onbuzz 4.6.4 → 4.7.0

package/src/interfaces/accountRoutes.js

@@ -0,0 +1,250 @@
+/**
+ * Account & API-key management routes on the local CLI server.
+ *
+ * These are thin proxies over the autopilot-backend's `/auth/*` and
+ * `/account/*` endpoints. The local server holds the user's JWT in
+ * `lastAuthResult.jwt` (encrypted on disk via authCacheStore) and
+ * forwards it as a `Authorization: Bearer` to the backend. The web-ui
+ * never sees the JWT after the initial OAuth landing — keeping it on
+ * the local-server side means:
+ *
+ *   1. No CORS dance between the browser and Azure backend.
+ *   2. The web-ui can talk to one origin (its own).
+ *   3. A compromised renderer cannot exfiltrate the bearer in plaintext
+ *      (it lives in localStorage, but everything that NEEDS it goes
+ *      through the local server).
+ *   4. Symmetric with the existing marketplaceApi pattern.
+ *
+ * Endpoints (mounted by webServer.js at boot):
+ *   GET    /api/account/profile         — proxies /auth/me
+ *   GET    /api/account/balance         — proxies /account/balance (ledger)
+ *   GET    /api/account/keys            — proxies /auth/apikeys
+ *   POST   /api/account/keys            — proxies /auth/apikey  (one-time-reveal body)
+ *   DELETE /api/account/keys/:id        — proxies /auth/apikey/:id
+ *   POST   /api/account/handoff         — mints + returns a portal handoff URL
+ *
+ * Auth: each route requires `lastAuthResult.jwt` to be present. When
+ * the user hasn't OAuth'd yet, we return 401 with a clear `code` the
+ * FE can branch on ('not_signed_in') so it can prompt for sign-in
+ * rather than show a generic error.
+ *
+ * Security guarantees:
+ *   - The local server never returns the JWT to the renderer.
+ *   - The API-key create endpoint returns the `lx_*` value exactly
+ *     once (mirroring the backend); subsequent list calls show only
+ *     metadata + a masked key.
+ *   - The handoff URL embeds a single-use short-lived token, NOT the
+ *     long-lived JWT.
+ *   - All errors are normalised to `{ success: false, error, code? }`
+ *     so the FE never has to special-case axios vs fetch envelopes.
+ *
+ * Testable design:
+ *   `createAccountRouter()` accepts every dependency it needs (fetch
+ *   impl, backend URL, JWT getter, logger). Production builds inject
+ *   the real ones; tests inject stubs. See accountRoutes.test.js.
+ */
+
+import express from 'express';
+
+/**
+ * Default backend URL — overridable via the same `config.backend.baseUrl`
+ * the existing /auth routes use, so a single env-config change moves
+ * every backend call to staging or local-dev.
+ */
+const DEFAULT_BACKEND_URL = 'https://autopilot-api.azurewebsites.net';
+
+/**
+ * Portal URL per brand. The handoff endpoint uses this to construct
+ * the deep-link the FE opens in the system browser. Two reasons we
+ * pick the brand at construction time, not request time:
+ *   - The local server already knows its brand (loaded at boot).
+ *   - The renderer should never get to influence which portal we send
+ *     the user to (mitigation against open-redirect via a tampered
+ *     request body).
+ */
+const PORTAL_URLS_BY_BRAND = Object.freeze({
+  autopilot: 'https://autopilot.loxia.ai',
+  onbuzz:    'https://onbuzz.loxia.ai',
+});
+
+/**
+ * Codes the FE branches on. Keep this list in lockstep with web-ui's
+ * account API client. New codes must be added to the FE's switch.
+ */
+export const ERROR_CODES = Object.freeze({
+  NOT_SIGNED_IN:    'not_signed_in',
+  BACKEND_ERROR:    'backend_error',
+  NETWORK_ERROR:    'network_error',
+  BAD_REQUEST:      'bad_request',
+  NOT_FOUND:        'not_found',
+});
+
+/**
+ * Build the account router. Pure DI — every external concern is a
+ * function the caller passes in.
+ *
+ * @param {Object} deps
+ * @param {() => string|null} deps.getJwt
+ *   Returns the user's current JWT or null when unauthenticated.
+ *   Caller hooks this to `() => webServer.lastAuthResult?.jwt`.
+ * @param {() => string} deps.getBrand
+ *   Returns 'autopilot' | 'onbuzz'. Used to pick portal URL.
+ * @param {string} [deps.backendBaseUrl]
+ * @param {typeof fetch} [deps.fetchImpl]
+ * @param {Object} [deps.logger]
+ */
+export function createAccountRouter({
+  getJwt,
+  getBrand,
+  backendBaseUrl = DEFAULT_BACKEND_URL,
+  fetchImpl = fetch,
+  logger = console,
+} = {}) {
+  if (typeof getJwt !== 'function') throw new Error('createAccountRouter: getJwt is required');
+  if (typeof getBrand !== 'function') throw new Error('createAccountRouter: getBrand is required');
+
+  const router = express.Router();
+  const baseUrl = backendBaseUrl.replace(/\/$/, '');
+
+  /**
+   * Forward a request to the backend with the user's JWT. Returns a
+   * { status, body } tuple the route handlers can hand straight back
+   * to Express, normalising every transport failure into the same
+   * envelope.
+   */
+  async function proxyToBackend(method, path, body) {
+    const jwt = getJwt();
+    if (!jwt) {
+      return {
+        status: 401,
