stegdoc 6.0.0 → 6.1.0

package/src/index.js

@@ -24,7 +24,6 @@ program
   .option('-f, --format <format>', 'Output format: xlsx (default) or docx', 'xlsx')
   .option('-p, --password <password>', 'Encryption password (optional, but recommended)')
   .option('--force', 'Overwrite existing files without asking')
-  .option('--legacy', 'Use v4 format (hidden sheet + gzip) for backward compatibility')
   .option('--v5', 'Emit the v5 format (PBKDF2) instead of the v6 default')
   .option('--v6', 'Emit the v6 format (default; Argon2id, authenticated metadata)')
   .option('--no-limit', 'Bypass DOCX 1 MB size limit (large files will produce huge documents)')

package/src/lib/compression.js

@@ -9,40 +9,6 @@ const zlib = require('zlib');
  */
 const BROTLI_DEFAULT_QUALITY = 6;
 
-/**
- * Compress data using Brotli (used in v5+)
- * @param {Buffer} buffer - Data to compress
- * @param {number} [quality] - Compression quality (0-11, default 6)
- * @returns {Promise<Buffer>} Compressed data
- */
-function compressBrotli(buffer, quality) {
-  const q = quality !== undefined ? quality : BROTLI_DEFAULT_QUALITY;
-  return new Promise((resolve, reject) => {
-    zlib.brotliCompress(buffer, {
-      params: {
-        [zlib.constants.BROTLI_PARAM_QUALITY]: q,
-      },
-    }, (err, result) => {
-      if (err) reject(err);
-      else resolve(result);
-    });
-  });
-}
-
-/**
- * Decompress Brotli data
- * @param {Buffer} buffer - Compressed data
- * @returns {Promise<Buffer>} Decompressed data
- */
-function decompressBrotli(buffer) {
-  return new Promise((resolve, reject) => {
-    zlib.brotliDecompress(buffer, (err, result) => {
-      if (err) reject(err);
-      else resolve(result);
-    });
-  });
-}
-
 /**
  * Create a streaming Brotli compression transform
  * @param {number} [quality] - Compression quality (0-11, default 6)
@@ -57,130 +23,4 @@ function createBrotliCompressStream(quality) {
   });
 }
 
-/**
- * Create a streaming Brotli decompression transform
- * @returns {zlib.BrotliDecompress} Brotli transform stream
- */
-function createBrotliDecompressStream() {
-  return zlib.createBrotliDecompress();
-}
-
-// ─── Gzip Compression (v3/v4 legacy) ───────────────────────────────────────
-
-/**
- * MIME types that are already compressed - no benefit from additional compression
- */
-const COMPRESSED_MIMES = new Set([
-  // Archives
-  'application/zip',
-  'application/x-7z-compressed',
-  'application/x-rar-compressed',
-  'application/gzip',
-  'application/x-gzip',
-  'application/x-bzip2',
-  'application/x-xz',
-  'application/x-tar',
-  'application/x-lzip',
-  'application/x-lzma',
-  'application/zstd',
-
-  // Images (lossy compressed)
-  'image/jpeg',
-  'image/png',
-  'image/gif',
-  'image/webp',
-  'image/avif',
-  'image/heic',
-  'image/heif',
-  'image/jxl',
-
-  // Audio
-  'audio/mpeg', // mp3
-  'audio/ogg',
-  'audio/flac',
-  'audio/aac',
-  'audio/mp4',
-  'audio/x-m4a',
-  'audio/opus',
-
-  // Video
-  'video/mp4',
-  'video/webm',
-  'video/x-matroska', // mkv
-  'video/quicktime', // mov
-  'video/x-msvideo', // avi
-  'video/mpeg',
-
-  // Documents (OOXML are zip-based)
-  'application/vnd.openxmlformats-officedocument.wordprocessingml.document', // docx
-  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', // xlsx
-  'application/vnd.openxmlformats-officedocument.presentationml.presentation', // pptx
-  'application/pdf',
-  'application/epub+zip',
-]);
-
-/**
- * Check if a file type is already compressed
- * @param {string|null} mime - MIME type from file-type detection
- * @returns {boolean}
- */
-function isCompressedMime(mime) {
-  return mime ? COMPRESSED_MIMES.has(mime) : false;
-}
-
-/**
- * Compress data using gzip
- * @param {Buffer} buffer - Data to compress
- * @returns {Promise<Buffer>} Compressed data
- */
-function compress(buffer) {
-  return new Promise((resolve, reject) => {
-    zlib.gzip(buffer, { level: 9 }, (err, result) => {
-      if (err) reject(err);
-      else resolve(result);
-    });
-  });
-}
-
-/**
- * Decompress gzip data
- * @param {Buffer} buffer - Compressed data
- * @returns {Promise<Buffer>} Decompressed data
- */
-function decompress(buffer) {
-  return new Promise((resolve, reject) => {
-    zlib.gunzip(buffer, (err, result) => {
-      if (err) reject(err);
-      else resolve(result);
-    });
-  });
-}
-
-/**
- * Create a streaming gzip compression transform
- * @returns {zlib.Gzip} Gzip transform stream
- */
-function createCompressStream() {
-  return zlib.createGzip({ level: 9 });
-}
-
-/**
- * Create a streaming gunzip decompression transform
- * @returns {zlib.Gunzip} Gunzip transform stream
- */
-function createDecompressStream() {
-  return zlib.createGunzip();
-}
-
-module.exports = {
-  isCompressedMime,
-  compress,
-  decompress,
-  createCompressStream,
-  createDecompressStream,
-  compressBrotli,
-  decompressBrotli,
-  createBrotliCompressStream,
-  createBrotliDecompressStream,
-  COMPRESSED_MIMES,
-};
+module.exports = { createBrotliCompressStream };

