ts-packages 1.0.0 → 2.0.0

package/packages/security/src/core/crypto/cryptoManager.ts

@@ -0,0 +1,292 @@
+import {
+	decrypt as functionalDecrypt,
+	encrypt as functionalEncrypt,
+	hmacSign as functionalHmacSign,
+	hmacVerify as functionalHmacVerify,
+	randomToken as functionalRandomToken,
+} from './index'
+
+/**
+ * Configuration options for CryptoManager
+ */
+export interface CryptoManagerConfig {
+	defaultAlgorithm?: string
+	defaultEncoding?: BufferEncoding
+	hmacAlgorithm?: string
+}
+
+/**
+ * Default configuration
+ */
+const DEFAULT_CONFIG: Required<CryptoManagerConfig> = {
+	defaultAlgorithm: 'aes-256-gcm',
+	defaultEncoding: 'utf8',
+	hmacAlgorithm: 'sha256',
+}
+
+/**
+ * CryptoManager - Class-based wrapper for all cryptographic operations
+ * Provides a consistent interface for encryption, decryption, HMAC generation, and secure random generation
+ */
+export class CryptoManager {
+	private config: Required<CryptoManagerConfig>
+
+	constructor(config: CryptoManagerConfig = {}) {
+		this.config = { ...DEFAULT_CONFIG, ...config }
+	}
+
+	/**
+	 * Update configuration
+	 */
+	public updateConfig(config: Partial<CryptoManagerConfig>): void {
+		this.config = { ...this.config, ...config }
+	}
+
+	/**
+	 * Get current configuration
+	 */
+	public getConfig(): Required<CryptoManagerConfig> {
+		return { ...this.config }
+	}
+
+	/**
+	 * Encrypt data using the default or specified algorithm
+	 */
+	public encrypt(
+		plaintext: string,
+		key: string,
+		_options?: {
+			algorithm?: string
+			encoding?: BufferEncoding
+			iv?: string
+		},
+	): string {
+		// For now, use the basic encrypt function
+		// TODO: Enhance to support different algorithms and options
+		return functionalEncrypt(plaintext, key)
+	}
+
+	/**
+	 * Decrypt data using the default or specified algorithm
+	 */
+	public decrypt(
+		encryptedData: string,
+		key: string,
+		_options?: {
+			algorithm?: string
+			encoding?: BufferEncoding
+			iv?: string
+		},
+	): string {
+		// For now, use the basic decrypt function
+		// TODO: Enhance to support different algorithms and options
+		return functionalDecrypt(encryptedData, key)
+	}
+
+	/**
+	 * Generate HMAC signature
+	 */
+	public generateHmac(
+		data: string,
+		secret: string,
+		_options?: {
+			algorithm?: string
+			encoding?: BufferEncoding
+		},
+	): string {
+		// Use the basic HMAC sign function for now
+		// TODO: Add support for different algorithms
+		return functionalHmacSign(data, secret)
+	}
+
+	/**
+	 * Generate cryptographically secure random bytes
+	 */
+	public generateSecureRandom(
+		length: number,
+		_encoding: BufferEncoding = 'hex',
+	): string {
+		// Use the basic random token function
+		return functionalRandomToken(length)
+	}
+
+	/**
+	 * Verify HMAC signature
+	 */
+	public verifyHmac(
+		data: string,
+		secret: string,
+		signature: string,
+		_options?: {
+			algorithm?: string
+			encoding?: BufferEncoding
+		},
+	): boolean {
+		// Use the basic HMAC verify function
+		return functionalHmacVerify(data, secret, signature)
+	}
+
+	/**
+	 * Create a key derivation function using PBKDF2
+	 */
+	public deriveKey(
+		password: string,
+		salt: string,
+		iterations = 100000,
+		keyLength = 32,
+	): Promise<string> {
+		return new Promise((resolve, reject) => {
+			const crypto = require('crypto')
+
+			crypto.pbkdf2(
+				password,
+				salt,
+				iterations,
+				keyLength,
+				'sha256',
+				(err: Error, derivedKey: Buffer) => {
