FM / security

/home/techb158/cosmic.abdallabala.com/src/security/

/home/techb158/cosmic.abdallabala.com/src/security

Name	Size	Mode	Actions
accessControl.js	12143	0666	edit dl rm
securityHeaders.js	2341	0666	edit dl rm
tokenVault.js	1967	0666	edit dl rm

Edit: /home/techb158/cosmic.abdallabala.com/src/security/tokenVault.js (1967B)

const crypto = require("crypto");

const ALGORITHM = "aes-256-gcm";

function hasEncryptionSecret(env = process.env) {
  return Boolean(env.COSMIC_TOKEN_ENCRYPTION_KEY && env.COSMIC_TOKEN_ENCRYPTION_KEY.trim());
}

function deriveKey(secret) {
  return crypto.createHash("sha256").update(String(secret)).digest();
}

function encryptToken(token, env = process.env) {
  if (!token) return null;
  if (!hasEncryptionSecret(env)) {
    throw new Error("COSMIC_TOKEN_ENCRYPTION_KEY is required before OAuth tokens can be stored");
  }
  const iv = crypto.randomBytes(12);
  const key = deriveKey(env.COSMIC_TOKEN_ENCRYPTION_KEY);
  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
  const encrypted = Buffer.concat([cipher.update(String(token), "utf8"), cipher.final()]);
  const tag = cipher.getAuthTag();
  return ["v1", iv.toString("base64"), tag.toString("base64"), encrypted.toString("base64")].join(":");
}

module.exports = {
  encryptToken,
  decryptToken,
  redactToken,
  hasEncryptionSecret
};

cmd: