dotencr/dist/crypto_key_manager.js

Encrypt and decrypt individual lines inside a .env file. Supports multiple encryption keys. Keys and dotenv files can be read text file or read from the environment.

"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
const lodash_1 = __importDefault(require("lodash"));
const jose_1 = require("jose");
const dotenv_parser_1 = require("./dotenv_parser");
const crypto_wrapper_1 = require("./crypto_wrapper");
const assert_1 = __importDefault(require("assert"));
/**
 * Class used to load and manage the encryption keys
 */
class CryptoKeyManager {
    constructor() {
        this.jwks = new jose_1.JWKS.KeyStore();
        this.parser = new dotenv_parser_1.DotenvParserCryptoKey();
    }
    /**
     * Do any of the encryption keys have errors
     */
    hasErrors() {
        return this.parser.variableInvalid.length > 0;
    }
    /**
     * Return all the encryption key errors
     */
    errors() {
        return lodash_1.default.flatten(this.parser.variableInvalid.map(x => x.errors));
    }
    /**
     * Given the encryption key name, generate the full name including the prefix and
     * separators.
     * @param keyName Name of the encryption key to find
     */
    buildDotenvNameFromKeyName(keyName) {
        return `${this.parser.cryptoKeyNamePrefix}${this.parser.separatorLeft}${keyName}`;
    }
    /**
     * Load the encryption keys from the process.env. This is the default.
     */
    loadFromEnv() {
        this.loadFromObject(process.env);
    }
    /**
     * Any object can be with key value pairs can be used
     * @param env and object with key value pairs
     */
    loadFromObject(env) {
        this.parser.parseObject(env);
        this.parser.variables.forEach(x => {
            const params = {
                alg: "aes-256-gcm",
                kid: x.leftCryptoKeyName(),
                key_ops: ["encrypt", "decrypt"],
                use: "enc",
            };
            const jwk = jose_1.JWK.asKey(Buffer.from(x.rightSide, "base64"), params);
            assert_1.default(jwk.keyObject.symmetricKeySize); // should never be undefined
            if (jwk.keyObject.symmetricKeySize <
                crypto_wrapper_1.CryptoWrapperAes256Gcm.SYM_ENC_KEY_LENGTH) {
                x.errors.push(`Encryption key [${x.leftSide}] is too short. Expected a length of 32 bytes (256bits) and received ${jwk
                    .keyObject.symmetricKeySize} bytes.`);
                // Add this variable to the list of invalid variables
                this.parser.variableInvalid.push(x);
            }
            else {
                this.jwks.add(jwk);
            }
        });
        // Remove any variables we just determined to be invalid
        // We do this now, because it is complicated to iterate over an array and add/remove at the same time
        lodash_1.default.pullAll(this.parser.variables, this.parser.variableInvalid);
    }
    /**
     * Get a specific key
     * @param keyName Name of the encryption key to find
     */
    get(keyName) {
        const query = {
            kid: keyName,
        };
        return this.jwks.get(query);
    }
    /**
     * Return all of the encryption keys
     */
    all() {
        return this.jwks.all();
    }
    /**
     * Return all of the encryption key names as an array of strings
     */
    allKeys() {
        return this.jwks.all().map(x => x.kid);
    }
}
exports.CryptoKeyManager = CryptoKeyManager;
//# sourceMappingURL=crypto_key_manager.js.map