ * @param text the stored field value
+ * @returns `true` if it base64-decodes to the `Salted__` header
+ */
+export declare function isLegacyCiphertext(text: unknown): boolean;
+/**
+ * Decrypts a legacy CryptoJS/OpenSSL `Salted__` ciphertext.
+ *
+ * @param text   the base64 legacy ciphertext
+ * @param secret the passphrase used to encrypt it
+ * @returns the decrypted UTF-8 plaintext
+ * @throws if the payload is not a valid `Salted__` block
+ */
+export declare function decryptLegacyAes(text: string, secret: string): string;

package/build/common/crypto/crypto-legacy.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLegacyCiphertext = isLegacyCiphertext;
+exports.decryptLegacyAes = decryptLegacyAes;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const crypto_constants_1 = require("./crypto.constants");
+/**
+ * Backward-compatibility decryptor for values produced by the previous
+ * `CryptoJS.AES.encrypt(text, passphrase)` implementation.
+ *
+ * CryptoJS emits the OpenSSL format: base64 of `"Salted__" | salt(8) |
+ * ciphertext`, where the AES-256-CBC key and IV are derived from the passphrase
+ * and salt with OpenSSL's `EVP_BytesToKey` (one round of MD5). This module
+ * re-implements that derivation with `node:crypto`, so `crypto-js` can be
+ * dropped while existing ciphertexts remain readable.
+ */
+const SALT_HEADER_BYTES = 8;
+const SALT_BYTES = 8;
+const AES_KEY_BYTES = 32; // AES-256
+const AES_IV_BYTES = 16; // CBC IV
+/**
+ * OpenSSL `EVP_BytesToKey` with a single MD5 digest per block.
+ *
+ * Derives `keyLen + ivLen` bytes by hashing `previousBlock | password | salt`
+ * repeatedly, exactly as OpenSSL/CryptoJS do for `AES.encrypt(text, passphrase)`.
+ *
+ * @param password the passphrase (secret) as used by CryptoJS
+ * @param salt     the 8-byte salt extracted from the payload
+ * @param keyLen   number of key bytes to derive (32 for AES-256)
+ * @param ivLen    number of IV bytes to derive (16 for CBC)
+ */
+function evpBytesToKey(password, salt, keyLen, ivLen) {
+    const pwd = Buffer.from(password, 'utf8');
+    let derived = Buffer.alloc(0);
+    let block = Buffer.alloc(0);
+    while (derived.length < keyLen + ivLen) {
+        block = node_crypto_1.default.createHash('md5').update(Buffer.concat([block, pwd, salt])).digest();
+        derived = Buffer.concat([derived, block]);
+    }
+    return {
+        key: derived.subarray(0, keyLen),
+        iv: derived.subarray(keyLen, keyLen + ivLen),
+    };
+}
+/**
+ * Detects whether a stored value is a legacy CryptoJS/OpenSSL ciphertext.
+ *
+ * @param text the stored field value
+ * @returns `true` if it base64-decodes to the `Salted__` header
+ */
+function isLegacyCiphertext(text) {
+    if (!text || typeof text !== 'string')
+        return false;
+    try {
+        const raw = Buffer.from(text, 'base64');
+        return raw.length > SALT_HEADER_BYTES + SALT_BYTES
+            && raw.subarray(0, SALT_HEADER_BYTES).toString('latin1') === crypto_constants_1.LEGACY_ENC_MAGIC;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+/**
+ * Decrypts a legacy CryptoJS/OpenSSL `Salted__` ciphertext.
+ *
+ * @param text   the base64 legacy ciphertext
+ * @param secret the passphrase used to encrypt it
+ * @returns the decrypted UTF-8 plaintext
+ * @throws if the payload is not a valid `Salted__` block
+ */
+function decryptLegacyAes(text, secret) {
+    const raw = Buffer.from(text, 'base64');
+    if (raw.subarray(0, SALT_HEADER_BYTES).toString('latin1') !== crypto_constants_1.LEGACY_ENC_MAGIC)
+        throw new Error('Not a legacy Salted__ ciphertext');
+    const salt = raw.subarray(SALT_HEADER_BYTES, SALT_HEADER_BYTES + SALT_BYTES);
+    const ciphertext = raw.subarray(SALT_HEADER_BYTES + SALT_BYTES);
+    const { key, iv } = evpBytesToKey(secret, salt, AES_KEY_BYTES, AES_IV_BYTES);
+    const decipher = node_crypto_1.default.createDecipheriv('aes-256-cbc', key, iv);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+}