+					if (err) {
+						reject(err)
+					} else {
+						resolve(derivedKey.toString('hex'))
+					}
+				},
+			)
+		})
+	}
+
+	/**
+	 * Hash data using SHA-256
+	 */
+	public sha256(data: string, encoding: BufferEncoding = 'hex'): string {
+		const crypto = require('crypto')
+		return crypto.createHash('sha256').update(data).digest(encoding)
+	}
+
+	/**
+	 * Hash data using SHA-512
+	 */
+	public sha512(data: string, encoding: BufferEncoding = 'hex'): string {
+		const crypto = require('crypto')
+		return crypto.createHash('sha512').update(data).digest(encoding)
+	}
+
+	/**
+	 * Generate a secure key pair for asymmetric encryption
+	 */
+	public generateKeyPair(options?: {
+		modulusLength?: number
+		publicKeyEncoding?: { type: string; format: string }
+		privateKeyEncoding?: { type: string; format: string }
+	}): Promise<{ publicKey: string; privateKey: string }> {
+		return new Promise((resolve, _reject) => {
+			const crypto = require('crypto')
+
+			const keyPair = crypto.generateKeyPairSync('rsa', {
+				modulusLength: options?.modulusLength || 2048,
+				publicKeyEncoding: options?.publicKeyEncoding || {
+					type: 'spki',
+					format: 'pem',
+				},
+				privateKeyEncoding: options?.privateKeyEncoding || {
+					type: 'pkcs8',
+					format: 'pem',
+				},
+			})
+
+			resolve(keyPair)
+		})
+	}
+
+	/**
+	 * Encrypt data using RSA public key
+	 */
+	public rsaEncrypt(data: string, publicKey: string): Promise<string> {
+		return new Promise((resolve, _reject) => {
+			const crypto = require('crypto')
+
+			const buffer = Buffer.from(data, 'utf8')
+			const encrypted = crypto.publicEncrypt(publicKey, buffer)
+			resolve(encrypted.toString('base64'))
+		})
+	}
+
+	/**
+	 * Decrypt data using RSA private key
+	 */
+	public rsaDecrypt(
+		encryptedData: string,
+		privateKey: string,
+	): Promise<string> {
+		return new Promise((resolve, _reject) => {
+			const crypto = require('crypto')
+
+			const buffer = Buffer.from(encryptedData, 'base64')
+			const decrypted = crypto.privateDecrypt(privateKey, buffer)
+			resolve(decrypted.toString('utf8'))
+		})
+	}
+
+	/**
+	 * Create digital signature using RSA private key
+	 */
+	public rsaSign(
+		data: string,
+		privateKey: string,
+		algorithm = 'sha256',
+	): Promise<string> {
+		return new Promise((resolve, reject) => {
+			const crypto = require('crypto')
+
+			const sign = crypto.createSign(algorithm)
+			sign.update(data)
+			sign.end()
+
+			try {
+				const signature = sign.sign(privateKey, 'base64')
+				resolve(signature)
+			} catch (error) {
+				reject(error)
+			}
+		})
+	}
+
+	/**
+	 * Verify digital signature using RSA public key
+	 */
+	public rsaVerify(
+		data: string,
+		signature: string,
+		publicKey: string,
+		algorithm = 'sha256',
+	): Promise<boolean> {
+		return new Promise((resolve, reject) => {
+			const crypto = require('crypto')
+
+			const verify = crypto.createVerify(algorithm)
+			verify.update(data)
+			verify.end()
+
+			try {
+				const isValid = verify.verify(publicKey, signature, 'base64')
+				resolve(isValid)
+			} catch (error) {
+				reject(error)
+			}
+		})
+	}
+}
+
+/**
+ * Create a CryptoManager instance with default configuration
+ */
+export const createCryptoManager = (
+	config?: CryptoManagerConfig,
+): CryptoManager => {
+	return new CryptoManager(config)
+}
+
+/**
+ * Default CryptoManager instance
+ */
+export const cryptoManager = new CryptoManager()