package/src/lib/crypto.js

@@ -18,75 +18,6 @@ function deriveKey(password, salt) {
   return crypto.pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, KEY_LENGTH, 'sha256');
 }
 
-/**
- * Encrypt plaintext using AES-256-GCM
- * @param {string} plaintext - Data to encrypt
- * @param {string} password - User password
- * @returns {object} { ciphertext, iv, salt, authTag } - all as base64 strings
- */
-function encrypt(plaintext, password) {
-  // Generate random salt and IV
-  const salt = crypto.randomBytes(SALT_LENGTH);
-  const iv = crypto.randomBytes(IV_LENGTH);
-
-  // Derive key from password
-  const key = deriveKey(password, salt);
-
-  // Create cipher and encrypt
-  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, {
-    authTagLength: AUTH_TAG_LENGTH,
-  });
-
-  let ciphertext = cipher.update(plaintext, 'utf8', 'base64');
-  ciphertext += cipher.final('base64');
-
-  // Get authentication tag
-  const authTag = cipher.getAuthTag();
-
-  return {
-    ciphertext,
-    iv: iv.toString('base64'),
-    salt: salt.toString('base64'),
-    authTag: authTag.toString('base64'),
-  };
-}
-
-/**
- * Decrypt ciphertext using AES-256-GCM
- * @param {string} ciphertext - Encrypted data (base64)
- * @param {string} password - User password
- * @param {string} ivBase64 - Initialization vector (base64)
- * @param {string} saltBase64 - Salt used for key derivation (base64)
- * @param {string} authTagBase64 - Authentication tag (base64)
- * @returns {string} Decrypted plaintext
- * @throws {Error} If decryption fails (wrong password or tampered data)
- */
-function decrypt(ciphertext, password, ivBase64, saltBase64, authTagBase64) {
-  // Convert from base64
-  const iv = Buffer.from(ivBase64, 'base64');
-  const salt = Buffer.from(saltBase64, 'base64');
-  const authTag = Buffer.from(authTagBase64, 'base64');
-
-  // Derive key from password
-  const key = deriveKey(password, salt);
-
-  // Create decipher
-  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, {
-    authTagLength: AUTH_TAG_LENGTH,
-  });
-
-  // Set auth tag for verification
-  decipher.setAuthTag(authTag);
-
-  try {
-    let plaintext = decipher.update(ciphertext, 'base64', 'utf8');
-    plaintext += decipher.final('utf8');
-    return plaintext;
-  } catch (error) {
-    throw new Error('Decryption failed: Invalid password or corrupted data');
-  }
-}
-
 /**
  * Pack encryption metadata into a single string for storage
  * @param {object} encryptionData - { iv, salt, authTag }
@@ -96,19 +27,6 @@ function packEncryptionMeta(encryptionData) {
   return `${encryptionData.iv}:${encryptionData.salt}:${encryptionData.authTag}`;
 }
 