package/build/common/crypto/crypto.constants.d.ts

@@ -5,6 +5,17 @@ export declare const CRYPTO_SYM_BITSIZE = 256;
 export declare const CRYPTO_ASYM_BITSIZE_LIST: number[];
 export declare const CRYPTO_PUB_KEY_ENCODING: KeyEncoding;
 export declare const CRYPTO_PRIV_KEY_ENCODING: KeyEncoding;
+export declare const FIELD_ENC_VERSION = "v1";
+export declare const FIELD_ENC_PREFIX = "v1:";
+export declare const FIELD_ENC_ALGO = "aes-256-gcm";
+export declare const FIELD_ENC_IV_BYTES = 12;
+export declare const FIELD_ENC_TAG_BYTES = 16;
+export declare const FIELD_ENC_KEY_BYTES = 32;
+export declare const FIELD_ENC_KDF_SALT = "nxfb.field.v1";
+export declare const FIELD_ENC_KDF_N = 16384;
+export declare const FIELD_ENC_KDF_R = 8;
+export declare const FIELD_ENC_KDF_P = 1;
+export declare const LEGACY_ENC_MAGIC = "Salted__";
 export declare const CRYPTO_SYM_BITSIZE_MAP: NxTypeObject<KeySizeMap>;
 export declare enum CRYPTO_ERR_CODES {
     BITSIZE = "ERR_INVALID_BITSIZE",

package/build/common/crypto/crypto.constants.js

@@ -1,11 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CRYPTO_ERRORS = exports.CRYPTO_ERR_CODES = exports.CRYPTO_SYM_BITSIZE_MAP = exports.CRYPTO_PRIV_KEY_ENCODING = exports.CRYPTO_PUB_KEY_ENCODING = exports.CRYPTO_ASYM_BITSIZE_LIST = exports.CRYPTO_SYM_BITSIZE = exports.CRYPTO_ASYM_BITSIZE = void 0;
+exports.CRYPTO_ERRORS = exports.CRYPTO_ERR_CODES = exports.CRYPTO_SYM_BITSIZE_MAP = exports.LEGACY_ENC_MAGIC = exports.FIELD_ENC_KDF_P = exports.FIELD_ENC_KDF_R = exports.FIELD_ENC_KDF_N = exports.FIELD_ENC_KDF_SALT = exports.FIELD_ENC_KEY_BYTES = exports.FIELD_ENC_TAG_BYTES = exports.FIELD_ENC_IV_BYTES = exports.FIELD_ENC_ALGO = exports.FIELD_ENC_PREFIX = exports.FIELD_ENC_VERSION = exports.CRYPTO_PRIV_KEY_ENCODING = exports.CRYPTO_PUB_KEY_ENCODING = exports.CRYPTO_ASYM_BITSIZE_LIST = exports.CRYPTO_SYM_BITSIZE = exports.CRYPTO_ASYM_BITSIZE = void 0;
 exports.CRYPTO_ASYM_BITSIZE = 4096;
 exports.CRYPTO_SYM_BITSIZE = 256;
 exports.CRYPTO_ASYM_BITSIZE_LIST = [1024, 2048, 4096];
 exports.CRYPTO_PUB_KEY_ENCODING = { type: 'spki', format: 'pem' };
 exports.CRYPTO_PRIV_KEY_ENCODING = { type: 'pkcs8', format: 'pem' };
+// ---------------------------------------------------------------------------
+// Field-level symmetric encryption (encryptText / decryptText).
+//
+// New scheme: AES-256-GCM (authenticated) with a random 12-byte IV per value.
+// The stored value is `<version>:<base64(iv | authTag | ciphertext)>`, where the
+// version prefix identifies the scheme and enables key rotation (a future `v2`
+// can coexist with `v1`). The AES key is derived from the secret passphrase with
+// scrypt (memory-hard) and cached per secret+version.
+//
+// Legacy scheme (produced by the previous CryptoJS.AES implementation) has NO
+// version prefix: it is OpenSSL "Salted__" base64 (MD5 EVP_BytesToKey +
+// AES-256-CBC). `decryptText` still reads it for backward compatibility.
+// ---------------------------------------------------------------------------
+exports.FIELD_ENC_VERSION = 'v1';
+exports.FIELD_ENC_PREFIX = `${exports.FIELD_ENC_VERSION}:`;
+exports.FIELD_ENC_ALGO = 'aes-256-gcm';
+exports.FIELD_ENC_IV_BYTES = 12;
+exports.FIELD_ENC_TAG_BYTES = 16;
+exports.FIELD_ENC_KEY_BYTES = 32;
+// scrypt KDF parameters used to derive the AES key from the secret passphrase.
+// `N=16384,r=8,p=1` needs ~16 MB and is derived once per secret (then cached).
+exports.FIELD_ENC_KDF_SALT = 'nxfb.field.v1';
+exports.FIELD_ENC_KDF_N = 16384;
+exports.FIELD_ENC_KDF_R = 8;
+exports.FIELD_ENC_KDF_P = 1;
+// Legacy CryptoJS/OpenSSL "Salted__" magic header (8 bytes, then 8-byte salt).
+exports.LEGACY_ENC_MAGIC = 'Salted__';
 exports.CRYPTO_SYM_BITSIZE_MAP = {
     128: {
         keySize: 128,

