Smartdevs17
diff --git a/‎backend/secrets/SecretsVault.ts‎
Lines changed: 77 additions & 12 deletions b/‎backend/secrets/SecretsVault.ts‎
Lines changed: 77 additions & 12 deletions
diff --git a/‎backend/services/__tests__/encryption.test.ts‎
Lines changed: 241 additions & 0 deletions b/‎backend/services/__tests__/encryption.test.ts‎
Lines changed: 241 additions & 0 deletions
@@ -1,4 +1,11 @@
 import AsyncStorage from '@react-native-async-storage/async-storage';
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac,
+  randomBytes,
+  timingSafeEqual,
+} from 'crypto';
 
 // ---------------------------------------------------------------------------
 // Types
@@ -12,16 +19,16 @@ export interface SecretMetadata {
   version: number;
   createdAt: number;
   rotatedAt: number | null;
-  /** Rotation interval in ms; null = no auto-rotation */
   rotationIntervalMs: number | null;
-  /** Whether this secret has been soft-deleted */
   deleted: boolean;
 }
 
 export interface SecretEntry {
   meta: SecretMetadata;
-  /** Obfuscated value stored in AsyncStorage (base64) */
-  value: string;
+  ciphertext: string;
+  iv: string;
+  authTag: string;
+  algorithm: 'aes-256-gcm';
 }
 
 export interface AuditEvent {
@@ -48,18 +55,69 @@ const VAULT_PREFIX = '@subtrackr:secrets:';
 const AUDIT_KEY = '@subtrackr:secrets:audit';
 const INDEX_KEY = '@subtrackr:secrets:index';
 const MAX_AUDIT_EVENTS = 1000;
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16;
+const TAG_LENGTH = 16;
+const VAULT_MASTER_KEY_KEY = '@subtrackr:secrets:vault_key';
+const HMAC_ALGORITHM = 'sha256';
 
 // ---------------------------------------------------------------------------
-// Minimal obfuscation (base64) — keeps values out of plain-text logs.
-// For production-grade encryption, replace with expo-crypto AES-GCM.
+// AES-256-GCM encryption for secrets at rest
 // ---------------------------------------------------------------------------
 
-function encode(value: string): string {
-  return Buffer.from(value, 'utf8').toString('base64');
+async function getOrCreateMasterKey(): Promise<Buffer> {
+  const existing = await AsyncStorage.getItem(VAULT_MASTER_KEY_KEY);
+  if (existing) return Buffer.from(existing, 'base64');
+  const key = randomBytes(32);
+  await AsyncStorage.setItem(VAULT_MASTER_KEY_KEY, key.toString('base64'));
+  return key;
 }
 
-function decode(encoded: string): string {
-  return Buffer.from(encoded, 'base64').toString('utf8');
+function deriveVaultKey(masterKey: Buffer): { encKey: Buffer; hmacKey: Buffer } {
+  const hmac1 = createHmac(HMAC_ALGORITHM, masterKey);
+  hmac1.update('vault-encryption');
+  const encKey = hmac1.digest();
+
+  const hmac2 = createHmac(HMAC_ALGORITHM, masterKey);
+  hmac2.update('vault-integrity');
+  const hmacKey = hmac2.digest();
+
+  return { encKey, hmacKey };
+}
+
+async function encrypt(value: string): Promise<{ ciphertext: string; iv: string; authTag: string }> {
+  const masterKey = await getOrCreateMasterKey();
+  const { encKey } = deriveVaultKey(masterKey);
+  const iv = randomBytes(IV_LENGTH);
+
+  const cipher = createCipheriv(ALGORITHM, encKey, iv, { authTagLength: TAG_LENGTH });
+  const encrypted = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+
+  return {
+    ciphertext: encrypted.toString('base64'),
+    iv: iv.toString('base64'),
+    authTag: authTag.toString('base64'),
+  };
+}
+
+async function decrypt(
+  ciphertext: string,
+  iv: string,
+  authTag: string
+): Promise<string> {
+  const masterKey = await getOrCreateMasterKey();
+  const { encKey } = deriveVaultKey(masterKey);
+
+  const ivBuf = Buffer.from(iv, 'base64');
+  const authTagBuf = Buffer.from(authTag, 'base64');
+  const ciphertextBuf = Buffer.from(ciphertext, 'base64');
+
+  const decipher = createDecipheriv(ALGORITHM, encKey, ivBuf, { authTagLength: TAG_LENGTH });
+  decipher.setAuthTag(authTagBuf);
+  const decrypted = Buffer.concat([decipher.update(ciphertextBuf), decipher.final()]);
+
+  return decrypted.toString('utf8');
 }
 
 function storageKey(key: string, env: Environment): string {
@@ -98,7 +156,14 @@ export class SecretsVault {
       deleted: false,
     };
 