-/**
- * Unpack encryption metadata from storage string
- * @param {string} packed - Packed string (iv:salt:authTag)
- * @returns {object} { iv, salt, authTag }
- */
-function unpackEncryptionMeta(packed) {
-  const [iv, salt, authTag] = packed.split(':');
-  if (!iv || !salt || !authTag) {
-    throw new Error('Invalid encryption metadata format');
-  }
-  return { iv, salt, authTag };
-}
-
 /**
  * Generate a random salt for key derivation (one per encode session)
  * @returns {Buffer} Random salt
@@ -139,34 +57,9 @@ function createEncryptStream(password, salt) {
   };
 }
 
-/**
- * Create a streaming decrypt decipher for per-part decryption.
- * Auth tag is set immediately and verified on .final().
- * @param {string} password - User password
- * @param {string} ivBase64 - IV (base64)
- * @param {string} saltBase64 - Salt (base64)
- * @param {string} authTagBase64 - Auth tag (base64)
- * @returns {crypto.Decipher} Decipher transform stream
- */
-function createDecryptStream(password, ivBase64, saltBase64, authTagBase64) {
-  const iv = Buffer.from(ivBase64, 'base64');
-  const salt = Buffer.from(saltBase64, 'base64');
-  const authTag = Buffer.from(authTagBase64, 'base64');
-  const key = deriveKey(password, salt);
-  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, {
-    authTagLength: AUTH_TAG_LENGTH,
-  });
-  decipher.setAuthTag(authTag);
-  return decipher;
-}
-
 module.exports = {
-  encrypt,
-  decrypt,
   deriveKey,
   packEncryptionMeta,
-  unpackEncryptionMeta,
   generateSalt,
   createEncryptStream,
-  createDecryptStream,
 };

package/src/lib/docx-handler.js

@@ -1,16 +1,11 @@
 const {
   Document, Paragraph, TextRun, Packer, Table, TableRow, TableCell,
-  AlignmentType, HeadingLevel, WidthType, ShadingType, BorderStyle, PageBreak,
+  AlignmentType, HeadingLevel, WidthType, ShadingType,
 } = require('docx');
 const fs = require('fs');
 const path = require('path');
-const { serializeMetadata, parseMetadata } = require('./metadata');
-const { parseXmlFromZip, ensureArray, extractTextContent } = require('./xml-utils');
 const { generateIncident, generateHebrewDate } = require('./docx-templates');
-const {
-  encodePayloadToLogLines, decodeLogLines, generateLogHeaders, resetTimeState,
-  BYTES_PER_DATA_LINE, calculateDataLineCount,
-} = require('./log-generator');
+const { encodePayloadToLogLines, resetTimeState } = require('./log-generator');
 
 // ─── Shared Styles ──────────────────────────────────────────────────────────
 
@@ -311,277 +306,6 @@ function createHebrewCell(text, isHeader, widthPct) {
   });
 }
 