+        body: { success: false, error: 'Sign in to manage your account', code: ERROR_CODES.NOT_SIGNED_IN },
+      };
+    }
+    const url = `${baseUrl}${path}`;
+    try {
+      const res = await fetchImpl(url, {
+        method,
+        headers: {
+          'Authorization': `Bearer ${jwt}`,
+          'Content-Type': 'application/json',
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+      });
+
+      const text = await res.text();
+      let parsed;
+      try { parsed = text ? JSON.parse(text) : {}; } catch { parsed = { raw: text }; }
+
+      if (!res.ok) {
+        return {
+          status: res.status,
+          body: {
+            success: false,
+            error: parsed.error || parsed.message || `Backend returned ${res.status}`,
+            code: res.status === 404 ? ERROR_CODES.NOT_FOUND : ERROR_CODES.BACKEND_ERROR,
+          },
+        };
+      }
+      return { status: res.status, body: parsed };
+    } catch (err) {
+      logger?.warn?.('[accountRoutes] backend fetch failed', { method, path, error: err.message });
+      return {
+        status: 503,
+        body: {
+          success: false,
+          error: 'Could not reach the account service. Try again in a moment.',
+          code: ERROR_CODES.NETWORK_ERROR,
+        },
+      };
+    }
+  }
+
+  // ── Profile ────────────────────────────────────────────────────────
+  router.get('/profile', async (_req, res) => {
+    const r = await proxyToBackend('GET', '/auth/me');
+    // /auth/me returns either `{ user: {...} }` or `{...userFields}`.
+    // Normalise so the FE always sees `{ user: {...} }`.
+    if (r.status === 200) {
+      const u = r.body?.user || r.body;
+      return res.json({ success: true, user: u });
+    }
+    res.status(r.status).json(r.body);
+  });
+
+  // ── Balance ────────────────────────────────────────────────────────
+  router.get('/balance', async (_req, res) => {
+    // The backend exposes a balance read at /account/profile (which
+    // bundles plan + balance) — see autopilot-backend/routes/account.js.
+    // Calling this single endpoint instead of /ledger/balance keeps the
+    // local server free of ledger credentials.
+    const r = await proxyToBackend('GET', '/account/profile');
+    res.status(r.status).json(r.body);
+  });
+
+  // ── API keys list ──────────────────────────────────────────────────
+  router.get('/keys', async (_req, res) => {
+    const r = await proxyToBackend('GET', '/auth/apikeys');
+    res.status(r.status).json(r.body);
+  });
+
+  // ── API key create ────────────────────────────────────────────────
+  router.post('/keys', express.json(), async (req, res) => {
+    const { name, expiresIn } = req.body || {};
+    if (!name || typeof name !== 'string' || !name.trim()) {
+      return res.status(400).json({
+        success: false,
+        error: 'Provide a name to identify the key',
+        code: ERROR_CODES.BAD_REQUEST,
+      });
+    }
+    const payload = { name: name.trim() };
+    if (expiresIn != null) payload.expiresIn = expiresIn;
+    const r = await proxyToBackend('POST', '/auth/apikey', payload);
+    res.status(r.status).json(r.body);
+  });
+
+  // ── API key revoke ────────────────────────────────────────────────
+  router.delete('/keys/:id', async (req, res) => {
+    const id = req.params.id;
+    if (!id || !/^[a-zA-Z0-9_-]+$/.test(id)) {
+      return res.status(400).json({
+        success: false,
+        error: 'Invalid key id',
+        code: ERROR_CODES.BAD_REQUEST,
+      });
+    }
+    const r = await proxyToBackend('DELETE', `/auth/apikey/${encodeURIComponent(id)}`);
+    res.status(r.status).json(r.body);
+  });
+
+  // ── Portal handoff (Buy Credits) ──────────────────────────────────
+  router.post('/handoff', async (req, res) => {
+    const { destination } = req.body || {};
+    // Closed allowlist — never let the renderer drive arbitrary portal
+    // paths. New destinations must be added here intentionally.
+    const ALLOWED_DESTINATIONS = ['payment', 'subscription', 'api-keys', 'account'];
+    const path = destination && ALLOWED_DESTINATIONS.includes(destination) ? destination : 'payment';
+
+    const r = await proxyToBackend('POST', '/auth/handoff-token', { purpose: `portal-${path}` });
+    if (r.status !== 200 && r.status !== 201) {
+      return res.status(r.status).json(r.body);
+    }
+    const handoff = r.body?.handoff || r.body?.token;
+    if (!handoff) {
+      return res.status(502).json({
+        success: false,
+        error: 'Backend did not return a handoff token',
+        code: ERROR_CODES.BACKEND_ERROR,
+      });
+    }
+    const brand = getBrand();
+    const portalBase = PORTAL_URLS_BY_BRAND[brand] || PORTAL_URLS_BY_BRAND.autopilot;
+    const url = `${portalBase}/${path}?handoff=${encodeURIComponent(handoff)}`;
+    res.json({ success: true, url });
+  });
+
+  return router;
+}
+
+// Exported so tests + future routes can re-use it.
+export const __test__ = { PORTAL_URLS_BY_BRAND, DEFAULT_BACKEND_URL };

package/src/interfaces/webServer.js

@@ -33,6 +33,9 @@ import { getGalleryService } from '../services/galleryService.js';
 import { getUserDataPaths } from '../utilities/userDataDir.js';
 import { projectActiveRuns } from '../utilities/flowRunFilters.js';
 import { recordOAuthResult, recordResolvedUser, projectAuthStatus } from '../utilities/authCache.js';
+import AuthCacheStore from '../services/authCacheStore.js';
+import { createAccountRouter } from './accountRoutes.js';
+import { getBrand } from '../utilities/brand.js';
 
 // Connect visual editor server to bridge (enables element selection forwarding)
 setBridgeGetter(getVisualEditorBridge);
@@ -419,8 +422,15 @@ class WebServer {
     // API Key Manager reference (will be set by LoxiaSystem)
     this.apiKeyManager = null;
 
-    // Cached auth result for polling support (set by /auth/callback, cleared by /auth/signout)
-    this.lastAuthResult = null; // { user, hasApiKey, timestamp }
+    // Cached auth result for polling support (set by /auth/callback, cleared by /auth/signout).
+    // Shape: { user, hasApiKey, jwt, timestamp }. The JWT is the critical
+    // field for marketplace publish/install/rate calls — see authCache.js.
+    // Persisted encrypted to <userDataDir>/settings/auth-cache.enc via
+    // `authCacheStore` so a server restart no longer wipes the JWT.
+    // Use `_setLastAuthResult(value)` rather than assigning directly so
+    // every mutation hits disk too.
+    this.lastAuthResult = null;
+    this.authCacheStore = new AuthCacheStore(this.logger);
 
