devendra-skill-package 1.0.2

package/.github/skills/encryption-decryption-utility/references/native-rsa-implementation.md

@@ -0,0 +1,373 @@
+# RSA + Native — Implementation Reference
+
+Covers the **RSA model + Native layer** only.
+The interceptor structure, request mapping, and envelope shape are identical to RSA JS mode.
+Only the AES and RSA operations move into platform-native code.
+
+---
+
+## Architecture Overview
+
+- AES-256-GCM and RSA-OAEP run inside the device OS engine.
+- Android: `javax.crypto.Cipher` (AES/GCM/NoPadding + RSA/ECB/OAEPWithSHA-256AndMGF1Padding).
+- iOS: `CryptoKit.AES.GCM.seal/open` + `SecKeyCreateEncryptedData(.rsaEncryptionOAEPSHA256)`.
+- Per-request AES keys are generated in JS with `randomBytes(32)`, passed as base64 into every native call, and discarded after the response. They are never stored in Android Keystore or iOS Secure Enclave.
+
+---
+
+## Step 1: Dependencies
+
+Install these for the native crypto backend. Keep `react-native-quick-crypto` — it is still required for `randomBytes(32)` used in the JS interceptor to generate per-request AES keys before passing them into native calls.
+
+```
+react-native-quick-crypto — still required for randomBytes (key generation in JS interceptor)
+react-native-aes-crypto   — native AES-256-GCM (Android javax.crypto + iOS CryptoKit/CommonCrypto)
+react-native-rsa-native   — native RSA-OAEP (Android KeyFactory + iOS SecKeyCreateEncryptedData)
+react-native-keychain     — token/session storage (unchanged from JS mode)
+```
+
+- Android: verify `minSdkVersion >= 23` before proceeding.
+- iOS: verify deployment target `>= 13.0` for CryptoKit; plan CommonCrypto fallback if below.
+- Run `pod install` (iOS) and Gradle sync (Android) after installation.
+
+---
+
+## Step 2: Android — `NativeCryptoModule.kt`
+
+```kotlin
+// android/app/src/main/java/.../NativeCryptoModule.kt
+package com.yourapp
+
+import android.util.Base64
+import com.facebook.react.bridge.*
+import java.security.KeyFactory
+import java.security.spec.X509EncodedKeySpec
+import javax.crypto.Cipher
+import javax.crypto.spec.GCMParameterSpec
+import javax.crypto.spec.SecretKeySpec
+
+class NativeCryptoModule(reactContext: ReactApplicationContext) :
+    ReactContextBaseJavaModule(reactContext) {
+
+    override fun getName() = "NativeCryptoModule"
+
+    @ReactMethod
+    fun encryptAES(plaintext: String, keyBase64: String, promise: Promise) {
+        try {
+            val keyBytes = Base64.decode(keyBase64, Base64.NO_WRAP)
+            require(keyBytes.size == 32) { "AES key must be 32 bytes" }
+            val secretKey = SecretKeySpec(keyBytes, "AES")
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+            cipher.init(Cipher.ENCRYPT_MODE, secretKey)
+            val iv = cipher.iv  // 12 bytes, auto-generated
+            val cipherWithTag = cipher.doFinal(plaintext.toByteArray(Charsets.UTF_8))
+            // GCM appends the 16-byte auth tag to cipherWithTag automatically
+            val result = WritableNativeMap()
+            result.putString("ciphertext", Base64.encodeToString(cipherWithTag, Base64.NO_WRAP))
+            result.putString("iv", Base64.encodeToString(iv, Base64.NO_WRAP))
+            promise.resolve(result)
+        } catch (e: Exception) {
+            promise.reject("ERR_ENCRYPT", e.message, e)
+        }
+    }
+
+    @ReactMethod
+    fun decryptAES(ciphertextBase64: String, ivBase64: String, keyBase64: String, promise: Promise) {
+        try {
+            val keyBytes = Base64.decode(keyBase64, Base64.NO_WRAP)
+            require(keyBytes.size == 32) { "AES key must be 32 bytes" }
+            val cipherWithTag = Base64.decode(ciphertextBase64, Base64.NO_WRAP)
+            val iv = Base64.decode(ivBase64, Base64.NO_WRAP)
+            val secretKey = SecretKeySpec(keyBytes, "AES")
+            val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+            cipher.init(Cipher.DECRYPT_MODE, secretKey, GCMParameterSpec(128, iv))
+            // GCM verifies the auth tag automatically; throws AEADBadTagException on failure
+            val plaintext = cipher.doFinal(cipherWithTag)
+            promise.resolve(String(plaintext, Charsets.UTF_8))
