dce-reactkit 3.12.1-beta-cross-server.4 → 3.12.1-beta-cross-server.5

package/genEncodedSecret.ts

@@ -1,5 +1,5 @@
 // Import crypto lib
-import Cryptr from 'cryptr';
+import crypto from 'crypto';
 
 const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
 
@@ -42,9 +42,34 @@ if (!host) {
   process.exit(1);
 }
 
-// Encrypt the secret
-const cryptr = new Cryptr(REACTKIT_CRED_ENCODING_SALT);
-const encodedSecret = cryptr.encrypt(secret);
+// Encryption process based on:
+// https://medium.com/@tony.infisical/guide-to-nodes-crypto-module-for-encryption-decryption-65c077176980
+
+// Create a random initialization vector
+const iv = crypto.randomBytes(12).toString('base64');
+
+// Create a cipher
+const cipher = crypto.createCipheriv(
+  'aes-256-gcm',
+  Buffer.from(secret, 'base64'),
+  Buffer.from(iv, 'base64'),
+);
+
+// Encrypt the string
+let ciphertext = cipher.update(secret, 'utf8', 'base64');
+
+// Finalize the encryption
+ciphertext += cipher.final('base64');
+
+// Get the authentication tag
+const tag = cipher.getAuthTag();
+
+// JSONify the encrypted data
+const encryptionPack = encodeURIComponent(JSON.stringify({
+  ciphertext,
+  iv,
+  tag,
+}));
 
 // Show the encrypted data
 console.log('\n\n');
@@ -54,6 +79,6 @@ console.log('On the server *sending* the requests, append the following to the R
 console.log(`|${host}:${key}:${secret}|`);
 console.log('');
 console.log('On the server *receiving* the requests, add an entry to the "CrossServerCredential" collection:');
-console.log(`{ "description": "${description}", "key": "${key}", "encodedeSecret": "${encodedSecret}", "scopes": [] }`);
+console.log(`{ "description": "${description}", "key": "${key}", "encodedeSecret": "${encryptionPack}", "scopes": [] }`);
 console.log('');
 console.log('For all scopes that the server should have access to, add them to the "scopes" array.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dce-reactkit",
-  "version": "3.12.1-beta-cross-server.4",
+  "version": "3.12.1-beta-cross-server.5",
   "description": "Shared components for Harvard DCE apps",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
@@ -25,6 +25,7 @@
   },
   "homepage": "https://github.com/harvard-edtech/dce-reactkit#readme",
   "dependencies": {
+    "crypto-browserify": "^3.12.1",
     "cryptr": "^6.3.0",
     "qs": "^6.x.x",
     "react-select": "^5.7.3"

package/src/helpers/dataSigner.ts

@@ -1,6 +1,3 @@
-// Import cryptography lib
-import Cryptr from 'cryptr';
-
 // Import shared helpers
 // eslint-disable-next-line import/no-cycle
 import { internalGetCrossServerCredentialCollection } from '../server/initServer';
@@ -38,6 +35,27 @@ const getOauthLib = async () => {
   }
 };
 
+/**
+ * Get a copy of the crypto lib
+ * @author Gabe Abrams
+ * @return the crypto lib
+ */
+const getCryptoLib = async () => {
+  // Get the crypto library (included on the server)
+  // Ignore because this is assumed to be included with typescript
+  // @ts-ignore
+  try {
+    // @ts-ignore
+    const crypto = (await import('crypto-browserify') as any);
+    return crypto;
+  } catch (err) {
+    throw new ErrorWithCode(
+      'Could not sign a cross-server request because we could not load the crypto library. Please make sure this operation is running on the server.',
+      ReactKitErrorCode.NoCryptoLib,
+    );
+  }
+};
+
 /*------------------------------------------------------------------------*/
 /* ------------------------------- Helpers ------------------------------ */
 /*------------------------------------------------------------------------*/
@@ -105,6 +123,9 @@ const genSignature = async (
 const decrypt = async (
   encryptedPack: string,
 ): Promise<string> => {
+  // Decryption process based on:
+  // https://medium.com/@tony.infisical/guide-to-nodes-crypto-module-for-encryption-decryption-65c077176980
+
   // Get the encryption secret
   const { REACTKIT_CRED_ENCODING_SALT } = process.env;
   if (!REACTKIT_CRED_ENCODING_SALT) {
@@ -114,9 +135,29 @@ const decrypt = async (
     );
   }
 
+  // Get the crypto library
+  const crypto = await getCryptoLib();
+
+  // Separate encrypted pack
+  const {
+    ciphertext,
+    iv,
+    tag,
+  } = JSON.parse(decodeURIComponent(encryptedPack));
+
+  // Parse the encrypted data
+  const decipher = crypto.createDecipheriv(
+    'aes-256-gcm',
+    Buffer.from(REACTKIT_CRED_ENCODING_SALT, 'base64'),
+    Buffer.from(iv, 'base64'),
+  );
+
+  // Set the authentication tag
+  decipher.setAuthTag(Buffer.from(tag, 'base64'));
+
   // Decrypt the string
-  const cryptr = new Cryptr(REACTKIT_CRED_ENCODING_SALT);
-  const str = cryptr.decrypt(encryptedPack);
+  let str = decipher.update(ciphertext, 'base64', 'utf8');
+  str += decipher.final('utf8');
 
   // Return the decrypted string
   return str;