devendra-skill-package 1.0.2

package/.github/skills/encryption-decryption-utility/references/security-checklist.md

@@ -0,0 +1,176 @@
+# Security Checklist
+
+Use this checklist before marking any encryption implementation complete.
+Items are tagged by platform/approach scope.
+
+---
+
+## Crypto — All Platforms
+
+- AES key length is 32 bytes (AES-256).
+- IV length is 12 bytes (GCM) or 16 bytes (CBC depending on approach).
+- Auth tag length is 16 bytes when using GCM mode.
+- Random generation uses a cryptographically secure source (`crypto.subtle`, `randomBytes`, `SecureRandom`, `SecRandomCopyBytes`).
+- Selected approach is supported by the target platform (verified against `platform-matrix.json`).
+
+## Key Handling — All Platforms
+
+- RSA public key format validated (PEM headers present; `BEGIN PUBLIC KEY`).
+- RSA padding is RSA-OAEP. PKCS1 v1.5 only with explicit written approval for legacy systems — not acceptable for new deployments in 2026.
+- RSA key source is HTTPS if API-based.
+- Shared keys (approach 3) are at least 32 characters.
+- No key material written to disk or included in logs.
+
+## Transport and API — All Platforms
+
+- Encryption applied to POST/PUT/PATCH by default.
+- GET excluded unless explicitly configured.
+- FormData excluded from encryption at all times.
+- URL exclusion list configured and validated (if applicable).
+
+---
+
+## React Native — Approaches 4 and 5 (Production)
+
+### Crypto
+
+- AES mode is GCM.
+- IV is 12 bytes.
+- Auth tag is 16 bytes (appended to ciphertext in Base64 output).
+- Per-request AES key generated with `randomBytes(32)` in JS.
+
+### Key Handling
+
+- RSA key cached only in memory.
+- AES key and IV are never persisted.
+- Request key mapping (`requestId → { aesKey, iv }`) cleared immediately after response processing (success or failure).
+- RSA key fetch retry is bounded (default 3 attempts).
+- `KEY_ID_NOT_FOUND` triggers key refresh and exactly one retry — no retry loop.
+
+### Key Handling — Native Mode (Approach 5) Only
+
+- Per-request AES keys are generated in JS using `randomBytes(32)` and passed as base64 to native encrypt/decrypt — they are NOT stored in Android Keystore or iOS Secure Enclave.
+- Raw AES key material is never logged.
+- AES key lives only in the JS request map and is deleted immediately after response.
+- No RSA private key material exists on the client.
+- `try!` is NOT present anywhere in Swift bridge code.
+
+### Key Handling — EC (ECDH) Mode (Approach 6)
+
+- Server EC public key validated on fetch: decoded length MUST be 65 bytes; first byte MUST be `0x04` (uncompressed P-256 point marker).
+- Server EC public key fetched over HTTPS only.
+- Server EC public key cached in memory only (never persisted).
+- Ephemeral EC key pair generated fresh per request using `createECDH('prime256v1')` + `generateKeys()`.
+- Ephemeral EC private key discarded immediately after ECDH `computeSecret()` returns.
+- Derived AES key (from HKDF-SHA256) is never transmitted — only the 65-byte ephemeral public key is sent.
+- HKDF salt is the per-request nonce (unique per request — binds derived key to this request).
+- Derived AES key and IV never persisted; cleared from request map immediately after response.
+- On `KEY_ID_NOT_FOUND` (401): refresh EC public key and retry exactly once — no retry loop.
+
+### Key Handling — Session-Init EC Mode (Additional Checks)
+
+- Session AES key kept in memory ONLY — never persisted to storage.
+- Session AES key lifetime is separate from auth token lifetime. A persisted token does NOT mean the encryption session is alive after app restart.
+- `device_id` is stable and identical across: init request, HKDF context `info` string, AAD canonical JSON, and all encrypted API calls.
+- HKDF `info` string matches the backend's exact contract (confirm explicitly — do NOT assume `'enc'`).
