@vollcrypt/db-guard 0.1.0

package/dist/prisma.js

@@ -0,0 +1,390 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.prismaDbGuard = void 0;
+exports.resolveKeys = resolveKeys;
+exports.encryptValue = encryptValue;
+exports.decryptValue = decryptValue;
+exports.rewriteQueryWhere = rewriteQueryWhere;
+exports.addBlindIndexes = addBlindIndexes;
+const client_1 = require("@prisma/client");
+const blind_index_1 = require("./blind-index");
+const kms_1 = require("./kms");
+const security_1 = require("./security");
+/**
+ * Resolves the plaintext keys asynchronously from local config or KMS provider.
+ */
+async function resolveKeys(options) {
+    let rawKeys = {};
+    if (options.key) {
+        if (Buffer.isBuffer(options.key)) {
+            rawKeys = { '1': options.key };
+        }
+        else {
+            rawKeys = { ...options.key };
+        }
+    }
+    else if (options.kms) {
+        const { provider, wrappedKey, wrappedKek } = options.kms;
+        if (Buffer.isBuffer(wrappedKey)) {
+            if (wrappedKek && Buffer.isBuffer(wrappedKek)) {
+                const unwrappedKek = await provider.decrypt(wrappedKek);
+                const dek = (0, kms_1.unwrapDekLocal)(wrappedKey, unwrappedKek);
+                unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
+                rawKeys = { '1': dek };
+            }
+            else {
+                const key = await provider.decrypt(wrappedKey);
+                rawKeys = { '1': key };
+            }
+        }
+        else {
+            for (const [ver, wrapped] of Object.entries(wrappedKey)) {
+                if (wrappedKek) {
+                    const wKek = Buffer.isBuffer(wrappedKek) ? wrappedKek : wrappedKek[ver];
+                    if (wKek) {
+                        const unwrappedKek = await provider.decrypt(wKek);
+                        const dek = (0, kms_1.unwrapDekLocal)(wrapped, unwrappedKek);
+                        unwrappedKek.fill(0); // RAM Security: zeroize KEK immediately
+                        rawKeys[ver] = dek;
+                    }
+                    else {
+                        rawKeys[ver] = await provider.decrypt(wrapped);
+                    }
+                }
+                else {
+                    rawKeys[ver] = await provider.decrypt(wrapped);
+                }
+            }
+        }
+    }
+    else {
+        throw new Error("Either 'key' or 'kms' configuration must be provided.");
+    }
+    return rawKeys;
+}
+function encryptValue(val, key, version) {
+    if (val === null || val === undefined)
+        return val;
+    const plaintext = typeof val === 'string' ? val : JSON.stringify(val);
+    const plaintextBuf = Buffer.from(plaintext, 'utf8');
+    const encrypted = security_1.CRYPTO_ALGORITHMS['1'].encrypt(plaintextBuf, key);
+    // RAM Security: Zeroize the plaintext buffer immediately
+    plaintextBuf.fill(0);
+    return `VOLLVALT:v${version}:${encrypted.toString('base64')}`;
+}
+function decryptValue(stored, keys) {
+    if (typeof stored !== 'string') {
+        return stored;
+    }
+    const parsed = (0, security_1.parseCiphertext)(stored);
+    if (!parsed) {
+        return stored;
+    }
+    const { algoId, version, base64Data } = parsed;
+    const key = keys[version];
+    if (!key) {
+        throw new Error(`Decryption key version "${version}" not found in registered keys`);
+    }
+    try {
+        const encryptedBuf = Buffer.from(base64Data, 'base64');
+        const decryptor = security_1.CRYPTO_ALGORITHMS[algoId];
+        if (!decryptor) {
+            throw new Error(`Unsupported decryption algorithm ID "${algoId}"`);
+        }
+        const decrypted = decryptor.decrypt(encryptedBuf, key);
+        const plaintext = decrypted.toString('utf8');
+        // RAM Security: Zeroize the decrypted buffer
+        decrypted.fill(0);
+        try {
+            return JSON.parse(plaintext);
+        }
+        catch {
+            return plaintext;
+        }
+    }
+    catch (err) {
+        throw new Error(`Failed to decrypt field value: ${err.message}`);
+    }
+}
+/**
+ * Traverses query `where` arguments to rewrite exact match queries on encrypted fields
+ * to target shadow `_bidx` columns using dynamic HKDF-SHA256 blind indexing.