package/build/common/crypto/crypto.interfaces.d.ts

@@ -38,7 +38,7 @@ export interface KeyAdditionalFieldAttrs {
     value: any;
 }
 export interface BlindIndexOptions {
-    hasher?: any;
+    digest?: string;
     iterations?: number;
     keySize?: number;
     normalize?: boolean;

package/build/common/crypto/crypto.utils.d.ts

@@ -4,6 +4,8 @@ import { BlindIndexOptions } from './crypto.interfaces';
 import { SymmetricKey, AsymmetricKeyPair } from './crypto.classes';
 export declare class CryptoUtils {
     logger: any;
+    /** Cache of scrypt-derived AES keys, keyed by the secret passphrase. */
+    private readonly keyCache;
     constructor();
     /**
      * Generate a random Symmetric key based on AES bit size specified
@@ -52,48 +54,83 @@ export declare class CryptoUtils {
      */
     decypherAsym(privateKey: string, encData: string): Promise<string>;
     /**
-     * Decrypt AES encrypted string using CryptoJs
+     * Derives (and caches) the AES-256 key for a secret passphrase via scrypt.
      *
-     * @param   { string } text AES encrypted string to be decrypted
+     * scrypt is memory-hard; the derivation runs once per distinct secret and the
+     * 32-byte result is cached, so per-field encrypt/decrypt stays cheap.
+     *
+     * @param secret the secret passphrase
+     * @returns the 32-byte AES key
+     */
+    private deriveFieldKey;
+    /**
+     * Decrypts a field value.
+     *
+     * Dispatches on the stored format: a `v1:`-prefixed value is AES-256-GCM
+     * (current scheme); an un-prefixed value is decrypted with the legacy
+     * CryptoJS/OpenSSL reader for backward compatibility. Returns `''` on missing
+     * input or on any decryption failure (matching the previous behaviour).
+     *
+     * @param   { string } text   AES encrypted string to be decrypted
      * @param   { string } secret Secret string to decrypt value
      * @returns { string } Decrypted value
      */
     decryptText(text: string, secret: string): string;
     /**
-     * Encrypt plain text string to AES using CryptoJS
+     * Encrypts a field value with the current scheme (AES-256-GCM).
      *
-     * @param   { string } text Plain text string to be AES encrypted
+     * Output is `v1:<base64(iv | authTag | ciphertext)>`. The version prefix keeps
+     * the value self-describing and enables future key rotation.
+     *
+     * @param   { string } text   Plain text string to be encrypted
      * @param   { string } secret Secret string to encrypt value
      * @returns { string } Encrypted value
      */
     encryptText(text: string, secret: string): string;
     /**
-     * Generate an md5 hash from given string
+     * Decrypts a current-scheme (`v1:`) AES-256-GCM value.
+     *
+     * @param text   the `v1:`-prefixed ciphertext
+     * @param secret the secret passphrase
+     * @returns the decrypted UTF-8 plaintext
+     * @throws if the authentication tag does not verify (tampered/wrong key)
+     */
+    private decryptGcm;
+    /**
+     * Generates an md5 hash (hex) from the given string.
      *
      * @param {string} text
      */
     md5(text: string): string;
     /**
+     * Generates a sha256 hash (hex) from the given string.
      *
-     * @param {*} text
-     * @returns
+     * @param {string} text
+     * @returns {string} the hex digest
      */
     sha256(text: string): string;
     /**
+     * Generates a sha512 hash (hex) from the given string.
      *
      * @param {*} text
-     * @returns
+     * @returns the hex digest
      */
     sha512(text: string): string;
     /**
-     * Encrypt a text to PBKDF2 derivation function using given salt and keysize
+     * Derives a PBKDF2 hash (hex) — used for searchable blind indexes.
+     *
+     * Byte-compatible with the previous CryptoJS implementation: `keySize` is in
+     * bits (default 256 → 32 output bytes) and `digest` selects the PRF hash.
+     * Existing `_bidx` values remain valid.
      *
      * @param { string } text
      * @param { string } salt
-     * @param { number} keySize default 256
-     * @return { string } Hashed value
+     * @param { number } keySize    output size in bits (default 256)
+     * @param { string } digest     PRF hash name (default `'sha256'`)
+     * @param { number } iterations iteration count (default 10000)
+     * @return { string } the hex digest
      */
-    pbkdf2(text: string, salt: string, keySize?: number, hasher?: any, iterations?: number): string;
+    pbkdf2(text: string, salt: string, keySize?: number, digest?: string, iterations?: number): string;
     /**
      * Encrypt a text to PBKDF2 derivation function using given salt and keysize
      *
@@ -124,11 +161,17 @@ export declare class CryptoUtils {
      */
     createBlindIndexes(item: NxObject | undefined, keys: string[] | undefined, secret: string, opts?: BlindIndexOptions): void;
     /**
+     * Computes a searchable blind index (`<key>_bidx`) for a field.
      *
-     * @param {*} item
-     * @param {*} key
+     * Hashes the (optionally upper-cased) value with PBKDF2 so equality searches
+     * are possible over the encrypted field without exposing the plaintext.
+     *
+     * @param item the document, mutated in place with `<key>_bidx`
+     * @param key  the field to index
+     * @param salt per-field salt (falls back to the field name)
+     * @param opts blind-index options (`digest`, `iterations`, `keySize`, `normalize`)
      */
-    createBlindIndex(item: NxObject, key: string, salt: string, { hasher, iterations, keySize, normalize }?: BlindIndexOptions): void;
+    createBlindIndex(item: NxObject, key: string, salt: string, { digest, iterations, keySize, normalize }?: BlindIndexOptions): void;
     /**
      *
      * @param {*} item