-// ─── v5 DOCX Reader ─────────────────────────────────────────────────────────
-
-/**
- * Read a v5 log-embed DOCX file and extract payload.
- * Scans for monospace paragraphs that contain log lines.
- * @param {string} docxPath - Path to DOCX file
- * @returns {object} { payloadBuffer, metadataJson, encryptionMeta, metadata, formatVersion }
- */
-async function readDocxV5(docxPath) {
-  const docParsed = parseXmlFromZip(docxPath, 'word/document.xml');
-  if (!docParsed) {
-    throw new Error('Could not find document.xml in DOCX file');
-  }
-
-  // Also parse styles to identify monospace/code runs
-  const stylesParsed = parseXmlFromZip(docxPath, 'word/styles.xml');
-
-  // Extract all paragraphs with their formatting info
-  const body = docParsed?.document?.body;
-  if (!body) throw new Error('Empty document body');
-
-  const paragraphs = ensureArray(body.p);
-  const logLines = [];
-
-  for (const para of paragraphs) {
-    const runs = ensureArray(para.r);
-    let paraText = '';
-    let isCode = false;
-
-    for (const run of runs) {
-      if (run.t !== undefined) {
-        paraText += extractTextContent(run.t);
-      }
-
-      // Check if run uses monospace font (Consolas/Courier)
-      const rPr = run.rPr;
-      if (rPr) {
-        const fonts = rPr.rFonts;
-        if (fonts) {
-          const fontName = fonts['@_w:ascii'] || fonts['@_ascii'] || '';
-          if (/consolas|courier/i.test(fontName)) {
-            isCode = true;
-          }
-        }
-      }
-    }
-
-    // Also check paragraph-level shading as indicator of code block
-    const pPr = para.pPr;
-    if (pPr && pPr.shd) {
-      const fill = pPr.shd['@_w:fill'] || pPr.shd['@_fill'] || '';
-      if (fill === 'F2F2F2' || fill === 'f2f2f2') {
-        isCode = true;
-      }
-    }
-
-    // Collect code paragraphs that look like log lines
-    if (isCode && paraText.trim().length > 0) {
-      // Skip the comment line
-      if (paraText.startsWith('//')) continue;
-      logLines.push(paraText.trim());
-    }
-  }
-
-  if (logLines.length === 0) {
-    throw new Error('No log lines found in DOCX file. This may not be a v5 stegdoc file.');
-  }
-
-  // Parse log lines back into row arrays
-  const rows = logLines.map(parseLogLine);
-
-  // Decode using the same engine as XLSX
-  return decodeLogLines(rows);
-}
-
-/**
- * Parse a formatted log line string back into a row array.
- * Input format: `IP - - [timestamp] "request" status bytes "referer" "ua" "requestId" "traceId"`
- */
-function parseLogLine(line) {
-  // Regex to parse nginx combined log format with extra fields
-  const regex = /^(\S+)\s+-\s+-\s+(\[[^\]]+\])\s+"([^"]+)"\s+(\d+)\s+(\d+)\s+"([^"]+)"\s+"([^"]+)"\s+"([^"]+)"\s+"([^"]+)"$/;
-  const match = line.match(regex);
-
-  if (!match) {
-    // Fallback: try to extract what we can
-    return ['', '', '', line, '', '', '', '', '', ''];
-  }
-
-  const [, ip, timestamp, request, status, bytes, referer, ua, requestId, traceId] = match;
-
-  // Extract method from request
-  const methodMatch = request.match(/^(\w+)\s/);
-  const method = methodMatch ? methodMatch[1] : '';
-
-  return [ip, timestamp, method, request, status, bytes, referer, ua, requestId, traceId];
-}
-
-/**
- * Detect if a DOCX file is v5 (log-embed) format.
- * Checks for the presence of log-formatted monospace content.
- */
-function detectDocxVersion(docxPath) {
-  try {
-    const docParsed = parseXmlFromZip(docxPath, 'word/document.xml');
-    if (!docParsed) return 'legacy';
-
-    const body = docParsed?.document?.body;
-    if (!body) return 'legacy';
-
-    // Quick check: look for the STGD05 marker in raw text
-    const paragraphs = ensureArray(body.p);
-    for (const para of paragraphs) {
-      const runs = ensureArray(para.r);
-      for (const run of runs) {
-        const text = extractTextContent(run.t || '');
-        if (text.includes('/api/v1/health/')) {
