@nextblock-cms/db 0.10.5 → 0.10.7

package/lib/secret-crypto.cjs.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const c=require("node:crypto"),o="aes-256-gcm",a=1;function l(t){const e=t.trim();if(!e)throw new Error("A non-empty encryption secret is required to manage stored secrets.");return c.createHash("sha256").update(e).digest()}function i(t){if(!t||typeof t!="object")return!1;const e=t;return e.algorithm===o&&e.version===a&&typeof e.authTag=="string"&&typeof e.ciphertext=="string"&&typeof e.iv=="string"}function S(t){if(!i(t))throw new Error("Invalid encrypted secret payload.");const e=t;return{algorithm:e.algorithm,authTag:e.authTag,ciphertext:e.ciphertext,iv:e.iv,last4:typeof e.last4=="string"?e.last4:"",updatedAt:typeof e.updatedAt=="string"?e.updatedAt:"",version:e.version}}function E(t){const e=t.value.trim();if(!e)throw new Error("A non-empty value is required to encrypt a secret.");const r=l(t.encryptionSecret),n=c.randomBytes(12),u=c.createCipheriv(o,r,n),d=Buffer.concat([u.update(e,"utf8"),u.final()]),h=u.getAuthTag();return{algorithm:o,authTag:h.toString("base64"),ciphertext:d.toString("base64"),iv:n.toString("base64"),last4:e.slice(-4),updatedAt:(t.now??new Date).toISOString(),version:a}}function p(t){const e=S(t.envelope),r=l(t.encryptionSecret);try{const n=c.createDecipheriv(o,r,Buffer.from(e.iv,"base64"));return n.setAuthTag(Buffer.from(e.authTag,"base64")),Buffer.concat([n.update(Buffer.from(e.ciphertext,"base64")),n.final()]).toString("utf8")}catch{throw new Error("Failed to decrypt stored secret.")}}function f(t){const e=(t??"").trim();return e?`•••• ${e}`:"Stored secret"}function g(t){if(!i(t))return{hasStoredValue:!1,last4:null,maskedValue:null,updatedAt:null};const e=t,r=typeof e.last4=="string"&&e.last4?e.last4:null;return{hasStoredValue:!0,last4:r,maskedValue:f(r),updatedAt:typeof e.updatedAt=="string"&&e.updatedAt?e.updatedAt:null}}function s(){const t=process.env.NEXTBLOCK_ENCRYPTION_KEY;if(typeof t=="string"&&t.trim())return t.trim();const e=process.env.CORTEX_AI_ENCRYPTION_KEY;return typeof e=="string"&&e.trim()?e.trim():null}function v(){return s()!==null}function y(){const t=s();if(!t)throw new Error("An encryption key (NEXTBLOCK_ENCRYPTION_KEY or CORTEX_AI_ENCRYPTION_KEY) is required to manage stored secrets.");return t}function m(t,e){return E({value:t,encryptionSecret:y(),now:e})}function T(t){return p({envelope:t,encryptionSecret:y()})}function K(t){if(!i(t))return null;const e=s();if(!e)return null;try{return p({envelope:t,encryptionSecret:e})}catch{return null}}exports.SECRET_ENVELOPE_ALGORITHM=o;exports.SECRET_ENVELOPE_VERSION=a;exports.decryptSecret=p;exports.decryptWithEnvKey=T;exports.encryptSecret=E;exports.encryptWithEnvKey=m;exports.getMaskedSecret=f;exports.getSecretEnvelopeStatus=g;exports.hasSecretEncryptionKey=v;exports.isEncryptedSecretEnvelope=i;exports.requireSecretEncryptionKey=y;exports.resolveSecretEncryptionKey=s;exports.tryDecryptWithEnvKey=K;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const o=require("node:crypto"),c="aes-256-gcm",a=1;function E(t){const e=t.trim();if(!e)throw new Error("A non-empty encryption secret is required to manage stored secrets.");return o.createHash("sha256").update(e).digest()}function i(t){if(!t||typeof t!