+        } catch (e: Exception) {
+            promise.reject("ERR_DECRYPT", e.message, e)
+        }
+    }
+
+    @ReactMethod
+    fun encryptRSA(publicKeyPem: String, dataBase64: String, promise: Promise) {
+        try {
+            val pem = publicKeyPem
+                .replace("-----BEGIN PUBLIC KEY-----", "")
+                .replace("-----END PUBLIC KEY-----", "")
+                .replace("\n", "").trim()
+            val keyBytes = Base64.decode(pem, Base64.NO_WRAP)
+            val publicKey = KeyFactory.getInstance("RSA").generatePublic(X509EncodedKeySpec(keyBytes))
+            val cipher = Cipher.getInstance("RSA/ECB/OAEPWithSHA-256AndMGF1Padding")
+            cipher.init(Cipher.ENCRYPT_MODE, publicKey)
+            val encrypted = cipher.doFinal(Base64.decode(dataBase64, Base64.NO_WRAP))
+            promise.resolve(Base64.encodeToString(encrypted, Base64.NO_WRAP))
+        } catch (e: Exception) {
+            promise.reject("ERR_RSA_ENCRYPT", e.message, e)
+        }
+    }
+}
+```
+
+> `AEADBadTagException` on decryption = auth tag failure → trigger force logout/session reset.
+
+---
+
+## Step 3: Android — `NativeCryptoPackage.kt` + Registration
+
+```kotlin
+// NativeCryptoPackage.kt
+class NativeCryptoPackage : ReactPackage {
+    override fun createNativeModules(context: ReactApplicationContext) =
+        listOf(NativeCryptoModule(context))
+    override fun createViewManagers(context: ReactApplicationContext) = emptyList<ViewManager<*, *>>()
+}
+```
+
+Register in `MainApplication.kt` (or `.java`):
+
+```kotlin
+override fun getPackages(): List<ReactPackage> = listOf(
+    MainReactPackage(),
+    NativeCryptoPackage(),   // ← add this
+)
+```
+
+---
+
+## Step 4: iOS — `NativeCryptoModule.swift`
+
+**Never use `try!` in production code. Always use `do/try/catch`.**
+
+```swift
+// ios/NativeCryptoModule.swift
+import CryptoKit
+import Foundation
+
+@objc(NativeCryptoModule)
+class NativeCryptoModule: NSObject {
+
+    @objc func encryptAES(
+        _ plaintext: String,
+        keyBase64: String,
+        resolve: @escaping RCTPromiseResolveBlock,
+        reject: @escaping RCTPromiseRejectBlock
+    ) {
+        do {
+            guard let data = plaintext.data(using: .utf8),
+                  let keyData = Data(base64Encoded: keyBase64),
+                  keyData.count == 32 else {
+                return reject("ERR_INVALID_INPUT", "Invalid plaintext or key", nil)
+            }
+            let symmetricKey = SymmetricKey(data: keyData)
+            let nonce = try AES.GCM.Nonce()
+            let sealed = try AES.GCM.seal(data, using: symmetricKey, nonce: nonce)
+            resolve([
+                "ciphertext": (sealed.ciphertext + sealed.tag).base64EncodedString(),
+                "iv": Data(nonce).base64EncodedString()
+            ])
+        } catch {
+            reject("ERR_ENCRYPT", error.localizedDescription, error)
+        }
+    }
+
+    @objc func decryptAES(
+        _ ciphertextBase64: String,
+        ivBase64: String,
+        keyBase64: String,
+        resolve: @escaping RCTPromiseResolveBlock,
+        reject: @escaping RCTPromiseRejectBlock
+    ) {
+        do {
+            guard let combined = Data(base64Encoded: ciphertextBase64),
+                  let ivData = Data(base64Encoded: ivBase64),
+                  let keyData = Data(base64Encoded: keyBase64),
+                  keyData.count == 32,
+                  combined.count > 16 else {
+                return reject("ERR_INVALID_INPUT", "Invalid decrypt inputs", nil)
+            }
+            let tag = combined.suffix(16)
+            let ciphertext = combined.dropLast(16)
+            let symmetricKey = SymmetricKey(data: keyData)
+            let nonce = try AES.GCM.Nonce(data: ivData)
+            let box = try AES.GCM.SealedBox(nonce: nonce, ciphertext: ciphertext, tag: tag)
+            let plainData = try AES.GCM.open(box, using: symmetricKey)
+            guard let result = String(data: plainData, encoding: .utf8) else {
+                return reject("ERR_DECODE", "Failed to decode plaintext", nil)
+            }
+            resolve(result)
+        } catch {
