apiro-db 1.0.3 → 1.0.5

package/README.md

@@ -2,7 +2,7 @@
 
 A lightweight, zero-dependency, encrypted data store for Node.js.
 
-Secure Store provides a simple key-value database similar to Quick.db, while removing all third-party dependencies and keeping your data encrypted at rest using Node’s built-in cryptography.
+No configuration. No secrets. Just import and use.
 
 ---
 
@@ -11,7 +11,8 @@ Secure Store provides a simple key-value database similar to Quick.db, while rem
 * Zero dependencies
 * Fully asynchronous API
 * AES-256-GCM encrypted storage
-* User-supplied encryption key
+* Automatic key generation
+* Machine-bound encryption
 * Human-unreadable data at rest
 * Simple, familiar database methods
 
@@ -28,11 +29,10 @@ npm install apiro-db
 ## Usage
 
 ```js
-const { SecureStore } = require("apiro-db");
+import { SecureStore } from "apiro-db";
 
 const db = new SecureStore({
-  file: "./data.db",
-  secret: process.env.DB_SECRET
+  file: "./data.db", // Optional
 });
 
 await db.set("coins", 100);

package/lib/crypto.js

@@ -2,40 +2,30 @@ const crypto = require("crypto");
 
 const ALGO = "aes-256-gcm";
 const IV_LENGTH = 12;
-const SALT_LENGTH = 16;
-const TAG_LENGTH = 16;
 
-function deriveKey(secret, salt) {
-  return crypto.scryptSync(secret, salt, 32);
-}
-
-function encrypt(text, secret) {
+function encrypt(text, key) {
   const iv = crypto.randomBytes(IV_LENGTH);
-  const salt = crypto.randomBytes(SALT_LENGTH);
-  const key = deriveKey(secret, salt);
-
   const cipher = crypto.createCipheriv(ALGO, key, iv);
+
   const encrypted = Buffer.concat([
     cipher.update(text, "utf8"),
     cipher.final()
   ]);
 
-  const tag = cipher.getAuthTag();
-  return Buffer.concat([salt, iv, tag, encrypted]).toString("base64");
+  return Buffer.concat([
+    iv,
+    cipher.getAuthTag(),
+    encrypted
+  ]).toString("base64");
 }
 
-function decrypt(payload, secret) {
+function decrypt(payload, key) {
   const buffer = Buffer.from(payload, "base64");
 
-  const salt = buffer.subarray(0, SALT_LENGTH);
-  const iv = buffer.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
-  const tag = buffer.subarray(
-    SALT_LENGTH + IV_LENGTH,
-    SALT_LENGTH + IV_LENGTH + TAG_LENGTH
-  );
-  const encrypted = buffer.subarray(SALT_LENGTH + IV_LENGTH + TAG_LENGTH);
+  const iv = buffer.subarray(0, 12);
+  const tag = buffer.subarray(12, 28);
+  const encrypted = buffer.subarray(28);
 
-  const key = deriveKey(secret, salt);
   const decipher = crypto.createDecipheriv(ALGO, key, iv);
   decipher.setAuthTag(tag);
 

package/lib/masterKey.js

@@ -0,0 +1,52 @@
+const crypto = require("crypto");
+const os = require("os");
+
+const ALGO = "aes-256-gcm";
+
+function getMachineKey() {
+  const fingerprint = [
+    os.hostname(),
+    os.platform(),
+    os.arch()
+  ].join("|");
+
+  return crypto.scryptSync(fingerprint, "secure-store", 32);
+}
+
+function encryptMasterKey(masterKey) {
+  const iv = crypto.randomBytes(12);
+  const key = getMachineKey();
+
+  const cipher = crypto.createCipheriv(ALGO, key, iv);
+  const encrypted = Buffer.concat([
+    cipher.update(masterKey),
+    cipher.final()
+  ]);
+
+  return {
+    iv: iv.toString("base64"),
+    tag: cipher.getAuthTag().toString("base64"),
+    data: encrypted.toString("base64")
+  };
+}
+
+function decryptMasterKey(payload) {
+  const key = getMachineKey();
+  const iv = Buffer.from(payload.iv, "base64");