+ */
+function rewriteQueryWhere(where, fields, rootSalt, modelName) {
+    if (!where || typeof where !== 'object')
+        return;
+    for (const field of fields) {
+        if (where[field] !== undefined) {
+            const val = where[field];
+            const bidxField = `${field}_bidx`;
+            if (typeof val === 'string' || typeof val === 'number' || typeof val === 'boolean') {
+                where[bidxField] = (0, blind_index_1.computeBlindIndex)(val, rootSalt, `${modelName}.${field}`);
+                delete where[field];
+            }
+            else if (val && typeof val === 'object') {
+                if (val.equals !== undefined) {
+                    where[bidxField] = {
+                        equals: (0, blind_index_1.computeBlindIndex)(val.equals, rootSalt, `${modelName}.${field}`),
+                    };
+                    delete where[field];
+                }
+            }
+        }
+    }
+    // Recurse into compound logical operators
+    const operators = ['AND', 'OR', 'NOT'];
+    for (const op of operators) {
+        if (Array.isArray(where[op])) {
+            where[op].forEach((item) => rewriteQueryWhere(item, fields, rootSalt, modelName));
+        }
+        else if (where[op] && typeof where[op] === 'object') {
+            rewriteQueryWhere(where[op], fields, rootSalt, modelName);
+        }
+    }
+}
+/**
+ * Appends calculated blind indexes to the write payload (create/update).
+ */
+function addBlindIndexes(data, fields, rootSalt, modelName) {
+    if (!data || typeof data !== 'object')
+        return;
+    if (Array.isArray(data)) {
+        data.forEach((item) => addBlindIndexes(item, fields, rootSalt, modelName));
+        return;
+    }
+    for (const field of fields) {
+        if (data[field] !== undefined && data[field] !== null) {
+            const bidxField = `${field}_bidx`;
+            data[bidxField] = (0, blind_index_1.computeBlindIndex)(data[field], rootSalt, `${modelName}.${field}`);
+        }
+    }
+}
+/**
+ * Prisma DbGuard Extension Factory
+ *
+ * Bootstraps client-level field encryption, query translation, and automatic decryption.
+ */
+const prismaDbGuard = (options, resolvedKeys) => {
+    let keys = resolvedKeys;
+    if (!keys) {
+        if (options.key) {
+            if (Buffer.isBuffer(options.key)) {
+                keys = { '1': options.key };
+            }
+            else {
+                keys = { ...options.key };
+            }
+        }
+        else if (options.kms || options.multiTenant) {
+            // Keys might be resolved dynamically per tenant, or resolved later
+        }
+        else {
+            throw new Error("Resolved keys must be provided as the second argument when using KMS.");
+        }
+    }
+    if (keys) {
+        (0, security_1.registerKeysForZeroization)(keys);
+    }
+    const activeVersion = options.kms?.activeKeyVersion || '1';
+    const activeKey = keys ? keys[activeVersion] : undefined;
+    const resolveTenantKeysAndActiveKey = async (tenantId) => {
+        if ((0, security_1.isBreakGlassActive)()) {
+            const bgKey = (0, security_1.getBreakGlassKey)();
+            if (bgKey) {
+                return { keys: { '1': bgKey }, activeKey: bgKey, activeVersion: '1' };
+            }
+        }
+        if (!tenantId || !options.multiTenant) {
+            if (!keys || !activeKey) {
+                throw new Error("Vollcrypt Security: Global keys are not resolved.");
+            }
+            return { keys, activeKey, activeVersion };
+        }
+        // Check Secure TTL Cache
+        const cachedActiveKey = (0, security_1.getCachedKey)(tenantId, activeVersion);
+        if (cachedActiveKey) {
+            return { keys: { [activeVersion]: cachedActiveKey }, activeKey: cachedActiveKey, activeVersion };
+        }
+        // Cache miss: resolve configuration
+        let tenantConfig;
+        if (options.multiTenant.tenants) {
+            tenantConfig = options.multiTenant.tenants[tenantId];
+        }
+        else if (options.multiTenant.getTenantConfig) {
+            tenantConfig = await options.multiTenant.getTenantConfig(tenantId);
+        }
+        if (!tenantConfig) {
+            throw new Error(`Vollcrypt Security: Configuration not found for tenantId "${tenantId}".`);
+        }
+        const resolvedTenantKeys = await resolveKeys({
+            ...options,
+            key: tenantConfig.key,
+            kms: tenantConfig.kms
+        });
+        (0, security_1.registerKeysForZeroization)(resolvedTenantKeys);
+        const tActiveVersion = tenantConfig.kms?.activeKeyVersion || '1';
+        const tActiveKey = resolvedTenantKeys[tActiveVersion];
+        if (!tActiveKey) {
+            throw new Error(`Vollcrypt Security: Active key version "${tActiveVersion}" not found for tenantId "${tenantId}".`);