+- AAD is canonical JSON with alphabetically sorted keys. Both client and server must produce identical byte sequences.
+- `encrypted_shared_aes_key` from session init response: confirm whether it is used or ignored before implementing.
+- Base64url fields (`server_ecdh_pub`, `salt`) are normalized and padded before decoding.
+- Nonce format, length, and character set match the backend's exact contract.
+- **Nonce generator uses CSPRNG** (`randomBytes` from quick-crypto), NOT `Math.random()`. When the nonce IS the AES-GCM IV (session-init EC), a predictable IV breaks GCM confidentiality and authenticity.
+- Response IV source is confirmed from the backend contract (nonce-as-IV, separate `iv` field, or other).
+
+### Key Handling — Native Mode (EC)
+
+- ECDH + HKDF run in JS; derived `aesKeyBase64` is passed into `nativeEncryptAES` / `nativeDecryptAES`.
+- Derived AES key is ephemeral — passed as a parameter, not stored in native Keystore or Secure Enclave.
+- Validate `NativeModules.NativeCryptoModule` is accessible before first encrypted request.
+
+### Interceptor
+
+- Request mapping is safe under concurrent requests.
+- Missing request mapping handled with secure fallback — no crash or data leak.
+- Response decryption never leaks plaintext on failure.
+
+### Error Handling
+
+- Invalid auth tag triggers secure logout/session reset — not a silent fallback.
+- Decryption failure does not leak plaintext or key material in error messages or logs.
+- Key fetch failure blocks encrypted calls until resolved.
+
+### Storage
+
+- Tokens stored via `react-native-keychain`.
+- No secrets stored in plain `AsyncStorage`.
+- Sensitive persisted fields stored via keychain.
+
+### Environment
+
+- `ENCRYPTION_ENABLED` supported and defaults to `false` in development unless explicitly set.
+- `ENCRYPTION_MODEL` supported (values: `rsa` / `ec`).
+- `ENCRYPTION_LAYER` supported when using approach 5 or EC+Native (values: `rn` / `native`).
+- `ENCRYPTION_HMAC_SECRET` set as env var at runtime (never written to disk or committed).
+
+### Build and Dependency Verification (All JS Modes — Approaches 4, 6)
+
+- `react-native-quick-crypto` installed at compatible version.
+- `react-native-nitro-modules` installed explicitly (required peer dep for quick-crypto >= 1.0 / RN >= 0.76).
+- `react-native-worklets` installed explicitly (required peer dep for quick-crypto >= 1.0 / RN >= 0.76).
+- `react-native-quick-base64` present — verify with `npm ls react-native-quick-base64`.
+- `buffer` package installed (>= 6.0.0) — required for EC mode Hermes-safe helpers.
+- No `UNMET PEER DEP` warnings for crypto packages in `npm ls`.
+- Android `.cxx` cache cleared and clean build verified after adding native modules.
+- iOS `pod install` completed successfully.
+
+### Native Module Wiring — Approach 5 Only
+
+- `NativeCryptoModule` registered in `MainApplication.java` / `MainApplication.kt` (Android).
+- Bridge `.m` file present and linked in Xcode project (iOS).
+- Pod install completed successfully.
+- `NativeModules.NativeCryptoModule` accessible from JS at runtime.
+- `encryptAES`, `decryptAES`, `encryptRSA` callable and return Promises.
+- `ENCRYPTION_LAYER` env flag set and read correctly in interceptor.
+- Tested on a physical device (not emulator/simulator only).
+
+---
+
+## Angular — Approaches 1, 2, 3
+
+- `HTTP_INTERCEPTORS` provider registered (NgModule) or `withInterceptorsFromDi()` added (standalone).
+- `allowedCommonJsDependencies` updated in `angular.json` for `crypto-js` / `jsencrypt` (approaches 2/3).
+- `privateKeyPem` NOT accepted for browser platforms — private keys must stay on the server.
+- Encryption failure falls back silently (never blocks the HTTP request).