+            reject("ERR_DECRYPT", error.localizedDescription, error)
+        }
+    }
+
+    @objc func encryptRSA(
+        _ publicKeyPEM: String,
+        dataBase64: String,
+        resolve: @escaping RCTPromiseResolveBlock,
+        reject: @escaping RCTPromiseRejectBlock
+    ) {
+        guard let data = Data(base64Encoded: dataBase64) else {
+            return reject("ERR_INVALID_INPUT", "Invalid data for RSA encrypt", nil)
+        }
+        let pemStripped = publicKeyPEM
+            .replacingOccurrences(of: "-----BEGIN PUBLIC KEY-----", with: "")
+            .replacingOccurrences(of: "-----END PUBLIC KEY-----", with: "")
+            .replacingOccurrences(of: "\n", with: "")
+        guard let keyData = Data(base64Encoded: pemStripped) else {
+            return reject("ERR_KEY_PARSE", "Invalid PEM key", nil)
+        }
+        let keyDict: [CFString: Any] = [
+            kSecAttrKeyType: kSecAttrKeyTypeRSA,
+            kSecAttrKeyClass: kSecAttrKeyClassPublic
+        ]
+        guard let secKey = SecKeyCreateWithData(keyData as CFData, keyDict as CFDictionary, nil) else {
+            return reject("ERR_KEY_LOAD", "Failed to load RSA public key", nil)
+        }
+        var error: Unmanaged<CFError>?
+        guard let encrypted = SecKeyCreateEncryptedData(
+            secKey, .rsaEncryptionOAEPSHA256, data as CFData, &error
+        ) else {
+            reject("ERR_RSA_ENCRYPT",
+                   error?.takeRetainedValue().localizedDescription ?? "RSA encrypt failed", nil)
+            return
+        }
+        resolve((encrypted as Data).base64EncodedString())
+    }
+}
+```
+
+> iOS < 13 fallback: use `CommonCrypto CCCrypt` with `kCCAlgorithmAES` / GCM via `CCCryptorGCM`. Prefer CryptoKit for all new work.
+
+---
+
+## Step 5: iOS — Bridge File (`NativeCryptoModule.m`)
+
+```objc
+// ios/NativeCryptoModule.m
+#import <React/RCTBridgeModule.h>
+
+@interface RCT_EXTERN_MODULE(NativeCryptoModule, NSObject)
+
+RCT_EXTERN_METHOD(encryptAES:(NSString *)plaintext
+                  keyBase64:(NSString *)keyBase64
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(decryptAES:(NSString *)ciphertextBase64
+                  ivBase64:(NSString *)ivBase64
+                  keyBase64:(NSString *)keyBase64
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+RCT_EXTERN_METHOD(encryptRSA:(NSString *)publicKeyPEM
+                  dataBase64:(NSString *)dataBase64
+                  resolve:(RCTPromiseResolveBlock)resolve
+                  reject:(RCTPromiseRejectBlock)reject)
+
+@end
+```
+
+Add `NativeCryptoModule.m` to the Xcode project target. Run `pod install`.
+
+---
+
+## Step 6: JS Bridge Interface (`native-crypto.module.ts`)
+
+```typescript
+// src/services/security/native-crypto.module.ts
+import { NativeModules } from 'react-native';
+
+const { NativeCryptoModule } = NativeModules;
+
+export interface NativeEncryptResult {
+  ciphertext: string;  // base64(ciphertext + 16-byte auth_tag)
+  iv: string;          // base64(12-byte IV)
+}
+
+export const nativeEncryptAES = (
+  plaintext: string,
+  keyBase64: string,
+): Promise<NativeEncryptResult> =>
+  NativeCryptoModule.encryptAES(plaintext, keyBase64);
+
+export const nativeDecryptAES = (
+  ciphertextBase64: string,
+  ivBase64: string,
+  keyBase64: string,
+): Promise<string> =>
+  NativeCryptoModule.decryptAES(ciphertextBase64, ivBase64, keyBase64);
+
+export const nativeEncryptRSA = (
+  publicKeyPEM: string,
+  dataBase64: string,
+): Promise<string> =>
+  NativeCryptoModule.encryptRSA(publicKeyPEM, dataBase64);
+```
+
+---
+
+## Step 7: Interceptor Integration (RSA + Native)
+
+```typescript
+// Request interceptor — RSA Native path
+import { randomBytes } from 'react-native-quick-crypto';
+import { nativeEncryptAES, nativeEncryptRSA } from './native-crypto.module';
+
+const aesKeyBytes = randomBytes(32);
+const aesKeyBase64 = aesKeyBytes.toString('base64');
+
+const { ciphertext, iv } = await nativeEncryptAES(JSON.stringify(requestBody), aesKeyBase64);
+const encryptedKey = await nativeEncryptRSA(rsaPublicKeyPEM, aesKeyBase64);
+
+// Store only the AES key — response decryption uses responseData.iv (server-generated IV), not request iv.