package/build/common/crypto/crypto.utils.js

@@ -5,7 +5,6 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CryptoUtils = void 0;
 const crypto_1 = __importDefault(require("crypto"));
-const crypto_js_1 = __importDefault(require("crypto-js"));
 const stream_1 = require("stream");
 const constants_1 = require("../constants");
 const utils_1 = require("../utils");
@@ -15,9 +14,21 @@ const crypto_constants_2 = require("./crypto.constants");
 const crypto_constants_3 = require("./crypto.constants");
 const crypto_constants_4 = require("./crypto.constants");
 const crypto_constants_5 = require("./crypto.constants");
+const crypto_constants_6 = require("./crypto.constants");
+const crypto_constants_7 = require("./crypto.constants");
+const crypto_constants_8 = require("./crypto.constants");
+const crypto_constants_9 = require("./crypto.constants");
+const crypto_constants_10 = require("./crypto.constants");
+const crypto_constants_11 = require("./crypto.constants");
+const crypto_constants_12 = require("./crypto.constants");
+const crypto_constants_13 = require("./crypto.constants");
+const crypto_legacy_1 = require("./crypto-legacy");
+const crypto_legacy_2 = require("./crypto-legacy");
 const crypto_classes_1 = require("./crypto.classes");
 class CryptoUtils {
     constructor() {
+        /** Cache of scrypt-derived AES keys, keyed by the secret passphrase. */
+        this.keyCache = new Map();
         this.logger = constants_1.APP.logger;
     }
     /**
@@ -202,10 +213,37 @@ class CryptoUtils {
         });
     }
     // --------------------------------------------------------- CRYPTO-JS METHODS ---------------------------------------------------------------------------
+    // --------------------------------------------------------- SYMMETRIC FIELD ENCRYPTION ---------------------------------------------------------------
     /**
-     * Decrypt AES encrypted string using CryptoJs
+     * Derives (and caches) the AES-256 key for a secret passphrase via scrypt.
      *
-     * @param   { string } text AES encrypted string to be decrypted
+     * scrypt is memory-hard; the derivation runs once per distinct secret and the
+     * 32-byte result is cached, so per-field encrypt/decrypt stays cheap.
+     *
+     * @param secret the secret passphrase
+     * @returns the 32-byte AES key
+     */
+    deriveFieldKey(secret) {
+        const cached = this.keyCache.get(secret);
+        if (cached)
+            return cached;
+        const key = crypto_1.default.scryptSync(secret, crypto_constants_10.FIELD_ENC_KDF_SALT, crypto_constants_9.FIELD_ENC_KEY_BYTES, {
+            N: crypto_constants_11.FIELD_ENC_KDF_N,
+            r: crypto_constants_12.FIELD_ENC_KDF_R,
+            p: crypto_constants_13.FIELD_ENC_KDF_P,
+        });
+        this.keyCache.set(secret, key);
+        return key;
+    }
+    /**
+     * Decrypts a field value.
+     *
+     * Dispatches on the stored format: a `v1:`-prefixed value is AES-256-GCM
+     * (current scheme); an un-prefixed value is decrypted with the legacy
+     * CryptoJS/OpenSSL reader for backward compatibility. Returns `''` on missing
+     * input or on any decryption failure (matching the previous behaviour).
+     *
+     * @param   { string } text   AES encrypted string to be decrypted
      * @param   { string } secret Secret string to decrypt value
      * @returns { string } Decrypted value
      */
@@ -213,7 +251,12 @@ class CryptoUtils {
         if (!text || !secret)
             return '';
         try {
-            return crypto_js_1.default.AES.decrypt(text, secret).toString(crypto_js_1.default.enc.Utf8);
+            if (text.startsWith(crypto_constants_6.FIELD_ENC_PREFIX))
+                return this.decryptGcm(text, secret);
+            if ((0, crypto_legacy_1.isLegacyCiphertext)(text))
+                return (0, crypto_legacy_2.decryptLegacyAes)(text, secret);
+            // Neither current nor legacy ciphertext: nothing safe to decrypt.
+            return '';
         }
         catch (e) {
             this.logger.error(e, (0, utils_1.logClassCtx)(this, 'decryptText'));
@@ -221,9 +264,12 @@ class CryptoUtils {
         }
     }
     /**
-     * Encrypt plain text string to AES using CryptoJS
+     * Encrypts a field value with the current scheme (AES-256-GCM).
+     *
+     * Output is `v1:<base64(iv | authTag | ciphertext)>`. The version prefix keeps
+     * the value self-describing and enables future key rotation.
      *
-     * @param   { string } text Plain text string to be AES encrypted
+     * @param   { string } text   Plain text string to be encrypted
      * @param   { string } secret Secret string to encrypt value
      * @returns { string } Encrypted value
      */
@@ -231,7 +277,12 @@ class CryptoUtils {
         if (!text || !secret)
             return '';
         try {
-            return crypto_js_1.default.AES.encrypt(text, secret).toString();
+            const key = this.deriveFieldKey(secret);
+            const iv = crypto_1.default.randomBytes(crypto_constants_7.FIELD_ENC_IV_BYTES);
+            const cipher = crypto_1.default.createCipheriv(crypto_constants_6.FIELD_ENC_ALGO, key, iv);
+            const ciphertext = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
