54 lines
1.8 KiB
TypeScript
54 lines
1.8 KiB
TypeScript
import { Inject, Injectable } from '@nestjs/common';
|
|
import { createCipheriv, createDecipheriv, createHmac, randomBytes } from 'node:crypto';
|
|
|
|
import { AppConfigService } from '../config/app-config.service';
|
|
|
|
@Injectable()
|
|
export class SensitiveDataService {
|
|
constructor(@Inject(AppConfigService) private readonly config: AppConfigService) {}
|
|
|
|
encrypt(value: string): string {
|
|
const iv = randomBytes(12);
|
|
const cipher = createCipheriv('aes-256-gcm', this.config.fieldEncryptionKey, iv);
|
|
const ciphertext = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]);
|
|
const tag = cipher.getAuthTag();
|
|
return [
|
|
'v1',
|
|
iv.toString('base64url'),
|
|
tag.toString('base64url'),
|
|
ciphertext.toString('base64url'),
|
|
].join('.');
|
|
}
|
|
|
|
decrypt(value: string): string {
|
|
const [version, ivValue, tagValue, ciphertextValue] = value.split('.');
|
|
if (version !== 'v1' || !ivValue || !tagValue || !ciphertextValue) {
|
|
throw new Error('Unsupported encrypted value format');
|
|
}
|
|
const decipher = createDecipheriv(
|
|
'aes-256-gcm',
|
|
this.config.fieldEncryptionKey,
|
|
Buffer.from(ivValue, 'base64url'),
|
|
);
|
|
decipher.setAuthTag(Buffer.from(tagValue, 'base64url'));
|
|
return Buffer.concat([
|
|
decipher.update(Buffer.from(ciphertextValue, 'base64url')),
|
|
decipher.final(),
|
|
]).toString('utf8');
|
|
}
|
|
|
|
lookupHash(domain: string, value: string): string {
|
|
return createHmac('sha256', this.config.fieldEncryptionKey)
|
|
.update(`${domain}\0${value}`)
|
|
.digest('hex');
|
|
}
|
|
|
|
sessionTokenHash(token: string): string {
|
|
return createHmac('sha256', this.config.sessionTokenPepper).update(token).digest('hex');
|
|
}
|
|
|
|
auditIpHash(ip: string): string {
|
|
return createHmac('sha256', this.config.auditIpHashKey).update(ip).digest('hex');
|
|
}
|
|
}
|