luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

style(13-03): apply Prettier formatting across repo

Browse Source 
Mechanical reformat — no logic changes. 398 files changed, 19125
insertions(+), 16457 deletions(-). Prettier 3.8.4 with .prettierrc
(singleQuote:true, semi:true, tabWidth:2, trailingComma:all,
printWidth:100). Isolated per D-13-08 for reviewability.
This commit is contained in:
Lucas Berger
2026-06-11 20:35:18 -04:00
parent 4bc0445173
commit 982438dc10
398 changed files with 19050 additions and 16382 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/broker/crypto.ts
+20 -20
View File
@@ -11,27 +11,27 @@
* Source: Node.js docs node:crypto — AES-GCM
*/
import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto'
import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
// Validated at module load: key must be present and 32 bytes (64 hex chars).
// We deliberately do NOT throw here on missing key — that would crash the module
// during tests that set the env before the first import. The KEY is only read
// when encryptPassword / decryptPassword are actually called.
function getKey(): Buffer {
const hex = process.env.APP_PASSWORD_ENCRYPTION_KEY
const hex = process.env.APP_PASSWORD_ENCRYPTION_KEY;
if (!hex || hex.length !== 64) {
throw new Error(
'APP_PASSWORD_ENCRYPTION_KEY must be a 64-character hex string (32 bytes). ' +
'Generate with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'hex\'))"',
)
"Generate with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\"",
);
}
return Buffer.from(hex, 'hex')
return Buffer.from(hex, 'hex');
}
interface EncryptedPayload {
iv: string
authTag: string
ciphertext: string
iv: string;
authTag: string;
ciphertext: string;
}
/**
@@ -40,17 +40,17 @@ interface EncryptedPayload {
* Each call generates a fresh random 96-bit IV.
*/
export function encryptPassword(plaintext: string): string {
const key = getKey()
const iv = randomBytes(12) // 96-bit IV for GCM
const cipher = createCipheriv('aes-256-gcm', key, iv)
const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
const authTag = cipher.getAuthTag()
const key = getKey();
const iv = randomBytes(12); // 96-bit IV for GCM
const cipher = createCipheriv('aes-256-gcm', key, iv);
const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
const authTag = cipher.getAuthTag();
const payload: EncryptedPayload = {
iv: iv.toString('hex'),
authTag: authTag.toString('hex'),
ciphertext: encrypted.toString('hex'),
}
return JSON.stringify(payload)
};
return JSON.stringify(payload);
}
/**
@@ -58,12 +58,12 @@ export function encryptPassword(plaintext: string): string {
* Throws if the auth tag does not match (integrity violation).
*/
export function decryptPassword(stored: string): string {
const key = getKey()
const { iv, authTag, ciphertext } = JSON.parse(stored) as EncryptedPayload
const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(iv, 'hex'))
decipher.setAuthTag(Buffer.from(authTag, 'hex'))
const key = getKey();
const { iv, authTag, ciphertext } = JSON.parse(stored) as EncryptedPayload;
const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(iv, 'hex'));
decipher.setAuthTag(Buffer.from(authTag, 'hex'));
return Buffer.concat([
decipher.update(Buffer.from(ciphertext, 'hex')),
decipher.final(),
]).toString('utf8')
]).toString('utf8');
}