     // Credential Vault for secure credential management
     this.credentialVault = null;
@@ -447,6 +457,20 @@ class WebServer {
    */
   async initialize() {
     try {
+      // Restore the persisted auth cache (JWT + user) so a server restart
+      // doesn't strand the FE without a token. Best-effort: a missing or
+      // corrupted file just leaves `lastAuthResult` at null.
+      await this.authCacheStore.initialize();
+      const restored = await this.authCacheStore.load();
+      if (restored) {
+        this.lastAuthResult = restored;
+        this.logger?.info?.('[WebServer] Restored auth cache from disk', {
+          hasUser: !!restored.user,
+          hasJwt: !!restored.jwt,
+          savedAt: restored.timestamp,
+        });
+      }
+
       this.setupMiddleware();
       await this.setupRoutes();
       this.setupWebSocket();
@@ -462,7 +486,7 @@ class WebServer {
       // In remote session mode, auto-configure API key from environment
       if (process.env.LOXIA_REMOTE_SESSION === 'true' && process.env.LOXIA_API_KEY && this.apiKeyManager) {
         try {
-          await this.apiKeyManager.setKeys(null, { loxiaApiKey: process.env.LOXIA_API_KEY });
+          await this.apiKeyManager.setSessionKeys(null, { loxiaApiKey: process.env.LOXIA_API_KEY });
           this.logger.info('Remote session: API key auto-configured from environment');
         } catch (err) {
           this.logger.warn('Remote session: Failed to set API key from environment', { error: err.message });
@@ -485,6 +509,22 @@ class WebServer {
     }
   }
 
+  /**
+   * Single mutator for `lastAuthResult`. Always writes to disk so a
+   * server restart can restore the JWT. Passing null clears both
+   * memory and disk. Every call site that previously assigned to
+   * `this.lastAuthResult` directly should go through this helper.
+   * @param {Object|null} value
+   * @returns {Promise<void>}
+   */
+  async _setLastAuthResult(value) {
+    this.lastAuthResult = value || null;
+    // Fire-and-forget would be tempting but it lets a fast-following
+    // /api/auth/status read race the write. Awaiting is cheap: one
+    // ~200B AES-GCM write to a local file.
+    await this.authCacheStore.save(this.lastAuthResult);
+  }
+
   /**
    * Start the Visual Editor Server (always-on mode)
    * Server runs on port 4000 (or configured port) and waits for agent connections
@@ -859,7 +899,7 @@ class WebServer {
 
         // Store the API key if generated
         if (apiKey && this.apiKeyManager) {
-          await this.apiKeyManager.setKeys(null, { loxiaApiKey: apiKey });
+          await this.apiKeyManager.setSessionKeys(null, { loxiaApiKey: apiKey });
           this.logger?.info('API key auto-configured from OAuth login', { userId: userInfo.id });
         }
 
@@ -870,11 +910,11 @@ class WebServer {
         // marketplace publish/install/rate calls would 401 because the
         // FE never got the token into localStorage. Logic lives in
         // `utilities/authCache.js` so unit tests can lock the contract.
-        this.lastAuthResult = recordOAuthResult({
+        await this._setLastAuthResult(recordOAuthResult({
           user: userInfo,
           jwt: token,
           hasApiKey: !!apiKey,
-        });
+        }));
 