package/packages/security/src/core/crypto/decrypt.ts

@@ -0,0 +1,20 @@
+import crypto from 'crypto'
+
+const ALGO = 'AES-256-GCM'
+
+export const decrypt = (data: string, secret: string): string => {
+	const [ivHex, encryptedHex] = data.split(':')
+
+	const iv = Buffer.from(ivHex, 'hex')
+	const encrypted = Buffer.from(encryptedHex, 'hex')
+
+	const key = crypto.createHash('sha256').update(secret).digest()
+	const decipher = crypto.createDecipheriv(ALGO, key, iv)
+
+	const decrypted = Buffer.concat([
+		decipher.update(encrypted),
+		decipher.final(),
+	])
+
+	return decrypted.toString('utf8')
+}

package/packages/security/src/core/crypto/encrypt.ts

@@ -0,0 +1,14 @@
+import crypto from 'crypto'
+
+const ALGO = 'AES-256-GCM'
+
+export const encrypt = (text: string, secret: string): string => {
+	const key = crypto.createHash('sha256').update(secret).digest()
+	const iv = crypto.randomBytes(16)
+
+	const cipher = crypto.createCipheriv(ALGO, key, iv)
+
+	const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()])
+
+	return `${iv.toString('hex')}:${encrypted.toString('hex')}`
+}

package/packages/security/src/core/crypto/hmac.ts

@@ -0,0 +1,23 @@
+import crypto from 'crypto'
+
+/**
+ * Sign message using HMAC SHA-256
+ */
+export const hmacSign = (message: string, secret: string): string => {
+	return crypto.createHmac('sha256', secret).update(message).digest('hex')
+}
+
+/**
+ * Verify HMAC signature
+ */
+export const hmacVerify = (
+	message: string,
+	secret: string,
+	signature: string,
+): boolean => {
+	const expected = hmacSign(message, secret)
+
+	if (signature.length !== expected.length) return false
+
+	return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))
+}

package/packages/security/src/core/crypto/index.ts

@@ -0,0 +1,5 @@
+export { decrypt } from './decrypt'
+export { encrypt } from './encrypt'
+export { hmacSign, hmacVerify } from './hmac'
+export { randomToken, generateStrongPassword } from './random'
+export * from './cryptoManager'

package/packages/security/src/core/crypto/random.ts

@@ -0,0 +1,15 @@
+import crypto from 'crypto'
+
+/**
+ * Generate cryptographically secure random string
+ */
+export const randomToken = (length = 32): string => {
+	return crypto.randomBytes(length).toString('hex')
+}
+
+/**
+ * Generate a strong random password
+ */
+export const generateStrongPassword = (length = 16): string => {
+	return crypto.randomBytes(length).toString('hex').slice(0, length)
+}

package/packages/security/src/core/jwt/decode.ts

@@ -0,0 +1,25 @@
+// src/jwt/decodeToken.ts
+import { type JwtPayload, decode } from 'jsonwebtoken'
+
+/**
+ * Flexible decode
+ * Returns: null | string | JwtPayload
+ * Mirrors jsonwebtoken.decode()
+ */
+export function decodeToken(token: string): null | string | JwtPayload {
+	return decode(token)
+}
+
+/**
+ * Strict decode
+ * Always returns JwtPayload or throws error
+ */
+export function decodeTokenStrict(token: string): JwtPayload {
+	const decoded = decode(token)
+
+	if (!decoded || typeof decoded === 'string') {
+		throw new Error('Invalid JWT payload structure')
+	}
+
+	return decoded
+}

