@revealui/core 0.0.1-pre.4 → 0.2.1

package/dist/security/encryption.js

@@ -0,0 +1,517 @@
+/**
+ * Encryption Utilities
+ *
+ * Data encryption for at-rest and in-transit protection
+ */
+const DEFAULT_CONFIG = {
+    algorithm: 'AES-GCM',
+    keySize: 256,
+    ivSize: 12,
+};
+/**
+ * Encryption system
+ */
+export class EncryptionSystem {
+    config;
+    keys = new Map();
+    constructor(config = {}) {
+        this.config = { ...DEFAULT_CONFIG, ...config };
+    }
+    /**
+     * Generate encryption key
+     */
+    async generateKey(keyId) {
+        const crypto = globalThis.crypto;
+        if (!crypto) {
+            throw new Error('Crypto API not available');
+        }
+        const key = await crypto.subtle.generateKey({
+            name: this.config.algorithm,
+            length: this.config.keySize,
+        }, true, // extractable
+        ['encrypt', 'decrypt']);
+        if (keyId) {
+            this.keys.set(keyId, key);
+        }
+        return key;
+    }
+    /**
+     * Import key from raw data
+     */
+    async importKey(keyData, keyId) {
+        const crypto = globalThis.crypto;
+        if (!crypto) {
+            throw new Error('Crypto API not available');
+        }
+        const key = await crypto.subtle.importKey('raw', keyData, {
+            name: this.config.algorithm,
+            length: this.config.keySize,
+        }, true, ['encrypt', 'decrypt']);
+        if (keyId) {
+            this.keys.set(keyId, key);
+        }
+        return key;
+    }
+    /**
+     * Export key to raw data
+     */
+    async exportKey(key) {
+        const crypto = globalThis.crypto;
+        if (!crypto) {
+            throw new Error('Crypto API not available');
+        }
+        return crypto.subtle.exportKey('raw', key);
+    }
+    /**
+     * Encrypt data
+     */
+    async encrypt(data, keyOrId) {
+        const crypto = globalThis.crypto;
+        if (!crypto) {
+            throw new Error('Crypto API not available');
+        }
+        // Get key
+        const key = typeof keyOrId === 'string' ? this.keys.get(keyOrId) : keyOrId;
+        if (!key) {
+            throw new Error('Key not found');
+        }
+        // Generate IV
+        const iv = crypto.getRandomValues(new Uint8Array(this.config.ivSize || 12));
+        // Encode data
+        const encoder = new TextEncoder();
+        const encodedData = encoder.encode(data);
+        // Encrypt
+        const encrypted = await crypto.subtle.encrypt({
+            name: this.config.algorithm,
+            iv,
+        }, key, encodedData);
+        // Convert to base64
+        const encryptedArray = new Uint8Array(encrypted);
+        const ivArray = new Uint8Array(iv);
+        return {
+            data: this.arrayBufferToBase64(encryptedArray),
+            iv: this.arrayBufferToBase64(ivArray),
+            algorithm: this.config.algorithm,
+        };
+    }
+    /**
+     * Decrypt data
+     */
+    async decrypt(encryptedData, keyOrId) {
+        const crypto = globalThis.crypto;
+        if (!crypto) {
+            throw new Error('Crypto API not available');
+        }
+        // Get key
+        const key = typeof keyOrId === 'string' ? this.keys.get(keyOrId) : keyOrId;
+        if (!key) {
+            throw new Error('Key not found');
+        }
+        // Decode data
+        const data = this.base64ToArrayBuffer(encryptedData.data);
+        const iv = this.base64ToArrayBuffer(encryptedData.iv);
+        // Decrypt
+        const decrypted = await crypto.subtle.decrypt({
+            name: encryptedData.algorithm,
+            iv: iv,
+        }, key, data);
+        // Decode text
+        const decoder = new TextDecoder();
+        return decoder.decode(decrypted);
+    }
+    /**
+     * Encrypt object
+     */
+    async encryptObject(obj, keyOrId) {
+        const json = JSON.stringify(obj);