+
+## Node.js — Approaches 2, 3
+
+- Express middleware registered (`app.use(encryptionMiddleware)`).
+- `hmacSecret` read from `ENCRYPTION_HMAC_SECRET` environment variable at runtime.
+- Middleware error path calls `next()` without blocking.
+
+## Android — Approaches 2, 3
+
+- `EncryptionInterceptor` added to OkHttpClient builder.
+- `minSdkVersion` is sufficient for chosen algorithm.
+- No plaintext logging inside interceptor catch block.
+
+## iOS — Approaches 1, 2, 3
+
+- `EncryptionInterceptor.intercept()` called before request dispatch.
+- No `try!` in Swift crypto code.
+- Error path returns original request unmodified.
+
+## Flutter — Approaches 2, 3
+
+- `EncryptionInterceptor` added to Dio instance.
+- Dart `FormData` excluded from encryption.
+- `pubspec.yaml` contains `encrypt: ^5.0.3` and `pointycastle: ^3.7.3`.
+
+---
+
+## Universal (All Approaches, All Platforms)
+
+- No private keys, shared keys, HMAC secrets, or AES keys are hardcoded in source files.
+- No sensitive key material is committed to version control.
+- `encryptionEnabled: false` is the safe default — encryption is opt-in.
+- Build passes without errors after files are written.
+- Generated files do not overwrite existing non-encryption logic.

package/.github/skills/encryption-decryption-utility/references/web-crypto.md

@@ -0,0 +1,74 @@
+# Platform: Web (Vanilla JS / TypeScript SPA)
+
+## Overview
+
+Web projects use a **fetch wrapper** (`encryptRequest()`) instead of an interceptor.  
+The wrapper transparently encrypts the request body before handing off to the native `fetch` API.  
+Supports Approaches 1, 2, 3.
+
+---
+
+## File Naming Convention
+
+| Role           | Path                                      |
+|----------------|------------------------------------------|
+| Config         | `src/encryption.config.ts`               |
+| Service        | `src/encryption.service.ts`              |
+| Interceptor    | `src/encryption.interceptor.ts`          |
+| Module wiring  | `src/main.ts`                            |
+
+---
+
+## Module Wiring
+
+In `src/main.ts`, replace direct `fetch` calls with `encryptRequest`:
+
+```ts
+import { encryptRequest } from './encryption.interceptor.js';
+
+// Replace:
+// fetch(url, options)
+// With:
+// encryptRequest(url, options)
+// ENCRYPTION_INTERCEPTOR_PLACEHOLDER
+```
+
+The `// ENCRYPTION_INTERCEPTOR_PLACEHOLDER` comment is the marker used by install.js `patchFile()`.
+
+---
+
+## Fetch Wrapper Pattern
+
+```ts
+export async function encryptRequest(url: string, options: RequestInit = {}): Promise<Response> {
+  const cfg = encryptionConfig.encryption;
+  if (!cfg.enabled || !options.body) return fetch(url, options);
+  if (cfg.excludeUrls.some(prefix => url.startsWith(prefix))) return fetch(url, options);
+
+  try {
+    const body      = typeof options.body === 'string' ? JSON.parse(options.body) : options.body;
+    const encrypted = await encryptionService.encrypt(body);
+    options = { ...options, body: JSON.stringify(encrypted), headers: { ...options.headers, 'Content-Type': 'application/json' } };
+  } catch {}
+
+  return fetch(url, options);
+}
+```
+
+---
+
+## Dependencies (Approach 2 or 3)
+
+```bash
+npm install jsencrypt crypto-js
+```
+
+Approach 1 uses `crypto.subtle` — supported in all modern browsers without extra packages.
+
+---
+
+## Build Command
+
+```bash
+npm run build
+```

package/.github/skills/encryption-decryption-utility/scripts/detect.js

@@ -0,0 +1,128 @@
+#!/usr/bin/env node
+/**
+ * detect.js - Encryption-Decryption Generator Skill
+ *
+ * Scans a project for existing encryption logic before any file generation.
