feeddeck/supabase/functions/_shared/utils/encrypt.ts

import { decode, encode } from "std/hex";
import {
  FEEDDECK_ENCRYPTION_IV,
  FEEDDECK_ENCRYPTION_KEY,
} from "./constants.ts";

/**
 * The `generateKey` function is used to generate the values for the `FEEDDECK_ENCRYPTION_KEY` and
 * `FEEDDECK_ENCRYPTION_IV` environment variables, which are used to encryt / decrypt the users account data, before it
 * is stored in the database.
 */
export const generateKey = async (): Promise<
  { rawKey: string; iv: string }
> => {
  const key = await crypto.subtle.generateKey(
    { name: "AES-CBC", length: 128 },
    true,
    ["encrypt", "decrypt"],
  );
  const rawKey = new Uint8Array(await crypto.subtle.exportKey("raw", key));
  return {
    rawKey: new TextDecoder().decode(encode(rawKey)),
    iv: new TextDecoder().decode(
      encode(crypto.getRandomValues(new Uint8Array(16))),
    ),
  };
};

/**
 * `encrypt` encrypts the provided `plainText` so it can be stored in the database. The values for the required
 * environment variables can be generated using the `generateKey` function.
 */
export const encrypt = async (plainText: string): Promise<string> => {
  const rawKey = decode(
    new TextEncoder().encode(FEEDDECK_ENCRYPTION_KEY),
  );
  const key = await crypto.subtle.importKey(
    "raw",
    rawKey.buffer,
    "AES-CBC",
    true,
    ["encrypt", "decrypt"],
  );
  const iv = decode(
    new TextEncoder().encode(FEEDDECK_ENCRYPTION_IV),
  );

  const encrypted = await crypto.subtle.encrypt(
    { name: "AES-CBC", iv },
    key,
    new TextEncoder().encode(plainText),
  );
  const encryptedBytes = new Uint8Array(encrypted);
  return new TextDecoder().decode(encode(encryptedBytes));
};

/**
 * `decrypt` decrypts the provided `encryptedText` so it can be used in the application. The values for the required
 * environment variables can be generated using the `generateKey` function.
 */
export const decrypt = async (encryptedText: string): Promise<string> => {
  const rawKey = decode(
    new TextEncoder().encode(FEEDDECK_ENCRYPTION_KEY),
  );
  const key = await crypto.subtle.importKey(
    "raw",
    rawKey.buffer,
    "AES-CBC",
    true,
    ["encrypt", "decrypt"],
  );
  const iv = decode(
    new TextEncoder().encode(FEEDDECK_ENCRYPTION_IV),
  );

  const decrypted = await crypto.subtle.decrypt(
    { name: "AES-CBC", iv },
    key,
    decode(new TextEncoder().encode(encryptedText)),
  );
  const decryptedBytes = new Uint8Array(decrypted);
  return new TextDecoder().decode(decryptedBytes);
};