-    const entry: SecretEntry = { meta, value: encode(value) };
+    const { ciphertext, iv, authTag } = await encrypt(value);
+    const entry: SecretEntry = {
+      meta,
+      ciphertext,
+      iv,
+      authTag,
+      algorithm: ALGORITHM,
+    };
     await AsyncStorage.setItem(storageKey(key, env), JSON.stringify(entry));
     await this._updateIndex(meta);
     await this._audit({ action: version > 1 ? 'rotate' : 'set', key, env, success: true });
@@ -119,7 +184,7 @@ export class SecretsVault {
       return null;
     }
     await this._audit({ action: 'get', key, env: resolvedEnv, success: true });
-    return decode(entry.value);
+    return decrypt(entry.ciphertext, entry.iv, entry.authTag);
   }
 
   // ── Rotation ──────────────────────────────────────────────────────────────
 
@@ -0,0 +1,241 @@
+import {
+  encryptField,
+  decryptField,
+  generateBlindIndexTokens,
+  searchBlindIndex,
+  maskField,
+  maskObject,
+  generateKey,
+  generateEncryptionKey,
+  isPiiField,
+  getPiiFields,
+  reEncryptField,
+} from '../encryption';
+
+describe('Encryption Service', () => {
+  const masterKey = generateKey();
+
+  describe('generateKey', () => {
+    it('generates a 32-byte key', () => {
+      const key = generateKey();
+      expect(key).toBeInstanceOf(Buffer);
+      expect(key.length).toBe(32);
+    });
+
+    it('generates unique keys each time', () => {
+      const key1 = generateKey();
+      const key2 = generateKey();
+      expect(key1.toString('hex')).not.toBe(key2.toString('hex'));
+    });
+  });
+
+  describe('generateEncryptionKey', () => {
+    it('creates a key with id, version, and expiry', () => {
+      const key = generateEncryptionKey(masterKey, 1);
+      expect(key.id).toBeTruthy();
+      expect(key.version).toBe(1);
+      expect(key.key.length).toBe(32);
+      expect(key.createdAt).toBeLessThanOrEqual(Date.now());
+      expect(key.expiresAt).toBeGreaterThan(Date.now());
+    });
+
+    it('generates deterministic keys from the same master key and version', () => {
+      const key1 = generateEncryptionKey(masterKey, 1);
+      const key2 = generateEncryptionKey(masterKey, 1);
+      expect(key1.key.toString('hex')).toBe(key2.key.toString('hex'));
+    });
+
+    it('generates different keys for different versions', () => {
+      const key1 = generateEncryptionKey(masterKey, 1);
+      const key2 = generateEncryptionKey(masterKey, 2);
+      expect(key1.key.toString('hex')).not.toBe(key2.key.toString('hex'));
+    });
+  });
+
+  describe('encryptField / decryptField', () => {
+    let key: ReturnType<typeof generateEncryptionKey>;
+
+    beforeEach(() => {
+      key = generateEncryptionKey(generateKey(), 1);
+    });
+
+    it('encrypts and decrypts a plaintext value', () => {
+      const plaintext = 'user@example.com';
+      const encrypted = encryptField(plaintext, key);
+      expect(encrypted.ciphertext).toBeTruthy();
+      expect(encrypted.iv).toBeTruthy();
+      expect(encrypted.authTag).toBeTruthy();
+      expect(encrypted.algorithm).toBe('aes-256-gcm');
+
+      const decrypted = decryptField(encrypted, key);
+      expect(decrypted.value).toBe(plaintext);
+    });
+
+    it('handles empty strings', () => {
+      const encrypted = encryptField('', key);
+      expect(encrypted.ciphertext).toBe('');
+      const decrypted = decryptField(encrypted, key);
+      expect(decrypted.value).toBe('');
+    });
+
+    it('produces different ciphertext for the same plaintext (random IV)', () => {
+      const encrypted1 = encryptField('test', key);
+      const encrypted2 = encryptField('test', key);
+      expect(encrypted1.ciphertext).not.toBe(encrypted2.ciphertext);
+    });
+
+    it('throws when decrypting with wrong key', () => {
+      const encrypted = encryptField('secret', key);
+      const wrongKey = generateEncryptionKey(generateKey(), 99);
+      expect(() => decryptField(encrypted, wrongKey)).toThrow();
+    });
+
+    it('includes keyId in encrypted field', () => {
+      const encrypted = encryptField('data', key);
+      expect(encrypted.keyId).toBe(key.id);
+    });
+  });
+
+  describe('reEncryptField', () => {
+    it('re-encrypts with a new key', () => {
+      const oldKey = generateEncryptionKey(generateKey(), 1);
+      const newKey = generateEncryptionKey(generateKey(), 2);
+      const encrypted = encryptField('sensitive data', oldKey);
+      const reEncrypted = reEncryptField(encrypted, newKey, oldKey);
+      expect(reEncrypted.keyId).toBe(newKey.id);
+      const decrypted = decryptField(reEncrypted, newKey);
+      expect(decrypted.value).toBe('sensitive data');
+    });
+  });
+
+  describe('blind indexing', () => {