+        }
+        for (const [ver, keyBuf] of Object.entries(resolvedTenantKeys)) {
+            (0, security_1.setCachedKey)(tenantId, ver, keyBuf);
+        }
+        return { keys: resolvedTenantKeys, activeKey: tActiveKey, activeVersion: tActiveVersion };
+    };
+    const encryptPayload = (modelName, data, encKey, encVer) => {
+        const fieldsToEncrypt = options.models[modelName];
+        if (!fieldsToEncrypt || !data || typeof data !== 'object')
+            return data;
+        const cloned = { ...data };
+        for (const field of fieldsToEncrypt) {
+            if (cloned[field] !== undefined) {
+                cloned[field] = encryptValue(cloned[field], encKey, encVer);
+            }
+        }
+        return cloned;
+    };
+    const decryptResult = (modelName, result, decKeys) => {
+        const fieldsToEncrypt = options.models[modelName];
+        if (!fieldsToEncrypt || !result)
+            return result;
+        if (Array.isArray(result)) {
+            const pageSizeStatus = (0, security_1.checkPageSize)(result.length, options.rateLimiter);
+            if (pageSizeStatus === 'bypass') {
+                const currentCtx = security_1.dbGuardContextStore.getStore() || {};
+                return security_1.dbGuardContextStore.run({ ...currentCtx, bypassRateLimit: true }, () => {
+                    return result.map((item) => decryptResult(modelName, item, decKeys));
+                });
+            }
+            return result.map((item) => decryptResult(modelName, item, decKeys));
+        }
+        if (typeof result !== 'object')
+            return result;
+        const cloned = { ...result };
+        for (const field of fieldsToEncrypt) {
+            if (cloned[field] !== undefined) {
+                cloned[field] = (0, security_1.decryptWithSecurity)(cloned[field], (val) => decryptValue(val, decKeys), modelName, field, cloned.id || cloned._id, options);
+            }
+        }
+        return cloned;
+    };
+    const processWriteQuery = (modelName, args, encKey, encVer) => {
+        if (!args)
+            return;
+        // Encrypt write payload
+        if (args.data) {
+            args.data = encryptPayload(modelName, args.data, encKey, encVer);
+        }
+        if (args.create) {
+            args.create = encryptPayload(modelName, args.create, encKey, encVer);
+        }
+        if (args.update) {
+            args.update = encryptPayload(modelName, args.update, encKey, encVer);
+        }
+        // Add blind indexes if enabled
+        const bidxFields = options.blindIndexes?.models[modelName];
+        if (bidxFields && options.blindIndexes?.rootSalt) {
+            if (args.data) {
+                addBlindIndexes(args.data, bidxFields, options.blindIndexes.rootSalt, modelName);
+            }
+            if (args.create) {
+                addBlindIndexes(args.create, bidxFields, options.blindIndexes.rootSalt, modelName);
+            }
+            if (args.update) {
+                addBlindIndexes(args.update, bidxFields, options.blindIndexes.rootSalt, modelName);
+            }
+        }
+    };
+    const processReadQuery = (modelName, args) => {
+        if (!args)
+            return;
+        // Rewrite queries targeting encrypted columns to use the blind index column
+        const bidxFields = options.blindIndexes?.models[modelName];
+        if (bidxFields && options.blindIndexes?.rootSalt && args.where) {
+            rewriteQueryWhere(args.where, bidxFields, options.blindIndexes.rootSalt, modelName);
+        }
+    };
+    return client_1.Prisma.defineExtension((client) => {
+        return client.$extends({
+            name: 'vollcrypt-db-guard',
+            query: {
+                $allModels: {
+                    async create({ model, args, query }) {
+                        const context = security_1.dbGuardContextStore.getStore();
+                        const resolved = await resolveTenantKeysAndActiveKey(context?.tenantId);
+                        processWriteQuery(model, args, resolved.activeKey, resolved.activeVersion);
+                        const result = await query(args);
+                        return decryptResult(model, result, resolved.keys);
+                    },
+                    async createMany({ model, args, query }) {
+                        const context = security_1.dbGuardContextStore.getStore();
+                        const resolved = await resolveTenantKeysAndActiveKey(context?.tenantId);
+                        if (args.data) {
+                            if (Array.isArray(args.data)) {
+                                args.data = args.data.map((item) => {
+                                    const encrypted = encryptPayload(model, item, resolved.activeKey, resolved.activeVersion);