+            const authTag = cipher.getAuthTag();
+            return crypto_constants_6.FIELD_ENC_PREFIX + Buffer.concat([iv, authTag, ciphertext]).toString('base64');
         }
         catch (e) {
             this.logger.error(e, (0, utils_1.logClassCtx)(this, 'encryptText'));
@@ -239,47 +290,73 @@ class CryptoUtils {
         }
     }
     /**
-     * Generate an md5 hash from given string
+     * Decrypts a current-scheme (`v1:`) AES-256-GCM value.
+     *
+     * @param text   the `v1:`-prefixed ciphertext
+     * @param secret the secret passphrase
+     * @returns the decrypted UTF-8 plaintext
+     * @throws if the authentication tag does not verify (tampered/wrong key)
+     */
+    decryptGcm(text, secret) {
+        const raw = Buffer.from(text.slice(crypto_constants_6.FIELD_ENC_PREFIX.length), 'base64');
+        const iv = raw.subarray(0, crypto_constants_7.FIELD_ENC_IV_BYTES);
+        const authTag = raw.subarray(crypto_constants_7.FIELD_ENC_IV_BYTES, crypto_constants_7.FIELD_ENC_IV_BYTES + crypto_constants_8.FIELD_ENC_TAG_BYTES);
+        const ciphertext = raw.subarray(crypto_constants_7.FIELD_ENC_IV_BYTES + crypto_constants_8.FIELD_ENC_TAG_BYTES);
+        const key = this.deriveFieldKey(secret);
+        const decipher = crypto_1.default.createDecipheriv(crypto_constants_6.FIELD_ENC_ALGO, key, iv);
+        decipher.setAuthTag(authTag);
+        return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+    }
+    /**
+     * Generates an md5 hash (hex) from the given string.
      *
      * @param {string} text
      */
     md5(text) {
         if (!text)
             return '';
-        return crypto_js_1.default.MD5(text).toString();
+        return crypto_1.default.createHash('md5').update(text).digest('hex');
     }
     /**
+     * Generates a sha256 hash (hex) from the given string.
      *
-     * @param {*} text
-     * @returns
+     * @param {string} text
+     * @returns {string} the hex digest
      */
     sha256(text) {
         if (!text)
             return '';
-        return crypto_js_1.default.SHA256(text).toString();
+        return crypto_1.default.createHash('sha256').update(text).digest('hex');
     }
     /**
+     * Generates a sha512 hash (hex) from the given string.
      *
      * @param {*} text
-     * @returns
+     * @returns the hex digest
      */
     sha512(text) {
         if (!text)
             return '';
-        return crypto_js_1.default.SHA512(text).toString();
+        return crypto_1.default.createHash('sha512').update(text).digest('hex');
     }
     /**
-     * Encrypt a text to PBKDF2 derivation function using given salt and keysize
+     * Derives a PBKDF2 hash (hex) — used for searchable blind indexes.
+     *
+     * Byte-compatible with the previous CryptoJS implementation: `keySize` is in
+     * bits (default 256 → 32 output bytes) and `digest` selects the PRF hash.
+     * Existing `_bidx` values remain valid.
      *
      * @param { string } text
      * @param { string } salt
-     * @param { number} keySize default 256
-     * @return { string } Hashed value
+     * @param { number } keySize    output size in bits (default 256)
+     * @param { string } digest     PRF hash name (default `'sha256'`)
+     * @param { number } iterations iteration count (default 10000)
+     * @return { string } the hex digest
      */
-    pbkdf2(text, salt, keySize = 256, hasher = crypto_js_1.default.algo.SHA256, iterations = 10000) {
+    pbkdf2(text, salt, keySize = 256, digest = 'sha256', iterations = 10000) {
         if (!text || !salt)
             return '';
-        return crypto_js_1.default.PBKDF2(text, salt, { keySize: keySize / 32, hasher, iterations }).toString();
+        return crypto_1.default.pbkdf2Sync(text, salt, iterations, keySize / 8, digest).toString('hex');
     }
     /**
      * Encrypt a text to PBKDF2 derivation function using given salt and keysize
@@ -327,17 +404,23 @@ class CryptoUtils {
         keys.forEach(k => this.createBlindIndex(item, k, secret, opts));
     }
     /**
+     * Computes a searchable blind index (`<key>_bidx`) for a field.
      *
-     * @param {*} item
-     * @param {*} key
+     * Hashes the (optionally upper-cased) value with PBKDF2 so equality searches
+     * are possible over the encrypted field without exposing the plaintext.
+     *
+     * @param item the document, mutated in place with `<key>_bidx`
+     * @param key  the field to index
+     * @param salt per-field salt (falls back to the field name)
+     * @param opts blind-index options (`digest`, `iterations`, `keySize`, `normalize`)
      */
-    createBlindIndex(item, key, salt, { hasher, iterations, keySize, normalize } = {}) {
+    createBlindIndex(item, key, salt, { digest, iterations, keySize, normalize } = {}) {
         let value = (0, utils_1.getAttr)(item, key);
         if (!value)
             return;
         if (normalize)
             value = `${value}`.toUpperCase();
-        (0, utils_1.setAttr)(item, `${key}_bidx`, this.pbkdf2(value, salt || key, keySize, hasher, iterations));
+        (0, utils_1.setAttr)(item, `${key}_bidx`, this.pbkdf2(value, salt || key, keySize, digest, iterations));
     }
     /**
      *