         // Broadcast auth success to connected web UI clients
         // Include the raw JWT so the frontend can use it for marketplace API calls
@@ -945,10 +985,10 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
         // Preserves any JWT from a prior OAuth login (this path mints
         // no JWT of its own — it just links a user from an existing
         // API key). See utilities/authCache.js for the invariant.
-        this.lastAuthResult = recordResolvedUser({
+        await this._setLastAuthResult(recordResolvedUser({
           user,
           prevCache: this.lastAuthResult,
-        });
+        }));
 
         res.json({ success: true, user });
       } catch (error) {
@@ -961,9 +1001,9 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
     this.app.post('/api/auth/signout', async (req, res) => {
       try {
         if (this.apiKeyManager) {
-          await this.apiKeyManager.removeKeys(null);
+          await this.apiKeyManager.removeSessionKeys(null);
         }
-        this.lastAuthResult = null;
+        await this._setLastAuthResult(null);
         this.broadcastToSession(null, {
           type: 'auth_signout',
           data: { timestamp: new Date().toISOString() }
@@ -974,6 +1014,19 @@ h2{color:#16a34a;margin-bottom:.5rem;} p{color:#666;}</style></head>
       }
     });
 
+    // =====================================================
+    // Account & API-key management (proxied to autopilot-backend).
+    // Defined in `interfaces/accountRoutes.js`; mounted here so the FE
+    // can hit /api/account/{profile,balance,keys,handoff} without ever
+    // touching the user's JWT directly.
+    // =====================================================
+    this.app.use('/api/account', createAccountRouter({
+      getJwt:   () => this.lastAuthResult?.jwt || null,
+      getBrand: () => getBrand().isOnBuzz ? 'onbuzz' : 'autopilot',
+      backendBaseUrl: this.config?.backend?.baseUrl,
+      logger:   this.logger,
+    }));
+
     // =====================================================
     // System Update API
     // =====================================================

package/src/services/__tests__/apiKeyManager.test.js

@@ -85,12 +85,10 @@ describe('ApiKeyManager', () => {
     expect(logger.warn).toHaveBeenCalled();
   });
 
-  test('_getMachineIdentifier returns colon-separated string', () => {
-    const id = manager._getMachineIdentifier();
-    expect(id).toContain('test-host');
-    expect(id).toContain('testuser');
-    expect(id).toContain('loxia-api-key-encryption-v1');
-  });
+  // _getMachineIdentifier moved to `utilities/secretsCipher.js` as part
+  // of the DRY refactor sharing the cipher with `services/authCacheStore.js`.
+  // The equivalent coverage now lives in
+  // `src/utilities/__tests__/secretsCipher.test.js`.
 
   test('_encrypt throws when no encryption key', () => {
     expect(() => manager._encrypt('test')).toThrow('Encryption key not initialized');