+                                    const bidxFields = options.blindIndexes?.models[model];
+                                    if (bidxFields && options.blindIndexes?.rootSalt) {
+                                        addBlindIndexes(encrypted, bidxFields, options.blindIndexes.rootSalt, model);
+                                    }
+                                    return encrypted;
+                                });
+                            }
+                            else {
+                                processWriteQuery(model, args, resolved.activeKey, resolved.activeVersion);
+                            }
+                        }
+                        const result = await query(args);
+                        return decryptResult(model, result, resolved.keys);
+                    },
+                    async update({ model, args, query }) {
+                        const context = security_1.dbGuardContextStore.getStore();
+                        const resolved = await resolveTenantKeysAndActiveKey(context?.tenantId);
+                        processWriteQuery(model, args, resolved.activeKey, resolved.activeVersion);
+                        processReadQuery(model, args);
+                        const result = await query(args);
+                        return decryptResult(model, result, resolved.keys);
+                    },
+                    async updateMany({ model, args, query }) {
+                        const context = security_1.dbGuardContextStore.getStore();
+                        const resolved = await resolveTenantKeysAndActiveKey(context?.tenantId);
+                        processWriteQuery(model, args, resolved.activeKey, resolved.activeVersion);
+                        processReadQuery(model, args);
+                        const result = await query(args);
+                        return decryptResult(model, result, resolved.keys);
+                    },
+                    async upsert({ model, args, query }) {
+                        const context = security_1.dbGuardContextStore.getStore();
+                        const resolved = await resolveTenantKeysAndActiveKey(context?.tenantId);
+                        processWriteQuery(model, args, resolved.activeKey, resolved.activeVersion);
+                        processReadQuery(model, args);
+                        const result = await query(args);
+                        return decryptResult(model, result, resolved.keys);
+                    },
+                    async findFirst({ model, args, query }) {
+                        const context = security_1.dbGuardContextStore.getStore();
+                        const resolved = await resolveTenantKeysAndActiveKey(context?.tenantId);
+                        processReadQuery(model, args);
+                        const result = await query(args);
+                        return decryptResult(model, result, resolved.keys);
+                    },
+                    async findUnique({ model, args, query }) {
+                        const context = security_1.dbGuardContextStore.getStore();
+                        const resolved = await resolveTenantKeysAndActiveKey(context?.tenantId);
+                        processReadQuery(model, args);
+                        const result = await query(args);
+                        return decryptResult(model, result, resolved.keys);
+                    },
+                    async findMany({ model, args, query }) {
+                        const context = security_1.dbGuardContextStore.getStore();
+                        const resolved = await resolveTenantKeysAndActiveKey(context?.tenantId);
+                        processReadQuery(model, args);
+                        const result = await query(args);
+                        return decryptResult(model, result, resolved.keys);
+                    },
+                },
+            },
+        });
+    });
+};
+exports.prismaDbGuard = prismaDbGuard;

package/dist/provenance.json

@@ -0,0 +1,222 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "subject": [
+    {
+      "name": "dist/blind-index.d.ts",
+      "digest": {
+        "sha256": "7e613b58cf47bc14d647cfbfa2a9cc0f9e805dbab7562daa00ac679c30830ba7"
+      }
+    },
+    {
+      "name": "dist/blind-index.js",
+      "digest": {
+        "sha256": "fb28a7038cc818346aeb212ece2e5d4f1db4b72fd3ed9dda78a1a7f5744d7455"
+      }
+    },
+    {
+      "name": "dist/cli.d.ts",
+      "digest": {
+        "sha256": "43e818adf60173644896298637f47b01d5819b17eda46eaa32d0c7d64724d012"
+      }
+    },
+    {
+      "name": "dist/cli.js",
+      "digest": {
+        "sha256": "bf91d9b9d820796590d8b030e409031623d177e45cc487da8bcb66af13078ec0"
