@vollcrypt/db-guard 0.9.0 → 0.9.1

package/dist/security.js

@@ -65,6 +65,11 @@ exports.resetAuditLoggerForTesting = resetAuditLoggerForTesting;
 exports.logDecryption = logDecryption;
 exports.decryptWithSecurity = decryptWithSecurity;
 exports.parseCiphertext = parseCiphertext;
+exports.computeBlindIndex = computeBlindIndex;
+exports.encryptValue = encryptValue;
+exports.decryptValue = decryptValue;
+exports.rewriteQueryWhere = rewriteQueryWhere;
+exports.addBlindIndexes = addBlindIndexes;
 const async_hooks_1 = require("async_hooks");
 const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
@@ -589,3 +594,122 @@ function parseCiphertext(stored) {
     }
     throw new Error("Vollcrypt Security: Legacy unversioned ciphertexts are deprecated and unsupported.");
 }
+/**
+ * Computes a hardened, frequency-resistant blind index for a database field.
+ */
+function computeBlindIndex(value, rootSalt, columnName) {
+    if (value === null || value === undefined)
+        return value;
+    const plaintext = typeof value === 'string' ? value : JSON.stringify(value);
+    const columnNameBuf = Buffer.from(columnName, 'utf8');
+    // 1. Derive column-specific key using HKDF-SHA256
+    const derivedColumnKey = deriveHkdf(rootSalt, null, columnNameBuf, 32);
+    try {
+        // 2. Compute the final blind index using the derived column key
+        const plaintextBuf = Buffer.from(plaintext, 'utf8');
+        const blindIndex = deriveHkdf(derivedColumnKey, null, plaintextBuf, 32);
+        return blindIndex.toString('hex');
+    }
+    finally {
+        // 3. RAM Security: Zeroize the derived key immediately (Anti-Core Dump)
+        derivedColumnKey.fill(0);
+    }
+}
+function encryptValue(val, key, version) {
+    if (val === null || val === undefined)
+        return val;
+    const context = exports.dbGuardContextStore.getStore();
+    const tId = context?.tenantId || 'global';
+    if (key.every(b => b === 0) || getFailClosedStatus(tId)) {
+        throw new Error(`Vollcrypt Security: Fail-Closed mode is active for tenant "${tId}". Encryption blocked.`);
+    }
+    const plaintext = typeof val === 'string' ? val : JSON.stringify(val);
+    const plaintextBuf = Buffer.from(plaintext, 'utf8');
+    const encrypted = exports.CRYPTO_ALGORITHMS['1'].encrypt(plaintextBuf, key);
+    // RAM Security: Zeroize the plaintext buffer immediately
+    plaintextBuf.fill(0);
+    return `VOLLVALT:v${version}:${encrypted.toString('base64')}`;
+}
+function decryptValue(stored, keys) {
+    if (typeof stored !== 'string') {
+        return stored;
+    }
+    const parsed = parseCiphertext(stored);
+    if (!parsed) {
+        return stored;
+    }
+    const { algoId, version, base64Data } = parsed;
+    const key = keys[version];
+    if (!key) {
+        throw new Error(`Decryption key version "${version}" not found in registered keys`);
+    }
+    if (key.every(b => b === 0)) {
+        throw new Error(`Vollcrypt Security: Decryption blocked. Key version "${version}" is zeroized due to a Fail-Closed event.`);
+    }
+    try {
+        const encryptedBuf = Buffer.from(base64Data, 'base64');
+        const decryptor = exports.CRYPTO_ALGORITHMS[algoId];
+        if (!decryptor) {
+            throw new Error(`Unsupported decryption algorithm ID "${algoId}"`);
+        }
+        const decrypted = decryptor.decrypt(encryptedBuf, key);
+        const plaintext = decrypted.toString('utf8');
+        // RAM Security: Zeroize the decrypted buffer
+        decrypted.fill(0);
+        try {
+            return JSON.parse(plaintext);
+        }
+        catch {
+            return plaintext;
+        }
+    }
+    catch (err) {
+        throw new Error(`Failed to decrypt field value: ${err.message}`);
+    }
+}
+function rewriteQueryWhere(where, fields, rootSalt, modelName) {
+    if (!where || typeof where !== 'object')
+        return;
+    for (const field of fields) {
+        if (where[field] !== undefined) {
+            const val = where[field];
+            const bidxField = `${field}_bidx`;
+            if (typeof val === 'string' || typeof val === 'number' || typeof val === 'boolean') {
+                where[bidxField] = computeBlindIndex(val, rootSalt, `${modelName}.${field}`);
+                delete where[field];
+            }
+            else if (val && typeof val === 'object') {
+                if (val.equals !== undefined) {
+                    where[bidxField] = {
+                        equals: computeBlindIndex(val.equals, rootSalt, `${modelName}.${field}`),
+                    };
+                    delete where[field];
+                }
+            }
+        }
+    }
+    // Recurse into compound logical operators
+    const operators = ['AND', 'OR', 'NOT'];
+    for (const op of operators) {
+        if (Array.isArray(where[op])) {
+            where[op].forEach((item) => rewriteQueryWhere(item, fields, rootSalt, modelName));
+        }
+        else if (where[op] && typeof where[op] === 'object') {
+            rewriteQueryWhere(where[op], fields, rootSalt, modelName);
+        }
+    }
+}
+function addBlindIndexes(data, fields, rootSalt, modelName) {
+    if (!data || typeof data !== 'object')
+        return;
+    if (Array.isArray(data)) {
+        data.forEach((item) => addBlindIndexes(item, fields, rootSalt, modelName));
+        return;
+    }
+    for (const field of fields) {
+        if (data[field] !== undefined && data[field] !== null) {
+            const bidxField = `${field}_bidx`;
+            data[bidxField] = computeBlindIndex(data[field], rootSalt, `${modelName}.${field}`);
+        }
+    }
+}