package/src/services/__tests__/authCacheStore.test.js

@@ -0,0 +1,118 @@
+/**
+ * Round-trip + failure-mode tests for `services/authCacheStore.js`.
+ *
+ * The store is the disk half of the marketplace-publish fix: without
+ * it, a server restart wipes the JWT cache and the FE's polling
+ * fallback gets `{ user: null, jwt: null }` so any browser without the
+ * token already in localStorage 401s on publish.
+ *
+ * These tests exercise the real cipher against a tmp directory by
+ * pointing `getUserDataPaths` at it via the harness below.
+ */
+
+import { describe, test, expect, beforeEach, afterEach, jest } from '@jest/globals';
+import { promises as fs } from 'fs';
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+
+// Mock userDataDir BEFORE importing the store so the dynamic import
+// below picks up the mock. Each test resets the tmpdir.
+const tmpRoot = path.join(os.tmpdir(), 'authCacheStore-test-' + crypto.randomBytes(6).toString('hex'));
+
+jest.unstable_mockModule('../../utilities/userDataDir.js', () => ({
+  getUserDataPaths: () => ({ settings: tmpRoot }),
+  ensureUserDataDirs: async () => { await fs.mkdir(tmpRoot, { recursive: true }); },
+}));
+
+const { default: AuthCacheStore } = await import('../authCacheStore.js');
+
+const SAMPLE_CACHE = Object.freeze({
+  user: { id: 'u-1', email: 'a@b.com' },
+  hasApiKey: true,
+  jwt: 'eyJ.test.jwt',
+  timestamp: '2026-05-11T12:00:00.000Z',
+});
+
+async function cleanTmp() {
+  try { await fs.rm(tmpRoot, { recursive: true, force: true }); } catch { /* ok */ }
+}
+
+describe('AuthCacheStore', () => {
+  beforeEach(async () => { await cleanTmp(); });
+  afterEach(async () => { await cleanTmp(); });
+
+  test('load returns null when uninitialized (no init() call yet)', async () => {
+    const store = new AuthCacheStore(null);
+    expect(await store.load()).toBeNull();
+  });
+
+  test('load returns null when file does not exist', async () => {
+    const store = new AuthCacheStore(null);
+    await store.initialize();
+    expect(await store.load()).toBeNull();
+  });
+
+  test('save then load returns the same row', async () => {
+    const store = new AuthCacheStore(null);
+    await store.initialize();
+    await store.save(SAMPLE_CACHE);
+    const loaded = await store.load();
+    expect(loaded).toEqual(SAMPLE_CACHE);
+  });
+
+  test('save(null) deletes the file', async () => {
+    const store = new AuthCacheStore(null);
+    await store.initialize();
+    await store.save(SAMPLE_CACHE);
+    const filePath = path.join(tmpRoot, 'auth-cache.enc');
+    await fs.access(filePath); // exists
+    await store.save(null);
+    await expect(fs.access(filePath)).rejects.toThrow();
+  });
+
+  test('clear() is a no-op when file does not exist', async () => {
+    const store = new AuthCacheStore(null);
+    await store.initialize();
+    await expect(store.clear()).resolves.toBeUndefined();
+  });
+
+  test('two store instances on the same machine share the key — second can read what first wrote', async () => {
+    // This is the actual production scenario: restart spawns a fresh
+    // AuthCacheStore that must decrypt what the previous instance saved.
+    const writer = new AuthCacheStore(null);
+    await writer.initialize();
+    await writer.save(SAMPLE_CACHE);
+
+    const reader = new AuthCacheStore(null);
+    await reader.initialize();
+    expect(await reader.load()).toEqual(SAMPLE_CACHE);
+  });
+
+  test('load returns null on corrupted ciphertext', async () => {
+    const store = new AuthCacheStore(null);
+    await store.initialize();
+    await fs.writeFile(path.join(tmpRoot, 'auth-cache.enc'), 'this-is-not-valid-base64-ciphertext!!');
+    expect(await store.load()).toBeNull();
+  });
+
+  test('load returns null on schema-version mismatch', async () => {
+    const store = new AuthCacheStore(null);
+    await store.initialize();
+    // Hand-craft a valid ciphertext with the wrong version.
+    const { encrypt } = await import('../../utilities/secretsCipher.js');
+    const payload = JSON.stringify({ version: 999, cache: SAMPLE_CACHE });
+    const ct = encrypt(payload, store.encryptionKey);
+    await fs.writeFile(path.join(tmpRoot, 'auth-cache.enc'), ct);
+    expect(await store.load()).toBeNull();
+  });
+
+  test('save survives ENOENT on directory creation between init and save (best-effort)', async () => {
+    // Edge case: someone deletes the settings dir mid-flight. save()
+    // should warn but not throw, so the request handler can finish.
+    const store = new AuthCacheStore(null);
+    await store.initialize();
+    await fs.rm(tmpRoot, { recursive: true, force: true });
+    await expect(store.save(SAMPLE_CACHE)).resolves.toBeUndefined();
+  });
+});

package/src/services/apiKeyManager.js

@@ -14,18 +14,13 @@
 
 import { promises as fs } from 'fs';
 import path from 'path';
-import crypto from 'crypto';
-import os from 'os';
 import { getUserDataPaths, ensureUserDataDirs } from '../utilities/userDataDir.js';
 import { isPlaceholderApiKey } from '../utilities/apiKeyPlaceholders.js';
-
-// Encryption configuration
-const ALGORITHM = 'aes-256-gcm';
-const KEY_LENGTH = 32; // 256 bits
-const IV_LENGTH = 16;
-const AUTH_TAG_LENGTH = 16;
-const SALT_LENGTH = 32;
-const PBKDF2_ITERATIONS = 100000;
+import {
+  getOrCreateEncryptionKey as _getOrCreateEncryptionKey,
+  encrypt as _cipherEncrypt,
+  decrypt as _cipherDecrypt,
+} from '../utilities/secretsCipher.js';
 
 class ApiKeyManager {
   constructor(logger) {
@@ -73,103 +68,21 @@ class ApiKeyManager {
   }
 
