homeio

1import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
2
3type EncryptedSecret = {
4  ciphertext: string;
5  iv: string;
6  tag: string;
7};
8
9const KEY_BYTES = 32;
10const IV_BYTES = 12;
11
12function decodeBase64Key(keyBase64: string) {
13  try {
14    return Buffer.from(keyBase64, "base64");
15  } catch {
16    return null;
17  }
18}
19
20function resolveSecretKey() {
21  const fromEnv = process.env.FILES_CREDENTIALS_KEY;
22  if (typeof fromEnv === "string" && fromEnv.trim().length > 0) {
23    const decoded = decodeBase64Key(fromEnv.trim());
24    if (decoded && decoded.length === KEY_BYTES) {
25      return decoded;
26    }
27
28    throw new Error("FILES_CREDENTIALS_KEY must be a base64-encoded 32-byte key");
29  }
30
31  const authSecret = process.env.AUTH_SESSION_SECRET || "dev-session-secret-change-me";
32  return createHash("sha256")
33    .update(`files-credentials:${authSecret}`)
34    .digest();
35}
36
37export function encryptSecret(plaintext: string): EncryptedSecret {
38  const key = resolveSecretKey();
39  const iv = randomBytes(IV_BYTES);
40  const cipher = createCipheriv("aes-256-gcm", key, iv);
41
42  const ciphertext = Buffer.concat([
43    cipher.update(Buffer.from(plaintext, "utf8")),
44    cipher.final(),
45  ]);
46  const tag = cipher.getAuthTag();
47
48  return {
49    ciphertext: ciphertext.toString("base64"),
50    iv: iv.toString("base64"),
51    tag: tag.toString("base64"),
52  };
53}
54
55export function decryptSecret(input: EncryptedSecret) {
56  const key = resolveSecretKey();
57  const iv = Buffer.from(input.iv, "base64");
58  const tag = Buffer.from(input.tag, "base64");
59  const ciphertext = Buffer.from(input.ciphertext, "base64");
60
61  const decipher = createDecipheriv("aes-256-gcm", key, iv);
62  decipher.setAuthTag(tag);
63
64  const plaintext = Buffer.concat([
65    decipher.update(ciphertext),
66    decipher.final(),
67  ]);
68
69  return plaintext.toString("utf8");
70}
71