+        return this.encrypt(json, keyOrId);
+    }
+    /**
+     * Decrypt object
+     */
+    async decryptObject(encryptedData, keyOrId) {
+        const json = await this.decrypt(encryptedData, keyOrId);
+        return JSON.parse(json);
+    }
+    /**
+     * Hash data
+     */
+    async hash(data, algorithm = 'SHA-256') {
+        const crypto = globalThis.crypto;
+        if (!crypto) {
+            throw new Error('Crypto API not available');
+        }
+        const encoder = new TextEncoder();
+        const encodedData = encoder.encode(data);
+        const hashBuffer = await crypto.subtle.digest(algorithm, encodedData);
+        return this.arrayBufferToBase64(new Uint8Array(hashBuffer));
+    }
+    /**
+     * Generate random bytes
+     */
+    randomBytes(length) {
+        const crypto = globalThis.crypto;
+        if (!crypto) {
+            throw new Error('Crypto API not available');
+        }
+        return crypto.getRandomValues(new Uint8Array(length));
+    }
+    /**
+     * Generate random string
+     */
+    randomString(length, charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789') {
+        // Rejection sampling to avoid modulo bias:
+        // Only accept bytes below the largest multiple of charset.length that fits in a byte.
+        const maxValid = 256 - (256 % charset.length);
+        const result = [];
+        while (result.length < length) {
+            const bytes = this.randomBytes(length - result.length + 16);
+            for (const byte of bytes) {
+                if (byte < maxValid) {
+                    result.push(charset[byte % charset.length]);
+                    if (result.length === length)
+                        break;
+                }
+            }
+        }
+        return result.join('');
+    }
+    /**
+     * Convert ArrayBuffer to base64
+     */
+    arrayBufferToBase64(buffer) {
+        const bytes = Array.from(buffer);
+        const binary = bytes.map((byte) => String.fromCharCode(byte)).join('');
+        if (typeof btoa !== 'undefined') {
+            return btoa(binary);
+        }
+        if (typeof Buffer !== 'undefined') {
+            return Buffer.from(binary, 'binary').toString('base64');
+        }
+        throw new Error('No base64 encoding available');
+    }
+    /**
+     * Convert base64 to ArrayBuffer
+     */
+    base64ToArrayBuffer(base64) {
+        let binary;
+        if (typeof atob !== 'undefined') {
+            binary = atob(base64);
+        }
+        else if (typeof Buffer !== 'undefined') {
+            binary = Buffer.from(base64, 'base64').toString('binary');
+        }
+        else {
+            throw new Error('No base64 decoding available');
+        }
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+    /**
+     * Store key
+     */
+    storeKey(keyId, key) {
+        this.keys.set(keyId, key);
+    }
+    /**
+     * Get key
+     */
+    getKey(keyId) {
+        return this.keys.get(keyId);
+    }
+    /**
+     * Remove key
+     */
+    removeKey(keyId) {
+        this.keys.delete(keyId);
+    }
+    /**
+     * Clear all keys
+     */
+    clearKeys() {
+        this.keys.clear();
+    }
+}
+/**
+ * Global encryption instance
+ */
+export const encryption = new EncryptionSystem();
+/**
+ * Field-level encryption
+ */
+export class FieldEncryption {
+    encryption;
+    key = null;
+    constructor(encryption) {
+        this.encryption = encryption;
+    }
+    /**
+     * Initialize with key
+     */
+    async initialize(key) {
+        this.key = key;
+    }
+    /**
+     * Encrypt field
+     */
+    async encryptField(value) {
+        if (!this.key) {
+            throw new Error('Encryption not initialized');
+        }
+        const stringValue = typeof value === 'string' ? value : JSON.stringify(value);
+        return this.encryption.encrypt(stringValue, this.key);
+    }
+    /**
+     * Decrypt field