-          return 'v5';
-        }
-      }
-    }
-
-    // Check for WHITENER_METADATA (legacy)
-    for (const para of paragraphs) {
-      const runs = ensureArray(para.r);
-      for (const run of runs) {
-        const text = extractTextContent(run.t || '');
-        if (text.includes('WHITENER_METADATA:')) {
-          return 'legacy';
-        }
-      }
-    }
-
-    return 'legacy';
-  } catch {
-    return 'legacy';
-  }
-}
-
-// ─── Legacy DOCX (v3/v4) ───────────────────────────────────────────────────
-
-/**
- * Create a legacy DOCX file with base64 content (v3/v4 format)
- */
-async function createDocxWithBase64(options) {
-  const { base64Content, metadata, outputPath } = options;
-
-  const metadataStr = serializeMetadata(metadata);
-
-  const doc = new Document({
-    sections: [{
-      properties: {},
-      children: [
-        new Paragraph({
-          children: [
-            new TextRun({
-              text: `WHITENER_METADATA:${metadataStr}`,
-              size: 1,
-            }),
-          ],
-        }),
-        new Paragraph({
-          children: [
-            new TextRun({ text: '---', break: 1 }),
-          ],
-        }),
-        new Paragraph({
-          children: [
-            new TextRun({
-              text: base64Content,
-              font: 'Courier New',
-              size: 16,
-            }),
-          ],
-        }),
-      ],
-    }],
-  });
-
-  const buffer = await Packer.toBuffer(doc);
-
-  const outputDir = path.dirname(outputPath);
-  if (!fs.existsSync(outputDir)) {
-    fs.mkdirSync(outputDir, { recursive: true });
-  }
-
-  fs.writeFileSync(outputPath, buffer);
-  return outputPath;
-}
-
-// ─── Unified Reader ─────────────────────────────────────────────────────────
-
-/**
- * Read a DOCX file, auto-detecting v5 vs legacy format.
- */
-async function readDocxBase64(docxPath) {
-  if (!fs.existsSync(docxPath)) {
-    throw new Error(`DOCX file not found: ${docxPath}`);
-  }
-
-  const version = detectDocxVersion(docxPath);
-
-  if (version === 'v5') {
-    const result = await readDocxV5(docxPath);
-    return {
-      ...result,
-      formatVersion: 'v5',
-    };
-  }
-
-  // Legacy path
-  try {
-    const docParsed = parseXmlFromZip(docxPath, 'word/document.xml');
-    if (!docParsed) {
-      throw new Error('Could not find document.xml in DOCX file');
-    }
-
-    const fullText = extractAllText(docParsed);
-    const metadataMarker = 'WHITENER_METADATA:';
-    const metadataStart = fullText.indexOf(metadataMarker);
-
-    if (metadataStart === -1) {
-      throw new Error('No metadata found in DOCX file. This may not be a stegdoc-encoded file.');
-    }
-
-    const separatorIndex = fullText.indexOf('---', metadataStart);
-    if (separatorIndex === -1) {
-      throw new Error('Invalid file format: separator not found');
-    }
-
-    const metadataStr = fullText.substring(metadataStart + metadataMarker.length, separatorIndex).trim();
-    const metadata = parseMetadata(metadataStr);
-    const base64Content = fullText.substring(separatorIndex + 3).trim();
-
-    return {
-      base64Content,
-      metadata,
-      formatVersion: 'legacy',
-    };
-  } catch (error) {
-    throw new Error(`Failed to read DOCX file: ${error.message}`);
-  }
-}
-
-/**
- * Extract all text content from parsed DOCX document (legacy)
- */
-function extractAllText(docParsed) {
-  let fullText = '';
-  const body = docParsed?.document?.body;
-  if (!body) return fullText;
-
-  const paragraphs = ensureArray(body.p);
-  for (const para of paragraphs) {
-    const runs = ensureArray(para.r);
-    for (const run of runs) {
-      if (run.t !== undefined) {
-        fullText += extractTextContent(run.t);
-      }
-    }
-  }
-  return fullText;
-}
-
 module.exports = {
-  // v5
   createDocxV5,
-  readDocxV5,
-  detectDocxVersion,
-  // Legacy
-  createDocxWithBase64,
-  // Unified
-  readDocxBase64,
 };