package/build/common/crypto/index.d.ts

@@ -1,4 +1,6 @@
 export * from './crypto.interfaces';
 export * from './crypto.classes';
 export * from './crypto.utils';
+export * from './crypto-legacy';
+export * from './migrate-encrypted-fields';
 export * from './encryption.plugin';

package/build/common/crypto/index.js

@@ -17,4 +17,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./crypto.interfaces"), exports);
 __exportStar(require("./crypto.classes"), exports);
 __exportStar(require("./crypto.utils"), exports);
+__exportStar(require("./crypto-legacy"), exports);
+__exportStar(require("./migrate-encrypted-fields"), exports);
 __exportStar(require("./encryption.plugin"), exports);

package/build/common/crypto/migrate-encrypted-fields.d.ts

@@ -0,0 +1,55 @@
+import { BaseModel } from '../base/base.model';
+/**
+ * Reusable one-shot migration for legacy field-level encryption.
+ *
+ * The previous `CryptoJS.AES` implementation stored un-versioned OpenSSL
+ * `Salted__` ciphertexts. The current scheme is AES-256-GCM with a `v1:`
+ * version prefix. New writes migrate lazily (every `save` re-encrypts through the
+ * model setters), but records that are never re-saved stay in the legacy format.
+ *
+ * This engine bulk-migrates them: it reads documents at the **native driver
+ * level** (bypassing Mongoose getters), and for each configured field decrypts
+ * the legacy value and re-encrypts it with the current scheme, writing back at
+ * the **native driver level** too (bypassing setters, so the value is not
+ * double-encrypted). It is idempotent: already-`v1:` values are skipped, so it
+ * can be re-run safely.
+ *
+ * Because it operates through the standard nx-frame-be `BaseModel`, the same
+ * engine works for ANY project built on the framework: the caller only supplies
+ * the list of `{ model, fields }` targets (the fields that use the encrypting
+ * getter/setter in that project's schema).
+ */
+/** A model plus the dotted paths of its encrypted string fields. */
+export interface EncryptedFieldTarget {
+    model: BaseModel<any, any, any>;
+    fields: string[];
+}
+/** Options for {@link reEncryptLegacyFields}. */
+export interface MigrateEncryptedFieldsOptions {
+    targets: EncryptedFieldTarget[];
+    secret?: string;
+    dryRun?: boolean;
+    batchSize?: number;
+    logger?: any;
+}
+/** Per-field counters for a migration run. */
+export interface FieldMigrationStats {
+    migrated: number;
+    skipped: number;
+    errors: number;
+}
+/** Aggregated result of a migration run. */
+export interface MigrateEncryptedFieldsResult {
+    scanned: number;
+    migrated: number;
+    skipped: number;
+    errors: number;
+    perModel: Record<string, Record<string, FieldMigrationStats>>;
+}
+/**
+ * Re-encrypts legacy-encrypted fields to the current AES-256-GCM scheme.
+ *
+ * @param opts the targets to migrate and run options
+ * @returns aggregated counters (also broken down per model and field)
+ */
+export declare function reEncryptLegacyFields(opts: MigrateEncryptedFieldsOptions): Promise<MigrateEncryptedFieldsResult>;

