@syldel/crypto-utils 1.0.1 → 1.0.2

package/README.md

@@ -1,8 +1,60 @@
 # @syldel/crypto-utils
 
-Lightweight JWT and AES-256-GCM utilities
+A lightweight, universal, and dependency-safe cryptographic toolkit for Node.js, Web browsers, and Mobile frameworks (Ionic/Capacitor).
 
----
+## 🚀 Features
+ - **Universal Compatibility**: Works everywhere (Node, Angular, React, Ionic, NestJS).
+
+- **Zero Node-only Dependencies**: Replaced native crypto and Buffer with cross-platform alternatives.
+
+- **AES-256-GCM**: Secure authenticated encryption with integrity verification.
+
+- **Pure JWT**: Sign and verify JSON Web Tokens without heavy libraries.
+
+## 🛠 Usage
+
+### AES-GCM Encryption (Universal)
+Uses node-forge for authenticated encryption. It ensures that if the data is tampered with, decryption will fail.
+
+```ts
+import { AesGcmUtil } from '@syldel/crypto-utils';
+
+const key = "your-64-char-hex-key...";
+const message = "Hello World";
+
+// Encrypt
+const encrypted = AesGcmUtil.encrypt(message, key);
+console.log(encrypted); // { data: '...', iv: '...', tag: '...' }
+
+// Decrypt
+const original = AesGcmUtil.decrypt(encrypted, key);
+```
+
+### JWT Utilities
+Lightweight JWT implementation using crypto-js.
+
+```ts
+import { PureJwtUtil } from '@syldel/crypto-utils';
+
+const secret = "my-super-secret";
+const payload = { sub: "123", role: "admin" };
+
+// Sign
+const token = PureJwtUtil.sign(payload, secret);
+
+// Verify
+try {
+  const decoded = PureJwtUtil.verify(token, secret);
+} catch (err) {
+  console.error("Invalid or expired token");
+}
+```
+
+### 🔒 Security Principles
+
+- **Integrity First**: Using AES-GCM (via Node-Forge) ensures that any modification to the ciphertext or the tag results in a decryption error, preventing "padding oracle" and bit-flipping attacks.
+
+- **Isomorphic Helpers**: Custom EncodingHelper uses standard Web APIs (atob/btoa) to handle Base64URL without needing the Node.js Buffer object.
 