+     */
+    async decryptField(encryptedData) {
+        if (!this.key) {
+            throw new Error('Encryption not initialized');
+        }
+        const decrypted = await this.encryption.decrypt(encryptedData, this.key);
+        // Try to parse as JSON
+        try {
+            return JSON.parse(decrypted);
+        }
+        catch {
+            return decrypted;
+        }
+    }
+    /**
+     * Encrypt object fields
+     */
+    async encryptFields(obj, fields) {
+        const result = { ...obj };
+        for (const field of fields) {
+            if (field in result) {
+                result[field] = (await this.encryptField(result[field]));
+            }
+        }
+        return result;
+    }
+    /**
+     * Decrypt object fields
+     */
+    async decryptFields(obj, fields) {
+        const result = { ...obj };
+        for (const field of fields) {
+            if (field in result && typeof result[field] === 'object' && result[field] !== null) {
+                const encryptedData = result[field];
+                if ('data' in encryptedData && 'iv' in encryptedData) {
+                    result[field] = (await this.decryptField(encryptedData));
+                }
+            }
+        }
+        return result;
+    }
+}
+/**
+ * Key rotation
+ */
+export class KeyRotationManager {
+    encryption;
+    currentKeyId;
+    oldKeys = new Map();
+    constructor(encryption, initialKeyId) {
+        this.encryption = encryption;
+        this.currentKeyId = initialKeyId;
+    }
+    /**
+     * Rotate to new key
+     */
+    async rotate(newKeyId, newKey) {
+        // Store old key
+        const oldKey = this.encryption.getKey(this.currentKeyId);
+        if (oldKey) {
+            this.oldKeys.set(this.currentKeyId, oldKey);
+        }
+        // Set new key
+        this.encryption.storeKey(newKeyId, newKey);
+        this.currentKeyId = newKeyId;
+    }
+    /**
+     * Re-encrypt data with new key
+     */
+    async reencrypt(encryptedData, oldKeyId) {
+        // Get keys
+        const oldKey = this.oldKeys.get(oldKeyId) || this.encryption.getKey(oldKeyId);
+        const newKey = this.encryption.getKey(this.currentKeyId);
+        if (!(oldKey && newKey)) {
+            throw new Error('Keys not found');
+        }
+        // Decrypt with old key
+        const decrypted = await this.encryption.decrypt(encryptedData, oldKey);
+        // Encrypt with new key
+        return this.encryption.encrypt(decrypted, newKey);
+    }
+    /**
+     * Get current key ID
+     */
+    getCurrentKeyId() {
+        return this.currentKeyId;
+    }
+    /**
+     * Clean up old keys
+     */
+    cleanupOldKeys(_olderThan) {
+        // In a real implementation, you'd track key creation dates
+        // and remove keys older than the specified date
+        this.oldKeys.clear();
+    }
+}
+/**
+ * Envelope encryption for large data
+ */
+export class EnvelopeEncryption {
+    encryption;
+    masterKey;
+    constructor(encryption, masterKey) {
+        this.encryption = encryption;
+        this.masterKey = masterKey;
+    }
+    /**
+     * Encrypt with envelope encryption
+     */
+    async encrypt(data) {
+        // Generate data encryption key (DEK)
+        const dek = await this.encryption.generateKey();
+        // Encrypt data with DEK
+        const encryptedData = await this.encryption.encrypt(data, dek);
+        // Export DEK
+        const dekRaw = await this.encryption.exportKey(dek);
+        const dekBase64 = this.arrayBufferToBase64(new Uint8Array(dekRaw));
+        // Encrypt DEK with master key
+        const encryptedKey = await this.encryption.encrypt(dekBase64, this.masterKey);
+        return { encryptedData, encryptedKey };
+    }
+    /**
+     * Decrypt with envelope encryption
+     */
+    async decrypt(encryptedData, encryptedKey) {
+        // Decrypt DEK with master key