package/dist/typeorm.d.ts

@@ -1,4 +1,4 @@
-import { InsertEvent, UpdateEvent } from 'typeorm';
+import type { InsertEvent, UpdateEvent } from 'typeorm';
 import { RateLimiterOptions } from './security';
 export interface TypeOrmDbGuardOptions {
     key: Buffer | Record<string, Buffer>;

package/dist/typeorm.js

@@ -35,9 +35,6 @@ var __runInitializers = (this && this.__runInitializers) || function (thisArg, i
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createTypeOrmSubscriber = createTypeOrmSubscriber;
-const typeorm_1 = require("typeorm");
-const prisma_1 = require("./prisma");
-const blind_index_1 = require("./blind-index");
 const security_1 = require("./security");
 function getKeys(options) {
     let keys;
@@ -56,6 +53,7 @@ function getKeys(options) {
     return { keys, activeVersion };
 }
 function createTypeOrmSubscriber(options) {
+    const { EventSubscriber } = require('typeorm');
     const { keys, activeVersion } = getKeys(options);
     const activeKey = keys[activeVersion];
     if (!activeKey) {
@@ -63,7 +61,7 @@ function createTypeOrmSubscriber(options) {
     }
     (0, security_1.registerKeysForZeroization)(keys);
     let VollcryptDbGuardSubscriber = (() => {
-        let _classDecorators = [(0, typeorm_1.EventSubscriber)()];
+        let _classDecorators = [EventSubscriber()];
         let _classDescriptor;
         let _classExtraInitializers = [];
         let _classThis;
@@ -90,7 +88,7 @@ function createTypeOrmSubscriber(options) {
                             for (const field of bidxFields) {
                                 if (event.entity[field] !== undefined && event.entity[field] !== null) {
                                     const bidxField = `${field}_bidx`;
-                                    event.entity[bidxField] = (0, blind_index_1.computeBlindIndex)(event.entity[field], options.blindIndexes.rootSalt, `${entityName}.${field}`);
+                                    event.entity[bidxField] = (0, security_1.computeBlindIndex)(event.entity[field], options.blindIndexes.rootSalt, `${entityName}.${field}`);
                                 }
                             }
                         }
@@ -98,7 +96,7 @@ function createTypeOrmSubscriber(options) {
                     // Encrypt fields
                     for (const field of fields) {
                         if (event.entity[field] !== undefined && event.entity[field] !== null) {
-                            event.entity[field] = (0, prisma_1.encryptValue)(event.entity[field], activeKey, activeVersion);
+                            event.entity[field] = (0, security_1.encryptValue)(event.entity[field], activeKey, activeVersion);
                         }
                     }
                 }
@@ -114,7 +112,7 @@ function createTypeOrmSubscriber(options) {
                             for (const field of bidxFields) {
                                 if (event.entity[field] !== undefined && event.entity[field] !== null) {
                                     const bidxField = `${field}_bidx`;
-                                    event.entity[bidxField] = (0, blind_index_1.computeBlindIndex)(event.entity[field], options.blindIndexes.rootSalt, `${entityName}.${field}`);
+                                    event.entity[bidxField] = (0, security_1.computeBlindIndex)(event.entity[field], options.blindIndexes.rootSalt, `${entityName}.${field}`);
                                 }
                             }
                         }
@@ -122,7 +120,7 @@ function createTypeOrmSubscriber(options) {
                     // Encrypt fields
                     for (const field of fields) {
                         if (event.entity[field] !== undefined && event.entity[field] !== null) {
-                            event.entity[field] = (0, prisma_1.encryptValue)(event.entity[field], activeKey, activeVersion);
+                            event.entity[field] = (0, security_1.encryptValue)(event.entity[field], activeKey, activeVersion);
                         }
                     }
                 }
@@ -136,7 +134,7 @@ function createTypeOrmSubscriber(options) {
                     for (const field of fields) {
                         if (entity[field] !== undefined && entity[field] !== null) {
                             try {
-                                entity[field] = (0, security_1.decryptWithSecurity)(entity[field], (val) => (0, prisma_1.decryptValue)(val, keys), entityName, field, entity.id || entity._id, options);
+                                entity[field] = (0, security_1.decryptWithSecurity)(entity[field], (val) => (0, security_1.decryptValue)(val, keys), entityName, field, entity.id || entity._id, options);
                             }
                             catch (err) {
                                 throw new Error(`TypeORM db-guard failed to decrypt field "${field}": ${err.message}`);

package/package.json

@@ -1,16 +1,41 @@
 {
   "name": "@vollcrypt/db-guard",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Database field-level encryption integrations for Vollcrypt (Prisma, Mongoose, Drizzle, TypeORM)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
     "vollcrypt-db-guard": "dist/cli.js"
   },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./prisma": {
+      "types": "./dist/prisma.d.ts",
+      "default": "./dist/prisma.js"
+    },
+    "./mongoose": {
+      "types": "./dist/mongoose.d.ts",
+      "default": "./dist/mongoose.js"
+    },
+    "./drizzle": {
+      "types": "./dist/drizzle.d.ts",
+      "default": "./dist/drizzle.js"
+    },
+    "./typeorm": {
+      "types": "./dist/typeorm.d.ts",
+      "default": "./dist/typeorm.js"
+    }
+  },
   "files": [
     "dist",
     "README.md",
-    "compliance-config.json"
+    "compliance-config.json",
+    "LICENSE",
+    "LICENSE-COMMERCIAL.md",
+    "LICENSE-GPL"
   ],
   "publishConfig": {
     "access": "public"