   /**
-   * Get or create a machine-specific encryption key
-   * @param {string} settingsDir - Settings directory path
-   * @returns {Promise<Buffer>} Encryption key
+   * Cipher primitives delegate to `utilities/secretsCipher.js` so the
+   * api-keys.enc and auth-cache.enc stores share one implementation
+   * and one byte layout. See that module for the on-disk format and
+   * the KEY_DERIVATION_DOMAIN constant.
    */
   async _getOrCreateEncryptionKey(settingsDir) {
-    const saltFile = path.join(settingsDir, '.key-salt');
-    let salt;
-
-    try {
-      salt = await fs.readFile(saltFile);
-    } catch (error) {
-      // Generate new salt
-      salt = crypto.randomBytes(SALT_LENGTH);
-      await fs.writeFile(saltFile, salt, { mode: 0o600 });
-      this.logger?.info('[ApiKeyManager] Generated new encryption salt');
-    }
-
-    // Derive key from salt + machine-specific data
-    const machineData = this._getMachineIdentifier();
-    const key = crypto.pbkdf2Sync(
-      machineData,
-      salt,
-      PBKDF2_ITERATIONS,
-      KEY_LENGTH,
-      'sha256'
-    );
-
-    return key;
+    return _getOrCreateEncryptionKey(settingsDir, this.logger);
   }
 
-  /**
-   * Get a machine-specific identifier for key derivation
-   * @returns {string}
-   */
-  _getMachineIdentifier() {
-    const parts = [
-      os.hostname(),
-      os.homedir(),
-      os.userInfo().username,
-      process.platform,
-      'loxia-api-key-encryption-v1'
-    ];
-    return parts.join(':');
-  }
-
-  /**
-   * Encrypt data using AES-256-GCM
-   * @param {string} plaintext - Data to encrypt
-   * @returns {string} Encrypted data as base64
-   */
   _encrypt(plaintext) {
-    if (!this.encryptionKey) {
-      throw new Error('Encryption key not initialized');
-    }
-
-    const iv = crypto.randomBytes(IV_LENGTH);
-    const cipher = crypto.createCipheriv(ALGORITHM, this.encryptionKey, iv);
-
-    let encrypted = cipher.update(plaintext, 'utf8', 'base64');
-    encrypted += cipher.final('base64');
-
-    const authTag = cipher.getAuthTag();
-
-    // Combine IV + authTag + encrypted data
-    const combined = Buffer.concat([
-      iv,
-      authTag,
-      Buffer.from(encrypted, 'base64')
-    ]);
-
-    return combined.toString('base64');
+    return _cipherEncrypt(plaintext, this.encryptionKey);
   }
 
-  /**
-   * Decrypt data using AES-256-GCM
-   * @param {string} encryptedData - Encrypted data as base64
-   * @returns {string} Decrypted plaintext
-   */
   _decrypt(encryptedData) {
-    if (!this.encryptionKey) {
-      throw new Error('Encryption key not initialized');
-    }
-
-    const combined = Buffer.from(encryptedData, 'base64');
-
-    // Extract IV, authTag, and encrypted data
-    const iv = combined.subarray(0, IV_LENGTH);
-    const authTag = combined.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
-    const encrypted = combined.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
-
-    const decipher = crypto.createDecipheriv(ALGORITHM, this.encryptionKey, iv);
-    decipher.setAuthTag(authTag);
-
-    let decrypted = decipher.update(encrypted.toString('base64'), 'base64', 'utf8');
-    decrypted += decipher.final('utf8');
-
-    return decrypted;
+    return _cipherDecrypt(encryptedData, this.encryptionKey);
   }
 
   /**