="object")return!1;const e=t;return e.algorithm===c&&e.version===a&&typeof e.authTag=="string"&&typeof e.ciphertext=="string"&&typeof e.iv=="string"}function g(t){if(!i(t))throw new Error("Invalid encrypted secret payload.");const e=t;return{algorithm:e.algorithm,authTag:e.authTag,ciphertext:e.ciphertext,iv:e.iv,last4:typeof e.last4=="string"?e.last4:"",updatedAt:typeof e.updatedAt=="string"?e.updatedAt:"",version:e.version}}function d(t){const e=t.value.trim();if(!e)throw new Error("A non-empty value is required to encrypt a secret.");const n=E(t.encryptionSecret),r=o.randomBytes(12),s=o.createCipheriv(c,n,r),S=Buffer.concat([s.update(e,"utf8"),s.final()]),h=s.getAuthTag();return{algorithm:c,authTag:h.toString("base64"),ciphertext:S.toString("base64"),iv:r.toString("base64"),last4:e.slice(-4),updatedAt:(t.now??new Date).toISOString(),version:a}}function u(t){const e=g(t.envelope),n=E(t.encryptionSecret);try{const r=o.createDecipheriv(c,n,Buffer.from(e.iv,"base64"));return r.setAuthTag(Buffer.from(e.authTag,"base64")),Buffer.concat([r.update(Buffer.from(e.ciphertext,"base64")),r.final()]).toString("utf8")}catch{throw new Error("Failed to decrypt stored secret.")}}function l(t){const e=(t??"").trim();return e?`•••• ${e}`:"Stored secret"}function v(t){if(!i(t))return{hasStoredValue:!1,last4:null,maskedValue:null,updatedAt:null};const e=t,n=typeof e.last4=="string"&&e.last4?e.last4:null;return{hasStoredValue:!0,last4:n,maskedValue:l(n),updatedAt:typeof e.updatedAt=="string"&&e.updatedAt?e.updatedAt:null}}const _="nextblock-secret-encryption-key-v1";function m(){const t=process.env.SUPABASE_SERVICE_ROLE_KEY??process.env.SUPABASE_SECRET_KEY;return typeof t!="string"||!t.trim()?null:o.createHmac("sha256",t.trim()).update(_).digest("hex")}function f(){const t=[],e=n=>{const r=typeof n=="string"?n.trim():"";r&&!t.includes(r)&&t.push(r)};return e(process.env.NEXTBLOCK_ENCRYPTION_KEY),e(process.env.CORTEX_AI_ENCRYPTION_KEY),e(m()),t}function p(){return f()[0]??null}function K(){return p()!==null}function y(){const t=p();if(!t)throw new Error("An encryption key (NEXTBLOCK_ENCRYPTION_KEY or CORTEX_AI_ENCRYPTION_KEY) is required to manage stored secrets.");return t}function T(t,e){return d({value:t,encryptionSecret:y(),now:e})}function A(t){return u({envelope:t,encryptionSecret:y()})}function O(t){if(!i(t))return null;for(const e of f())try{return u({envelope:t,encryptionSecret:e})}catch{}return null}exports.SECRET_ENVELOPE_ALGORITHM=c;exports.SECRET_ENVELOPE_VERSION=a;exports.decryptSecret=u;exports.decryptWithEnvKey=A;exports.encryptSecret=d;exports.encryptWithEnvKey=T;exports.getMaskedSecret=l;exports.getSecretEnvelopeStatus=v;exports.hasSecretEncryptionKey=K;exports.isEncryptedSecretEnvelope=i;exports.requireSecretEncryptionKey=y;exports.resolveSecretEncryptionKey=p;exports.tryDecryptWithEnvKey=O;

package/lib/secret-crypto.es.js

@@ -1,125 +1,131 @@
-import { createDecipheriv as d, randomBytes as E, createCipheriv as h, createHash as g } from "node:crypto";
-const o = "aes-256-gcm", u = 1;
-function a(e) {
-  const t = e.trim();
-  if (!t)
+import { createDecipheriv as E, randomBytes as h, createCipheriv as g, createHash as S, createHmac as v } from "node:crypto";