+ * Exits 0 = ENCRYPTION_NOT_FOUND (safe to proceed)
+ * Exits 1 = ENCRYPTION_FOUND (list of matched files printed)
+ * Exits 2 = Input error (bad or missing --project-path)
+ *
+ * Usage:
+ *   node detect.js --project-path <path> [--platform <platform>]
+ *   node detect.js --help
+ */
+
+'use strict';
+
+const fs   = require('fs');
+const path = require('path');
+
+// ── CLI args ──────────────────────────────────────────────────────────────────
+
+const args = process.argv.slice(2);
+
+if (args.includes('--help') || args.includes('-h')) {
+  console.log([
+    'Usage: node detect.js --project-path <path> [--platform <platform>]',
+    '',
+    'Options:',
+    '  --project-path  Path to project root (required)',
+    '  --platform      One of: angular, web, node, android, ios, flutter (optional)',
+    '  --help          Print this help and exit',
+    '',
+    'Exit codes:',
+    '  0  ENCRYPTION_NOT_FOUND',
+    '  1  ENCRYPTION_FOUND',
+    '  2  Input error',
+  ].join('\n'));
+  process.exit(0);
+}
+
+const projectIndex = args.indexOf('--project-path');
+if (projectIndex === -1 || !args[projectIndex + 1]) {
+  console.error('Error: --project-path is required.');
+  console.error('Run with --help for usage.');
+  process.exit(2);
+}
+
+const projectPath = path.resolve(args[projectIndex + 1]);
+
+if (!fs.existsSync(projectPath)) {
+  console.error('Error: project path does not exist: ' + projectPath);
+  process.exit(2);
+}
+
+// ── Encryption detection patterns ─────────────────────────────────────────────
+
+const PATTERNS = [
+  /EncryptionService/,
+  /EncryptionInterceptor/,
+  /EncryptionMiddleware/,
+  /encryptPayload/,
+  /decryptPayload/,
+  /crypto\.subtle/,
+  /CryptoJS\.AES/,
+  /JSEncrypt/,
+  /AES-256-GCM/i,
+  /AES-256-CBC/i,
+  /RSA-OAEP/i,
+  /javax\.crypto\.Cipher/,
+  /pointycastle/,
+];
+
+// ── File scanner ──────────────────────────────────────────────────────────────
+
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.angular', '.gradle', 'DerivedData']);
+
+function scanDir(dir, results) {
+  if (!fs.existsSync(dir)) return;
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+  for (const entry of entries) {
+    if (SKIP_DIRS.has(entry.name)) continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      scanDir(full, results);
+    } else if (/\.(ts|js|kt|swift|dart|java)$/.test(entry.name)) {
+      results.push(full);
+    }
+  }
+}
+
+function matchedPatterns(filePath) {
+  let content;
+  try { content = fs.readFileSync(filePath, 'utf8'); } catch { return []; }
+  return PATTERNS.filter(p => p.test(content)).map(p => p.toString());
+}
+
+// ── Scan ──────────────────────────────────────────────────────────────────────
+
+const srcPath = path.join(projectPath, 'src');
+const scanRoot = fs.existsSync(srcPath) ? srcPath : projectPath;
+
+const files = [];
+scanDir(scanRoot, files);
+
+const matches = [];
+for (const file of files) {
+  const hits = matchedPatterns(file);
+  if (hits.length > 0) {
+    matches.push({ file: path.relative(projectPath, file), patterns: hits });
+  }
+}
+
+// ── Report ────────────────────────────────────────────────────────────────────
+
+if (matches.length === 0) {
+  console.log('ENCRYPTION_NOT_FOUND');
+  process.exit(0);
+}
+
+console.log('ENCRYPTION_FOUND');
+for (const m of matches) {
+  console.log('  ' + m.file);
+  for (const p of m.patterns) {
+    console.log('    matched: ' + p);
+  }
+}
+process.exit(1);