package/build/common/crypto/migrate-encrypted-fields.js

@@ -0,0 +1,114 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __asyncValues = (this && this.__asyncValues) || function (o) {
+    if (!Symbol.asyncIterator) throw new TypeError("Symbol.asyncIterator is not defined.");
+    var m = o[Symbol.asyncIterator], i;
+    return m ? m.call(o) : (o = typeof __values === "function" ? __values(o) : o[Symbol.iterator](), i = {}, verb("next"), verb("throw"), verb("return"), i[Symbol.asyncIterator] = function () { return this; }, i);
+    function verb(n) { i[n] = o[n] && function (v) { return new Promise(function (resolve, reject) { v = o[n](v), settle(resolve, reject, v.done, v.value); }); }; }
+    function settle(resolve, reject, d, v) { Promise.resolve(v).then(function(v) { resolve({ value: v, done: d }); }, reject); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.reEncryptLegacyFields = reEncryptLegacyFields;
+const constants_1 = require("../constants");
+const constants_2 = require("../constants");
+const utils_1 = require("../utils");
+const crypto_constants_1 = require("./crypto.constants");
+const crypto_legacy_1 = require("./crypto-legacy");
+const EMPTY_STATS = () => ({ migrated: 0, skipped: 0, errors: 0 });
+/**
+ * Re-encrypts legacy-encrypted fields to the current AES-256-GCM scheme.
+ *
+ * @param opts the targets to migrate and run options
+ * @returns aggregated counters (also broken down per model and field)
+ */
+function reEncryptLegacyFields(opts) {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a, e_1, _b, _c;
+        var _d, _e, _f, _g, _h;
+        const secret = (_f = (_e = (_d = opts.secret) !== null && _d !== void 0 ? _d : constants_1.APP.dataScr) !== null && _e !== void 0 ? _e : process.env.SECRET) !== null && _f !== void 0 ? _f : '';
+        const logger = (_g = opts.logger) !== null && _g !== void 0 ? _g : constants_1.APP.logger;
+        const dryRun = !!opts.dryRun;
+        const batchSize = (_h = opts.batchSize) !== null && _h !== void 0 ? _h : 500;
+        if (!secret)
+            throw new Error('reEncryptLegacyFields: no secret available (pass opts.secret or set APP.dataScr/SECRET)');
+        const result = {
+            scanned: 0,
+            migrated: 0,
+            skipped: 0,
+            errors: 0,
+            perModel: {},
+        };
+        for (const target of opts.targets) {
+            const modelName = target.model.name;
+            const collection = target.model.mgModel.collection;
+            result.perModel[modelName] = {};
+            for (const field of target.fields)
+                result.perModel[modelName][field] = EMPTY_STATS();
+            // Only fetch documents that carry at least one of the target fields.
+            const projection = target.fields.reduce((acc, f) => (acc[f] = 1, acc), { _id: 1 });
+            const cursor = collection.find({}, { projection, batchSize });
+            try {
+                for (var _j = true, cursor_1 = (e_1 = void 0, __asyncValues(cursor)), cursor_1_1; cursor_1_1 = yield cursor_1.next(), _a = cursor_1_1.done, !_a; _j = true) {
+                    _c = cursor_1_1.value;
+                    _j = false;
+                    const doc = _c;
+                    result.scanned++;
+                    const update = {};
+                    for (const field of target.fields) {
+                        const stats = result.perModel[modelName][field];
+                        const value = (0, utils_1.getAttr)(doc, field);
+                        // Nothing to do: empty, or already migrated to the current scheme.
+                        if (!value || typeof value !== 'string' || value.startsWith(crypto_constants_1.FIELD_ENC_PREFIX)) {
+                            stats.skipped++;
+                            result.skipped++;
+                            continue;
+                        }
+                        // Only touch values we can confidently identify as legacy ciphertext.
+                        if (!(0, crypto_legacy_1.isLegacyCiphertext)(value)) {
+                            stats.skipped++;
+                            result.skipped++;
+                            continue;
+                        }
+                        try {
+                            const plain = constants_2.cryptoUtils.decryptText(value, secret);
+                            const reencoded = constants_2.cryptoUtils.encryptText(plain, secret);
+                            if (!reencoded)
+                                throw new Error('re-encryption produced an empty value');
+                            // Use the DOTTED path as a literal `$set` key (e.g. `profile.email`) so
+                            // MongoDB updates only that nested field and leaves its siblings intact.
+                            // A nested object here would replace the whole sub-document.
+                            update[field] = reencoded;
+                            stats.migrated++;
+                            result.migrated++;
+                        }
+                        catch (e) {
+                            stats.errors++;
+                            result.errors++;
+                            logger.error(`reEncryptLegacyFields: ${modelName}.${field} on _id=${doc._id}: %o`, e);
+                        }
+                    }
+                    if (!dryRun && Object.keys(update).length)
+                        yield collection.updateOne({ _id: doc._id }, { $set: update });
+                }
+            }
+            catch (e_1_1) { e_1 = { error: e_1_1 }; }
+            finally {
+                try {
+                    if (!_j && !_a && (_b = cursor_1.return)) yield _b.call(cursor_1);
+                }
+                finally { if (e_1) throw e_1.error; }
+            }
+        }
+        logger.info(`reEncryptLegacyFields: scanned=${result.scanned} migrated=${result.migrated} ` +
+            `skipped=${result.skipped} errors=${result.errors}${dryRun ? ' (dry-run)' : ''}`);
+        return result;
+    });
+}