+const o = "aes-256-gcm", s = 1;
+function a(t) {
+  const e = t.trim();
+  if (!e)
     throw new Error("A non-empty encryption secret is required to manage stored secrets.");
-  return g("sha256").update(t).digest();
+  return S("sha256").update(e).digest();
 }
-function c(e) {
-  if (!e || typeof e != "object")
+function i(t) {
+  if (!t || typeof t != "object")
     return !1;
-  const t = e;
-  return t.algorithm === o && t.version === u && typeof t.authTag == "string" && typeof t.ciphertext == "string" && typeof t.iv == "string";
+  const e = t;
+  return e.algorithm === o && e.version === s && typeof e.authTag == "string" && typeof e.ciphertext == "string" && typeof e.iv == "string";
 }
-function S(e) {
-  if (!c(e))
+function m(t) {
+  if (!i(t))
     throw new Error("Invalid encrypted secret payload.");
-  const t = e;
+  const e = t;
   return {
-    algorithm: t.algorithm,
-    authTag: t.authTag,
-    ciphertext: t.ciphertext,
-    iv: t.iv,
-    last4: typeof t.last4 == "string" ? t.last4 : "",
-    updatedAt: typeof t.updatedAt == "string" ? t.updatedAt : "",
-    version: t.version
+    algorithm: e.algorithm,
+    authTag: e.authTag,
+    ciphertext: e.ciphertext,
+    iv: e.iv,
+    last4: typeof e.last4 == "string" ? e.last4 : "",
+    updatedAt: typeof e.updatedAt == "string" ? e.updatedAt : "",
+    version: e.version
   };
 }
-function m(e) {
-  const t = e.value.trim();
-  if (!t)
+function A(t) {
+  const e = t.value.trim();
+  if (!e)
     throw new Error("A non-empty value is required to encrypt a secret.");
-  const r = a(e.encryptionSecret), n = E(12), i = h(o, r, n), l = Buffer.concat([i.update(t, "utf8"), i.final()]), y = i.getAuthTag();
+  const n = a(t.encryptionSecret), r = h(12), c = g(o, n, r), l = Buffer.concat([c.update(e, "utf8"), c.final()]), y = c.getAuthTag();
   return {
     algorithm: o,
     authTag: y.toString("base64"),
     ciphertext: l.toString("base64"),
-    iv: n.toString("base64"),
-    last4: t.slice(-4),
-    updatedAt: (e.now ?? /* @__PURE__ */ new Date()).toISOString(),
-    version: u
+    iv: r.toString("base64"),
+    last4: e.slice(-4),
+    updatedAt: (t.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    version: s
   };
 }
-function p(e) {
-  const t = S(e.envelope), r = a(e.encryptionSecret);
+function u(t) {
+  const e = m(t.envelope), n = a(t.encryptionSecret);
   try {
-    const n = d(
+    const r = E(
       o,
-      r,
-      Buffer.from(t.iv, "base64")
+      n,
+      Buffer.from(e.iv, "base64")
     );
-    return n.setAuthTag(Buffer.from(t.authTag, "base64")), Buffer.concat([
-      n.update(Buffer.from(t.ciphertext, "base64")),
-      n.final()
+    return r.setAuthTag(Buffer.from(e.authTag, "base64")), Buffer.concat([
+      r.update(Buffer.from(e.ciphertext, "base64")),
+      r.final()
     ]).toString("utf8");
   } catch {
     throw new Error("Failed to decrypt stored secret.");
   }
 }
-function v(e) {
-  const t = (e ?? "").trim();
-  return t ? `•••• ${t}` : "Stored secret";
+function _(t) {
+  const e = (t ?? "").trim();
+  return e ? `•••• ${e}` : "Stored secret";
 }
-function A(e) {
-  if (!c(e))
+function R(t) {