+      }
+    },
+    {
+      "name": "dist/compliance.d.ts",
+      "digest": {
+        "sha256": "cfdccbe0a9cf27c428af69853b2a16f860dcdfc9ac2f2c65fe7305b7a5332d19"
+      }
+    },
+    {
+      "name": "dist/compliance.js",
+      "digest": {
+        "sha256": "0b660e3eafcc27a78d5c97c7d34837a25c68295660a3d1c7da0ae8e0a676bfb6"
+      }
+    },
+    {
+      "name": "dist/drizzle.d.ts",
+      "digest": {
+        "sha256": "cb43fec66c7da1e84b96a97e8a18b0d08606535c64236f66ff950250d0f23292"
+      }
+    },
+    {
+      "name": "dist/drizzle.js",
+      "digest": {
+        "sha256": "aad49d4c9dd41f2e44175465da6ae7f4a7ae35337ce12f7b3a87113ec0f25424"
+      }
+    },
+    {
+      "name": "dist/index.d.ts",
+      "digest": {
+        "sha256": "7f7c57559ed6b17bd5698a248c18d636c65f812406b685bb6b2fe243d6df59b8"
+      }
+    },
+    {
+      "name": "dist/index.js",
+      "digest": {
+        "sha256": "9a6c591ff862cca301b2b45455b884c2c5ab7e994dd4a31df1235ebdcff8393c"
+      }
+    },
+    {
+      "name": "dist/kms.d.ts",
+      "digest": {
+        "sha256": "822f37608176917f438febaaea06a3b65508c45474bd7e137c4df815c50b4854"
+      }
+    },
+    {
+      "name": "dist/kms.js",
+      "digest": {
+        "sha256": "4b1a32b35545e2e7944ebba3f84272b7421ffedd1cc3c7eb569e1a6b2fcc4a02"
+      }
+    },
+    {
+      "name": "dist/mongoose.d.ts",
+      "digest": {
+        "sha256": "a3bf00d62fecf9266325a9dd18c4ec272de9559355dbf3f9f43836a4688fe86b"
+      }
+    },
+    {
+      "name": "dist/mongoose.js",
+      "digest": {
+        "sha256": "42b2177825713fa1c618b80af6cf7a5d9f4055399c8e95b67018a0410add2a3f"
+      }
+    },
+    {
+      "name": "dist/prisma.d.ts",
+      "digest": {
+        "sha256": "f6b85a786a9bb964f0620df4bcad0787e5c972e853df35551cf8fc902bb79691"
+      }
+    },
+    {
+      "name": "dist/prisma.js",
+      "digest": {
+        "sha256": "e2b7a8fa24c120f59ab48ebb508a18c01e3e24245e04c197b08ad0e327a2d9a8"
+      }
+    },
+    {
+      "name": "dist/security.d.ts",
+      "digest": {
+        "sha256": "85bbbfdbf47b5ce72c29071004664aa8d4c872107a9f1826daaec53f3b40182b"
+      }
+    },
+    {
+      "name": "dist/security.js",
+      "digest": {
+        "sha256": "8d3d398281d7d268e874f540c58371a4ba6410e19d5804d2cdde8fb7628531da"
+      }
+    },
+    {
+      "name": "dist/typeorm.d.ts",
+      "digest": {
+        "sha256": "6cc82bbbe82e260abcc789495fe85f984138c5c8368901881edaece1ffa46d8c"
+      }
+    },
+    {
+      "name": "dist/typeorm.js",
+      "digest": {
+        "sha256": "154827069a5496e043a9f69b3249bd5dddd62690783dfa8675d06d0f574ac76b"
+      }
+    }
+  ],
+  "predicateType": "https://slsa.dev/provenance/v1.0",
+  "predicate": {
+    "buildDefinition": {
+      "buildType": "https://vollcrypt.dev/builders/npm-typescript/v1",
+      "externalParameters": {
+        "packageJson": {
+          "name": "@vollcrypt/db-guard",
+          "version": "0.1.0",
+          "scripts": {
+            "build": "tsc && node scripts/generate-sbom.js",
+            "test": "node --import tsx --test tests/*.test.ts"
+          }
+        }
+      },
+      "internalParameters": {
+        "nodeVersion": "v22.15.0",
+        "platform": "win32",
+        "arch": "x64"
+      },
+      "resolvedDependencies": [
+        {
+          "uri": "pkg:npm/@prisma/client@4.7.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:npm/mongoose@6.0.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:npm/drizzle-orm@0.28.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:npm/typeorm@0.3.0",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/aes-gcm",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/hkdf",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/sha2",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/rand",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/diesel",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/base64",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/once_cell",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/zeroize",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/libsqlite3-sys",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/sea-orm",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/cryptoki",
+          "digest": {}
+        },
+        {
+          "uri": "pkg:rust/secrecy",
+          "digest": {}
+        }
+      ]
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://vollcrypt.dev/builders/local-hermetic-env"
+      },
+      "metadata": {
+        "invocationId": "6a158baa8a336e407b4daf328603e46e",
+        "startedOn": "2026-06-11T12:43:47.573Z",
+        "finishedOn": "2026-06-11T12:43:47.574Z"
+      }
+    }
+  }
+}

package/dist/provenance.json.sig

@@ -0,0 +1 @@
+�]�B�����8٨�3�e�1�,���d2@jIo~�Ҧ��r�4Hp�/9b=�uy'�>�dӰ3