+        const dekBase64 = await this.encryption.decrypt(encryptedKey, this.masterKey);
+        const dekRaw = this.base64ToArrayBuffer(dekBase64);
+        // Import DEK
+        const dek = await this.encryption.importKey(dekRaw.buffer);
+        // Decrypt data with DEK
+        return this.encryption.decrypt(encryptedData, dek);
+    }
+    arrayBufferToBase64(buffer) {
+        const bytes = Array.from(buffer);
+        const binary = bytes.map((byte) => String.fromCharCode(byte)).join('');
+        return typeof btoa !== 'undefined'
+            ? btoa(binary)
+            : Buffer.from(binary, 'binary').toString('base64');
+    }
+    base64ToArrayBuffer(base64) {
+        const binary = typeof atob !== 'undefined' ? atob(base64) : Buffer.from(base64, 'base64').toString('binary');
+        const bytes = new Uint8Array(binary.length);
+        for (let i = 0; i < binary.length; i++) {
+            bytes[i] = binary.charCodeAt(i);
+        }
+        return bytes;
+    }
+}
+/**
+ * Data masking utilities
+ */
+export class DataMasking {
+    /**
+     * Mask email
+     */
+    static maskEmail(email) {
+        const [local, domain] = email.split('@');
+        if (!(local && domain))
+            return email;
+        const maskedLocal = local.length > 2
+            ? local[0] + '*'.repeat(local.length - 2) + local[local.length - 1]
+            : `${local[0]}*`;
+        return `${maskedLocal}@${domain}`;
+    }
+    /**
+     * Mask phone number
+     */
+    static maskPhone(phone) {
+        const digits = phone.replace(/\D/g, '');
+        if (digits.length < 4)
+            return phone;
+        const lastFour = digits.slice(-4);
+        const masked = '*'.repeat(digits.length - 4) + lastFour;
+        return phone.replace(/\d/g, (char, index) => {
+            const digitIndex = phone.slice(0, index + 1).replace(/\D/g, '').length - 1;
+            return masked[digitIndex] || char;
+        });
+    }
+    /**
+     * Mask credit card
+     */
+    static maskCreditCard(card) {
+        const digits = card.replace(/\D/g, '');
+        if (digits.length < 4)
+            return card;
+        const lastFour = digits.slice(-4);
+        return `****-****-****-${lastFour}`;
+    }
+    /**
+     * Mask SSN
+     */
+    static maskSSN(ssn) {
+        const digits = ssn.replace(/\D/g, '');
+        if (digits.length !== 9)
+            return ssn;
+        return `***-**-${digits.slice(-4)}`;
+    }
+    /**
+     * Mask string (keep first and last character)
+     */
+    static maskString(str, keepChars = 1) {
+        if (str.length <= keepChars * 2) {
+            return '*'.repeat(str.length);
+        }
+        const prefix = str.slice(0, keepChars);
+        const suffix = str.slice(-keepChars);
+        const masked = '*'.repeat(str.length - keepChars * 2);
+        return `${prefix}${masked}${suffix}`;
+    }
+}
+/**
+ * Secure random token generator
+ */
+export class TokenGenerator {
+    /**
+     * Generate secure token. `length` is the number of random bytes;
+     * the returned string is hex-encoded, so it will be `length * 2` characters.
+     */
+    static generate(length = 32) {
+        const bytes = encryption.randomBytes(length);
+        return Array.from(bytes)
+            .map((b) => b.toString(16).padStart(2, '0'))
+            .join('');
+    }
+    /**
+     * Generate UUID v4
+     */
+    static generateUUID() {
+        const crypto = globalThis.crypto;
+        if (!crypto) {
+            throw new Error('Crypto API not available');
+        }
+        return crypto.randomUUID();
+    }
+    /**
+     * Generate API key
+     */
+    static generateAPIKey(prefix = 'sk') {
+        const token = TokenGenerator.generate(32);
+        return `${prefix}_${token}`;
+    }
+    /**
+     * Generate session ID
+     */
+    static generateSessionID() {
+        return TokenGenerator.generate(64);
+    }
+}