 ## 👨‍💻 Développement
 
@@ -24,8 +76,6 @@ Le projet utilise **ESLint** pour la logique et **Prettier** pour le formatage.
 npx eslint .
 ```
 
----
-
 ## 🔗 Utilisation en local (Development Workflow)
 
 Pour utiliser ce package dans tes autres projets sans le publier sur NPM :
@@ -39,8 +89,6 @@ Pour utiliser ce package dans tes autres projets sans le publier sur NPM :
     npm link @syldel/crypto-utils
     ```
 
----
-
 ## 📦 Publication
 
 Le projet utilise des **Granular Access Tokens** pour la publication afin de contourner la double authentification (2FA) manuelle tout en maintenant une sécurité maximale.

package/dist/aes-gcm.util.d.ts

@@ -4,7 +4,6 @@ export interface EncryptedData {
     tag: string;
 }
 export declare class AesGcmUtil {
-    private static validateKey;
-    static encrypt(text: string, key: Buffer | string): EncryptedData;
-    static decrypt(payload: EncryptedData, key: Buffer | string): string;
+    static encrypt(text: string, keyHex: string): EncryptedData;
+    static decrypt(payload: EncryptedData, keyHex: string): string;
 }

package/dist/aes-gcm.util.js

@@ -1,67 +1,41 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AesGcmUtil = void 0;
-const crypto = __importStar(require("crypto"));
+const node_forge_1 = __importDefault(require("node-forge"));
 class AesGcmUtil {
-    static validateKey(key) {
-        const encryptionKey = typeof key === 'string' ? Buffer.from(key, 'hex') : key;
-        if (encryptionKey.length !== 32) {
-            throw new Error('Invalid Key: Key must be 32 bytes (64 hex characters)');
-        }
-        return encryptionKey;
-    }
-    static encrypt(text, key) {
-        const encryptionKey = this.validateKey(key);
-        const iv = crypto.randomBytes(12);
-        const cipher = crypto.createCipheriv('aes-256-gcm', encryptionKey, iv);
-        let encrypted = cipher.update(text, 'utf8', 'hex');
-        encrypted += cipher.final('hex');
+    static encrypt(text, keyHex) {
+        const key = node_forge_1.default.util.hexToBytes(keyHex);
+        const iv = node_forge_1.default.random.getBytesSync(12); // IV standard GCM = 12 octets
+        const cipher = node_forge_1.default.cipher.createCipher('AES-GCM', key);
+        cipher.start({ iv: iv });
+        cipher.update(node_forge_1.default.util.createBuffer(node_forge_1.default.util.encodeUtf8(text)));
+        cipher.finish();
         return {
-            data: encrypted,
-            iv: iv.toString('hex'),
-            tag: cipher.getAuthTag().toString('hex'),
+            data: node_forge_1.default.util.bytesToHex(cipher.output.getBytes()),
+            iv: node_forge_1.default.util.bytesToHex(iv),
+            tag: node_forge_1.default.util.bytesToHex(cipher.mode.tag.getBytes()),
         };
     }
-    static decrypt(payload, key) {
-        const encryptionKey = this.validateKey(key);
-        const decipher = crypto.createDecipheriv('aes-256-gcm', encryptionKey, Buffer.from(payload.iv, 'hex'));
-        decipher.setAuthTag(Buffer.from(payload.tag, 'hex'));
-        let decrypted = decipher.update(payload.data, 'hex', 'utf8');
-        decrypted += decipher.final('utf8');
-        return decrypted;
+    static decrypt(payload, keyHex) {
+        const key = node_forge_1.default.util.hexToBytes(keyHex);
+        const iv = node_forge_1.default.util.hexToBytes(payload.iv);
+        const tag = node_forge_1.default.util.hexToBytes(payload.tag);
+        const ciphertext = node_forge_1.default.util.hexToBytes(payload.data);
+        const decipher = node_forge_1.default.cipher.createDecipher('AES-GCM', key);
+        decipher.start({
+            iv: iv,
+            tag: node_forge_1.default.util.createBuffer(tag),
+        });
+        decipher.update(node_forge_1.default.util.createBuffer(ciphertext));
+        // finish() renvoie 'false' si le tag est invalide (données corrompues ou mauvaise clé)
+        const authenticated = decipher.finish();
+        if (!authenticated) {
+            throw new Error('Decryption failed: authentication failed (bad key or corrupted data)');
+        }
+        return node_forge_1.default.util.decodeUtf8(decipher.output.getBytes());
     }
 }
 exports.AesGcmUtil = AesGcmUtil;

package/dist/encoding.helper.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Encode et décode en Base64URL sans dépendance à Buffer (Universal JS)
+ */
+export declare const EncodingHelper: {
+    toBase64: (str: string) => string;
+    fromBase64: (base64: string) => string;
+    toBase64Url: (base64: string) => string;
+    objToBase64Url: (obj: object) => string;
+};

package/dist/encoding.helper.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EncodingHelper = void 0;