+requestMap.set(requestId, { aesKeyBase64 });
+config.data = { data: ciphertext, key: encryptedKey, iv, nonce, key_id: currentKeyId };
+
+// Response decryption:
+const { aesKeyBase64 } = requestMap.get(requestId);
+const plaintext = await nativeDecryptAES(responseData.data, responseData.iv, aesKeyBase64);
+requestMap.delete(requestId); // clean up immediately
+```
+
+---
+
+## Step 8: Environment Variables
+
+```
+ENCRYPTION_ENABLED=true
+ENCRYPTION_MODEL=rsa
+ENCRYPTION_LAYER=native
+```
+
+---
+
+## Deliverables Summary
+
+| File | Action |
+|------|--------|
+| `android/app/src/main/java/.../NativeCryptoModule.kt` | Create |
+| `android/app/src/main/java/.../NativeCryptoPackage.kt` | Create |
+| `android/app/src/main/java/.../MainApplication.kt` | Register `NativeCryptoPackage` |
+| `ios/NativeCryptoModule.swift` | Create |
+| `ios/NativeCryptoModule.m` | Create, add to Xcode target |
+| `src/services/security/native-crypto.module.ts` | Create JS bridge |
+| `src/services/api.ts` | Update interceptors to call native bridge |
+| `.env` / `.env.example` | Add `ENCRYPTION_LAYER=native` |
+
+---
+
+## Startup Validation
+
+Before the first encrypted request, verify the native module is accessible:
+
+```typescript
+import { NativeModules } from 'react-native';
+
+if (!NativeModules.NativeCryptoModule) {
+  throw new Error(
+    'NativeCryptoModule not found. Ensure NativeCryptoPackage is registered in MainApplication ' +
+    '(Android) and NativeCryptoModule.m is linked in Xcode (iOS). Run pod install and clean build.'
+  );
+}
+```

package/.github/skills/encryption-decryption-utility/references/node-crypto.md

@@ -0,0 +1,86 @@
+# Platform: Node.js (Express/NestJS)
+
+## Overview
+
+Node.js uses an **Express middleware** function to transparently encrypt outgoing response bodies  
+or decrypt incoming request bodies depending on the use-case.  
+Supports Approaches 2 and 3 only (Approach 1 requires browser Web Crypto and is NOT compatible).
+
+---
+
+## File Naming Convention
+
+| Role           | Path                                              |
+|----------------|--------------------------------------------------|
+| Config         | `src/encryption/encryption.config.ts`            |
+| Service        | `src/encryption/encryption.service.ts`           |
+| Interceptor    | `src/encryption/encryption.middleware.ts`        |
+| Module wiring  | `src/main.ts`                                    |
+
+---
+
+## Module Wiring (Express)
+
+```ts
+import { encryptionMiddleware } from './encryption/encryption.middleware';
+
+app.use(express.json());
+app.use(encryptionMiddleware);
+// ENCRYPTION_INTERCEPTOR_PLACEHOLDER
+```
+
+The `// ENCRYPTION_INTERCEPTOR_PLACEHOLDER` comment is the marker used by install.js `patchFile()`.