+  if (!i(t))
     return { hasStoredValue: !1, last4: null, maskedValue: null, updatedAt: null };
-  const t = e, r = typeof t.last4 == "string" && t.last4 ? t.last4 : null;
+  const e = t, n = typeof e.last4 == "string" && e.last4 ? e.last4 : null;
   return {
     hasStoredValue: !0,
-    last4: r,
-    maskedValue: v(r),
-    updatedAt: typeof t.updatedAt == "string" && t.updatedAt ? t.updatedAt : null
+    last4: n,
+    maskedValue: _(n),
+    updatedAt: typeof e.updatedAt == "string" && e.updatedAt ? e.updatedAt : null
   };
 }
-function s() {
-  const e = process.env.NEXTBLOCK_ENCRYPTION_KEY;
-  if (typeof e == "string" && e.trim())
-    return e.trim();
-  const t = process.env.CORTEX_AI_ENCRYPTION_KEY;
-  return typeof t == "string" && t.trim() ? t.trim() : null;
+const T = "nextblock-secret-encryption-key-v1";
+function K() {
+  const t = process.env.SUPABASE_SERVICE_ROLE_KEY ?? process.env.SUPABASE_SECRET_KEY;
+  return typeof t != "string" || !t.trim() ? null : v("sha256", t.trim()).update(T).digest("hex");
+}
+function p() {
+  const t = [], e = (n) => {
+    const r = typeof n == "string" ? n.trim() : "";
+    r && !t.includes(r) && t.push(r);
+  };
+  return e(process.env.NEXTBLOCK_ENCRYPTION_KEY), e(process.env.CORTEX_AI_ENCRYPTION_KEY), e(K()), t;
+}
+function d() {
+  return p()[0] ?? null;
 }
 function N() {
-  return s() !== null;
+  return d() !== null;
 }
 function f() {
-  const e = s();
-  if (!e)
+  const t = d();
+  if (!t)
     throw new Error(
       "An encryption key (NEXTBLOCK_ENCRYPTION_KEY or CORTEX_AI_ENCRYPTION_KEY) is required to manage stored secrets."
     );
-  return e;
+  return t;
 }
-function _(e, t) {
-  return m({ value: e, encryptionSecret: f(), now: t });
+function C(t, e) {
+  return A({ value: t, encryptionSecret: f(), now: e });
 }
-function K(e) {
-  return p({ envelope: e, encryptionSecret: f() });
+function I(t) {
+  return u({ envelope: t, encryptionSecret: f() });
 }
-function O(e) {
-  if (!c(e))
-    return null;
-  const t = s();
-  if (!t)
+function w(t) {
+  if (!i(t))
     return null;
-  try {
-    return p({ envelope: e, encryptionSecret: t });
-  } catch {
-    return null;
-  }
+  for (const e of p())
+    try {
+      return u({ envelope: t, encryptionSecret: e });
+    } catch {
+    }
+  return null;
 }
 export {
   o as SECRET_ENVELOPE_ALGORITHM,
-  u as SECRET_ENVELOPE_VERSION,
-  p as decryptSecret,
-  K as decryptWithEnvKey,
-  m as encryptSecret,
-  _ as encryptWithEnvKey,
-  v as getMaskedSecret,
-  A as getSecretEnvelopeStatus,
+  s as SECRET_ENVELOPE_VERSION,
+  u as decryptSecret,
+  I as decryptWithEnvKey,
+  A as encryptSecret,
+  C as encryptWithEnvKey,
+  _ as getMaskedSecret,
+  R as getSecretEnvelopeStatus,
   N as hasSecretEncryptionKey,
-  c as isEncryptedSecretEnvelope,
+  i as isEncryptedSecretEnvelope,
   f as requireSecretEncryptionKey,
-  s as resolveSecretEncryptionKey,
-  O as tryDecryptWithEnvKey
+  d as resolveSecretEncryptionKey,
+  w as tryDecryptWithEnvKey
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextblock-cms/db",
-  "version": "0.10.5",
+  "version": "0.10.7",
   "main": "index.cjs.js",
   "module": "index.es.js",
   "types": "index.d.ts",