+/**
+ * Encode et décode en Base64URL sans dépendance à Buffer (Universal JS)
+ */
+exports.EncodingHelper = {
+    // Texte -> Base64
+    toBase64: (str) => {
+        return btoa(unescape(encodeURIComponent(str)));
+    },
+    // Base64 -> Texte
+    fromBase64: (base64) => {
+        return decodeURIComponent(escape(atob(base64)));
+    },
+    // Base64 -> Base64URL (pour JWT)
+    toBase64Url: (base64) => {
+        return base64.replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    },
+    // Object -> Base64URL
+    objToBase64Url: (obj) => {
+        const str = JSON.stringify(obj);
+        return exports.EncodingHelper.toBase64Url(exports.EncodingHelper.toBase64(str));
+    },
+};

package/dist/jwt.util.d.ts

@@ -1,4 +1,4 @@
 export declare class PureJwtUtil {
-    static verify<T extends object>(token: string, secret: string): T;
     static sign(payload: Record<string, any>, secret: string): string;
+    static verify<T extends object>(token: string, secret: string): T;
 }

package/dist/jwt.util.js

@@ -1,73 +1,34 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PureJwtUtil = void 0;
-const crypto = __importStar(require("crypto"));
+const crypto_js_1 = __importDefault(require("crypto-js"));
+const encoding_helper_1 = require("./encoding.helper");
 class PureJwtUtil {
+    static sign(payload, secret) {
+        const header = { alg: 'HS256', typ: 'JWT' };
+        const encodedHeader = encoding_helper_1.EncodingHelper.objToBase64Url(header);
+        const encodedPayload = encoding_helper_1.EncodingHelper.objToBase64Url(payload);
+        const signature = crypto_js_1.default.HmacSHA256(`${encodedHeader}.${encodedPayload}`, secret);
+        // Conversion du WordArray CryptoJS en Base64URL
+        const encodedSignature = encoding_helper_1.EncodingHelper.toBase64Url(signature.toString(crypto_js_1.default.enc.Base64));
+        return `${encodedHeader}.${encodedPayload}.${encodedSignature}`;
+    }
     static verify(token, secret) {
-        const parts = token.split('.');
-        if (parts.length !== 3)
+        const [headerB64, payloadB64, signatureB64] = token.split('.');
+        if (!signatureB64)
             throw new Error('Invalid token format');
-        const [headerB64, payloadB64, signatureB64] = parts;
-        const dataToVerify = `${headerB64}.${payloadB64}`;
-        const expectedSignature = crypto
-            .createHmac('sha256', secret)
-            .update(dataToVerify)
-            .digest('base64url');
+        const expectedSignature = encoding_helper_1.EncodingHelper.toBase64Url(crypto_js_1.default.HmacSHA256(`${headerB64}.${payloadB64}`, secret).toString(crypto_js_1.default.enc.Base64));
         if (signatureB64 !== expectedSignature) {
             throw new Error('Invalid signature');
         }
-        const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf8'));
-        const payloadRecord = payload;
-        if (typeof payloadRecord.exp === 'number') {
-            if (Date.now() >= payloadRecord.exp * 1000) {
-                throw new Error('Token expired');
-            }
+        const payload = JSON.parse(encoding_helper_1.EncodingHelper.fromBase64(payloadB64.replace(/-/g, '+').replace(/_/g, '/')));
+        if (payload.exp && Date.now() >= payload.exp * 1000) {
+            throw new Error('Token expired');
         }
         return payload;
     }
-    static sign(payload, secret) {
-        const header = { alg: 'HS256', typ: 'JWT' };
-        const encode = (obj) => Buffer.from(JSON.stringify(obj)).toString('base64url');
-        const encodedHeader = encode(header);
-        const encodedPayload = encode(payload);
-        const signature = crypto
-            .createHmac('sha256', secret)
-            .update(`${encodedHeader}.${encodedPayload}`)
-            .digest('base64url');
-        return `${encodedHeader}.${encodedPayload}.${signature}`;
-    }
 }
 exports.PureJwtUtil = PureJwtUtil;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@syldel/crypto-utils",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Lightweight JWT and AES-256-GCM utilities",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -31,7 +31,9 @@
   "license": "ISC",
   "devDependencies": {
     "@eslint/js": "^10.0.1",
+    "@types/crypto-js": "^4.2.2",
     "@types/jest": "^30.0.0",
+    "@types/node-forge": "^1.3.14",
     "eslint": "^10.0.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-jsonc": "^3.0.0",
@@ -45,5 +47,9 @@
   },
   "overrides": {
     "minimatch": "^10.2.1"
+  },
+  "dependencies": {
+    "crypto-js": "^4.2.0",
+    "node-forge": "^1.3.3"
   }
 }