+
+---
+
+## Middleware Pattern
+
+```ts
+export async function encryptionMiddleware(req: Request, res: Response, next: NextFunction): Promise<void> {
+  const cfg = encryptionConfig.encryption;
+  if (!cfg.enabled || req.body == null) return next();
+  if (cfg.excludeUrls.some(prefix => req.path.startsWith(prefix))) return next();
+  try {
+    req.body = await encryptionService.encrypt(req.body);
+  } catch {}
+  next();
+}
+```
+
+---
+
+## Built-in crypto (Approach 3 — no extra libraries)
+
+```ts
+import crypto from 'crypto';
+
+function encrypt(body: object, sharedKey: string): object {
+  const key = crypto.createHash('sha256').update(sharedKey).digest();
+  const iv  = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+  const encrypted = Buffer.concat([cipher.update(JSON.stringify(body), 'utf8'), cipher.final()]);
+  return {
+    iv:            iv.toString('base64'),
+    encryptedData: encrypted.toString('base64'),
+  };
+}
+```
+
+---
+
+## Dependencies (Approach 2)
+
+```bash
+npm install jsencrypt crypto-js
+npm install --save-dev @types/crypto-js
+```
+
+Approach 3 uses the built-in `crypto` module — no extra packages.
+
+---
+
+## Build Command
+
+```bash
+npm run build
+```

package/.github/skills/encryption-decryption-utility/references/react-crypto.md

@@ -0,0 +1,105 @@
+# Platform: React (Web / CRA / Vite)
+
+## Overview
+
+React projects use an **Axios interceptor** to transparently encrypt outgoing request bodies.  
+All encryption logic lives in `EncryptionService`; the interceptor calls the service and attaches the encrypted payload before the request leaves the client.  
+Supports Approaches 1, 2, 3.
+
+> **Approach 7 — React JS Web Production Mode**: For production-grade encryption using the built-in Web Crypto API (AES-256-GCM + RSA-OAEP or ECDH-Session, per-request ephemeral keys, response decryption, browser-safe storage, zero extra crypto packages), see `references/react-web-crypto.md`. Approach 7 supersedes approach 1 for new React JS deployments requiring a full request/response encryption lifecycle.
+
+---
+
+## File Naming Convention
+
+| Role           | Path                                                  |
+|----------------|-------------------------------------------------------|
+| Config         | `src/encryption/encryption.config.ts`                 |
+| Service        | `src/encryption/encryption.service.ts`                |
+| Interceptor    | `src/encryption/encryption.interceptor.ts`            |
+| Module wiring  | `src/api/axiosInstance.ts`                            |
+
+---
+
+## Module Wiring
+
+Create a shared Axios instance in `src/api/axiosInstance.ts` and register the interceptor there.  
+Import this instance in all API call sites instead of importing `axios` directly.
+
+```ts
+import axios from 'axios';
+import { applyEncryptionInterceptor } from '../encryption/encryption.interceptor';
+
+const axiosInstance = axios.create({
+  baseURL: encryptionConfig.apiUrl,
+});
+
+applyEncryptionInterceptor(axiosInstance);
+// ENCRYPTION_INTERCEPTOR_PLACEHOLDER
+
+export default axiosInstance;
+```
+
+The `// ENCRYPTION_INTERCEPTOR_PLACEHOLDER` comment is the marker used by install.js `patchFile()`.
+
+---
+
+## Interceptor Pattern
+
+```ts
+import axios, { AxiosInstance, InternalAxiosRequestConfig } from 'axios';
+import { encryptionService } from './encryption.service';
+import { encryptionConfig } from './encryption.config';
+
+export function applyEncryptionInterceptor(instance: AxiosInstance): void {
+  const cfg = encryptionConfig.encryption;
+
+  instance.interceptors.request.use(
+    async (config: InternalAxiosRequestConfig) => {
+      if (!cfg.enabled)                                         return config;
+      if (!config.data)                                         return config;
+      if (config.data instanceof FormData)                      return config;
+      if (cfg.excludeUrls?.some(u => config.url?.startsWith(u))) return config;
+
+      try {
+        config.data = await encryptionService.encrypt(config.data);
+        config.headers['Content-Type'] = 'application/json';
+      } catch {}
+
+      return config;
+    },
+    (error) => Promise.reject(error)
+  );
+}
+```
+
+---
+
+## URL Exclusion Pattern
+
+```ts
+const excludeUrls: string[] = encryptionConfig.encryption.excludeUrls;
+if (excludeUrls.some(prefix => config.url?.startsWith(prefix))) {
+  return config;
+}
+```
+
+---
+
+## Dependencies (Approach 2 or 3)
+
+```bash
+npm install axios jsencrypt crypto-js
+npm install --save-dev @types/crypto-js
+```
+
+Approach 1 uses the browser-native `crypto.subtle` — no extra packages.  
+Axios is required for all approaches when using the interceptor pattern.
+
+---
+
+## Build Command
+
+```bash
+npm run build
+```