package/packages/security/src/core/jwt/extractToken.ts

@@ -0,0 +1,59 @@
+export interface TokenSources {
+	header?: string | undefined | null
+	cookies?: Record<string, string> | undefined
+	query?: Record<string, string | undefined> | undefined
+	body?: Record<string, unknown> | undefined
+	wsMessage?: string | Record<string, unknown> | undefined // NEW
+}
+
+/**
+ * Universal token extractor
+ */
+export function extractToken(sources: TokenSources): string | null {
+	const { header, cookies, query, body, wsMessage } = sources
+
+	// 1. Authorization: Bearer <token>
+	if (header) {
+		const parts = header.split(' ')
+		if (parts.length === 2 && parts[0] === 'Bearer') return parts[1]
+	}
+
+	// 2. Cookies: token / accessToken
+	if (cookies) {
+		if (cookies['token']) return cookies['token']
+		if (cookies['accessToken']) return cookies['accessToken']
+	}
+
+	// 3. Query params: ?token=xxx
+	if (query?.token) return query.token
+
+	// 4. Body: { token: "" }
+	if (body?.token && typeof body.token === 'string') return body.token
+
+	// 5. WebSocket message extraction (NEW)
+	if (wsMessage) {
+		try {
+			let msg: unknown = wsMessage
+
+			// If it's a JSON string → parse safely
+			if (typeof wsMessage === 'string') {
+				msg = JSON.parse(wsMessage) as unknown
+			}
+
+			// Ensure msg is an object before property access
+			if (typeof msg === 'object' && msg !== null) {
+				const m = msg as Record<string, unknown>
+				if (typeof m['token'] === 'string') return m['token'] as string
+				const auth = m['auth']
+				if (typeof auth === 'object' && auth !== null) {
+					const a = auth as Record<string, unknown>
+					if (typeof a['token'] === 'string') return a['token'] as string
+				}
+			}
+		} catch {
+			// Ignore parse errors gracefully
+		}
+	}
+
+	return null
+}

package/packages/security/src/core/jwt/generateTokens.ts

@@ -0,0 +1,48 @@
+import type { JwtPayload, Secret } from 'jsonwebtoken'
+import { signToken } from './signToken'
+import type { AccessToken, RefreshToken, TokenPair } from './types'
+import { verifyToken } from './verify'
+
+// Helper function to create branded tokens
+/* const createBrandedToken = <T extends string>(token: string, _brand: T): T => {
+	return token as T
+} */
+
+export const generateTokens = (
+	payload: Record<string, unknown>,
+	accessSecret: Secret,
+	refreshSecret: Secret,
+	accessExpiry: string | number = '15m',
+	refreshExpiry: string | number = '7d',
+): TokenPair => {
+	const accessToken = signToken(payload, accessSecret, accessExpiry, {
+		algorithm: 'HS256',
+	})
+	const refreshToken = signToken(payload, refreshSecret, refreshExpiry, {
+		algorithm: 'HS256',
+	})
+
+	return {
+		accessToken: accessToken as AccessToken,
+		refreshToken: refreshToken as RefreshToken,
+	}
+}
+
+export function rotateRefreshToken(
+	oldToken: string,
+	secret: Secret,
+): RefreshToken {
+	const decoded = verifyToken(oldToken, secret)
+
+	if (typeof decoded === 'string') {
+		throw new Error('Invalid token payload — expected JWT payload object')
+	}
+
+	const payload: JwtPayload = { ...decoded }
+
+	delete payload.iat
+	delete payload.exp
+
+	const newToken = signToken(payload, secret, '7d')
+	return newToken as RefreshToken
+}

package/packages/security/src/core/jwt/index.ts

@@ -0,0 +1,8 @@
+export * from './decode'
+export * from './extractToken'
+export * from './generateTokens'
+export * from './parseDuration'
+export * from './signToken'
+export * from './types'
+export * from './validateToken'
+export * from './verify'