+    const indexKey = generateKey();
+
+    it('generates blind index tokens for a value', () => {
+      const idx = generateBlindIndexTokens('email', 'user@example.com', indexKey);
+      expect(idx.field).toBe('email');
+      expect(idx.tokens.length).toBeGreaterThan(0);
+    });
+
+    it('returns empty tokens for empty value', () => {
+      const idx = generateBlindIndexTokens('email', '', indexKey);
+      expect(idx.tokens).toHaveLength(0);
+    });
+
+    it('searchBlindIndex finds matching value', () => {
+      const idx = generateBlindIndexTokens('name', 'John Doe', indexKey);
+      expect(searchBlindIndex('John Doe', idx, indexKey)).toBe(true);
+      expect(searchBlindIndex('john', idx, indexKey)).toBe(true);
+      expect(searchBlindIndex('doe', idx, indexKey)).toBe(true);
+    });
+
+    it('searchBlindIndex does not match unrelated value', () => {
+      const idx = generateBlindIndexTokens('name', 'John Doe', indexKey);
+      expect(searchBlindIndex('Jane', idx, indexKey)).toBe(false);
+      expect(searchBlindIndex('xyz', idx, indexKey)).toBe(false);
+    });
+
+    it('blind index is deterministic for same inputs', () => {
+      const idx1 = generateBlindIndexTokens('email', 'user@example.com', indexKey);
+      const idx2 = generateBlindIndexTokens('email', 'user@example.com', indexKey);
+      expect(idx1.tokens).toEqual(idx2.tokens);
+    });
+
+    it('different index keys produce different tokens', () => {
+      const key1 = generateKey();
+      const key2 = generateKey();
+      const idx1 = generateBlindIndexTokens('email', 'test@test.com', key1);
+      const idx2 = generateBlindIndexTokens('email', 'test@test.com', key2);
+      expect(idx1.tokens).not.toEqual(idx2.tokens);
+    });
+  });
+
+  describe('isPiiField', () => {
+    it('identifies known PII fields', () => {
+      expect(isPiiField('email')).toBe(true);
+      expect(isPiiField('name')).toBe(true);
+      expect(isPiiField('phoneNumber')).toBe(true);
+      expect(isPiiField('address')).toBe(true);
+    });
+
+    it('returns false for non-PII fields', () => {
+      expect(isPiiField('id')).toBe(false);
+      expect(isPiiField('price')).toBe(false);
+      expect(isPiiField('category')).toBe(false);
+    });
+  });
+
+  describe('getPiiFields', () => {
+    it('returns all known PII fields', () => {
+      const fields = getPiiFields();
+      expect(fields).toContain('email');
+      expect(fields).toContain('name');
+      expect(fields).toContain('phoneNumber');
+    });
+  });
+
+  describe('maskField', () => {
+    const originalEnv = process.env['APP_ENV'];
+
+    afterEach(() => {
+      process.env['APP_ENV'] = originalEnv;
+    });
+
+    it('masks email in non-production', () => {
+      process.env['APP_ENV'] = 'development';
+      const masked = maskField('john.doe@example.com', 'email');
+      expect(masked).not.toBe('john.doe@example.com');
+      expect(masked).toContain('@');
+    });
+
+    it('does not mask in production', () => {
+      process.env['APP_ENV'] = 'production';
+      const masked = maskField('john.doe@example.com', 'email');
+      expect(masked).toBe('john.doe@example.com');
+    });
+
+    it('masks phone number showing last 4 digits', () => {
+      process.env['APP_ENV'] = 'development';
+      const masked = maskField('555-123-4567', 'phoneNumber');
+      expect(masked).toContain('4567');
+      expect(masked).not.toContain('123');
+    });
+
+    it('masks short strings completely', () => {
+      process.env['APP_ENV'] = 'development';
+      const masked = maskField('ab', 'name');
+      expect(masked).toBe('**');
+    });
+
+    it('handles empty string', () => {
+      process.env['APP_ENV'] = 'development';
+      expect(maskField('', 'name')).toBe('');
+    });
+  });
+
+  describe('maskObject', () => {
+    const originalEnv = process.env['APP_ENV'];
+
+    afterEach(() => {
+      process.env['APP_ENV'] = originalEnv;
+    });
+
+    it('masks PII fields in an object', () => {
+      process.env['APP_ENV'] = 'development';
+      const obj = { email: 'test@test.com', name: 'John', price: 10, id: '123' };
+      const masked = maskObject(obj);
+      expect(masked.email).not.toBe('test@test.com');
+      expect(masked.name).not.toBe('John');
+      expect(masked.price).toBe(10);
+      expect(masked.id).toBe('123');
+    });
+
+    it('does not mask in production', () => {
+      process.env['APP_ENV'] = 'production';
+      const obj = { email: 'test@test.com', name: 'John' };
+      const masked = maskObject(obj);
+      expect(masked.email).toBe('test@test.com');
+      expect(masked.name).toBe('John');
+    });
+  });
+});