+  const tag = Buffer.from(payload.tag, "base64");
+  const encrypted = Buffer.from(payload.data, "base64");
+
+  const decipher = crypto.createDecipheriv(ALGO, key, iv);
+  decipher.setAuthTag(tag);
+
+  return Buffer.concat([
+    decipher.update(encrypted),
+    decipher.final()
+  ]);
+}
+
+module.exports = {
+  generateMasterKey: () => crypto.randomBytes(32),
+  encryptMasterKey,
+  decryptMasterKey
+};

package/lib/store.js

@@ -1,34 +1,46 @@
+const crypto = require("crypto");
 const { readFile, writeFile } = require("./file");
 const { encrypt, decrypt } = require("./crypto");
+const { generateMasterKey, encryptMasterKey, decryptMasterKey } = require("./masterKey");
 
 class SecureStore {
   constructor(options = {}) {
-    if (!options.secret) {
-      throw new Error("SecureStore requires a secret key");
-    }
-
-    this.file = options.file || "./apiro.db";
-    this.secret = options.secret;
+    this.file = options.file || "./secure.db";
     this.data = {};
-    this.ready = this._load();
+    this.masterKey = null;
+    this.ready = this._init();
   }
 
-  async _load() {
-    const encrypted = await readFile(this.file);
-    if (!encrypted) return;
+  async _init() {
+    const existing = await readFile(this.file);
+
+    if (!existing) {
+      this.masterKey = crypto.randomBytes(32);
+      const encryptedKey = encryptMasterKey(this.masterKey);
+
+      const payload = encrypt(JSON.stringify({}), this.masterKey);
+
+      await writeFile(this.file, JSON.stringify({
+        _meta: { key: encryptedKey },
+        payload
+      }));
 
-    try {
-      const decrypted = decrypt(encrypted, this.secret);
-      this.data = JSON.parse(decrypted);
-    } catch {
-      throw new Error("Failed to decrypt data store. Invalid secret?");
+      return;
     }
+
+    const parsed = JSON.parse(existing);
+    this.masterKey = decryptMasterKey(parsed._meta.key);
+    const decrypted = decrypt(parsed.payload, this.masterKey);
+    this.data = JSON.parse(decrypted);
   }
 
   async _save() {
-    const json = JSON.stringify(this.data);
-    const encrypted = encrypt(json, this.secret);
-    await writeFile(this.file, encrypted);
+    const payload = encrypt(JSON.stringify(this.data), this.masterKey);
+
+    await writeFile(this.file, JSON.stringify({
+      _meta: { key: encryptMasterKey(this.masterKey) },
+      payload
+    }));
   }
 
   async get(key) {
@@ -53,9 +65,7 @@ class SecureStore {
 
   async add(key, amount) {
     await this.ready;
-    if (typeof this.data[key] !== "number") {
-      this.data[key] = 0;
-    }
+    if (typeof this.data[key] !== "number") this.data[key] = 0;
     this.data[key] += amount;
     await this._save();
     return this.data[key];
@@ -67,9 +77,7 @@ class SecureStore {
 
   async push(key, value) {
     await this.ready;
-    if (!Array.isArray(this.data[key])) {
-      this.data[key] = [];
-    }
+    if (!Array.isArray(this.data[key])) this.data[key] = [];
     this.data[key].push(value);
     await this._save();
     return this.data[key];

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "apiro-db",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "A lightweight, zero-dependency, encrypted data store for Node.js.",
   "main": "index.js",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
   },
-  "keywords": [],
+  "keywords": ["database", "storage", "encryption", "secure"],
   "author": "krispowers",
   "license": "ISC",
   "files": [