Update

backend/src/secrets.ts

@@ -0,0 +1,72 @@
+import crypto from "node:crypto";
+
+const encryptedSecretPrefix = "ttenc:v1:";
+
+let warnedAboutFallbackKey = false;
+let cachedKey: Buffer | null = null;
+
+function getEncryptionMaterial() {
+  const configuredKey = process.env.SECRET_ENCRYPTION_KEY ?? process.env.TICKETTRACKER_SECRET_KEY;
+
+  if (configuredKey) {
+    return configuredKey;
+  }
+
+  if (!process.env.DATABASE_URL) {
+    throw new Error("SECRET_ENCRYPTION_KEY is required to encrypt database secrets");
+  }
+
+  if (!warnedAboutFallbackKey) {
+    console.warn("SECRET_ENCRYPTION_KEY is not set; deriving database secret encryption from DATABASE_URL.");
+    warnedAboutFallbackKey = true;
+  }
+
+  return process.env.DATABASE_URL;
+}
+
+function getEncryptionKey() {
+  if (!cachedKey) {
+    cachedKey = crypto.createHash("sha256").update(getEncryptionMaterial()).digest();
+  }
+
+  return cachedKey;
+}
+
+export function isEncryptedSecret(value: string | null | undefined) {
+  return typeof value === "string" && value.startsWith(encryptedSecretPrefix);
+}
+
+export function encryptSecret(value: string) {
+  if (isEncryptedSecret(value)) {
+    return value;
+  }
+
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", getEncryptionKey(), iv);
+  const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+
+  return `${encryptedSecretPrefix}${iv.toString("base64url")}.${tag.toString("base64url")}.${encrypted.toString("base64url")}`;
+}
+
+export function decryptSecret(value: string | null | undefined) {
+  if (!value) {
+    return null;
+  }
+
+  if (!isEncryptedSecret(value)) {
+    return value;
+  }
+
+  const parts = value.slice(encryptedSecretPrefix.length).split(".");
+
+  if (parts.length !== 3) {
+    throw new Error("Encrypted database secret has an invalid format");
+  }
+
+  const [ivText, tagText, encryptedText] = parts;
+  const decipher = crypto.createDecipheriv("aes-256-gcm", getEncryptionKey(), Buffer.from(ivText, "base64url"));
+  decipher.setAuthTag(Buffer.from(tagText, "base64url"));
+
+  return Buffer.concat([decipher.update(Buffer.from(encryptedText, "base64url")), decipher.final()]).toString("utf8");
+}