package/build/common/types.d.ts

@@ -42,7 +42,20 @@ export type AppConfig = {
     mongo: AppMongoDB;
     invite: AppInvitation;
     logging: AppLogging;
+    app: AppCustomConfig;
 };
+/**
+ * Application-specific configuration slot.
+ *
+ * Intentionally EMPTY in the framework: each consuming application augments this
+ * interface (declaration merging: `declare module '@nextage/nx-frame-be'`) to
+ * add its own strongly-typed settings, and populates `APP.config.app` at bootstrap
+ * (after env is read). This keeps CORE config (`endpoint`, `jwt`, `mongo`, …) in
+ * the framework while APP-ONLY settings live here — typed by the app, not by env
+ * reads scattered across the codebase.
+ */
+export interface AppCustomConfig {
+}
 export type AppMongoDB = {
     auth?: {
         us: string;

package/build/common/utils.d.ts

@@ -19,8 +19,14 @@ export declare function generateJwt(sub: string, jti: string, iss: string, data?
  */
 export declare function validateJwt(token: string, options?: jwt.VerifyOptions, secret?: jwt.Secret): string | jwt.Jwt | jwt.JwtPayload;
 /**
+ * Generates a cryptographically-strong random string.
  *
- * @param {*} size
+ * Uses a URL-safe base64 alphabet (`A-Za-z0-9-_`, no `+`/`/`/`=` padding) so the
+ * value is safe to drop into URLs, tokens and filenames. Enough random bytes are
+ * generated to fill `size` characters without truncating away entropy.
+ *
+ * @param size number of characters to return (default 21)
+ * @returns a random URL-safe string of length `size`
  */
 export declare function randomString(size?: number): string;
 /**

package/build/common/utils.js

@@ -146,12 +146,20 @@ function validateJwt(token, options = {}, secret) {
     return jsonwebtoken_1.default.verify(token, secret, options);
 }
 /**
+ * Generates a cryptographically-strong random string.
  *
- * @param {*} size
+ * Uses a URL-safe base64 alphabet (`A-Za-z0-9-_`, no `+`/`/`/`=` padding) so the
+ * value is safe to drop into URLs, tokens and filenames. Enough random bytes are
+ * generated to fill `size` characters without truncating away entropy.
+ *
+ * @param size number of characters to return (default 21)
+ * @returns a random URL-safe string of length `size`
  */
 function randomString(size = 21) {
-    return crypto_1.default.randomBytes(size)
-        .toString('base64')
+    // base64url yields 4 chars per 3 bytes → ceil(3/4 * size) bytes cover `size` chars.
+    const bytes = Math.ceil((size * 3) / 4);
+    return crypto_1.default.randomBytes(bytes)
+        .toString('base64url')
         .slice(0, size);
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextage/nx-frame-be",
-  "version": "1.0.42",
+  "version": "1.0.44",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -35,7 +35,6 @@
     "@aws-sdk/s3-request-presigner": "^3.1017.0",
     "@types/async": "^3.2.24",
     "@types/cookie-session": "^2.0.49",
-    "@types/crypto-js": "^4.2.2",
     "@types/express": "^5.0.6",
     "@types/express-validator": "^3.0.0",
     "@types/graphql": "^14.5.0",
@@ -54,7 +53,6 @@
     "@types/uuid": "^9.0.8",
     "async": "^3.2.5",
     "cookie": "^1.1.1",
-    "crypto-js": "^4.2.0",
     "express": "^5.2.1",
     "express-validator": "^7.1.0",
     "graphql": "^16.11.0",