32 lines
1.4 KiB
TypeScript
32 lines
1.4 KiB
TypeScript
|
import { createCipheriv, createDecipheriv, randomBytes } from 'crypto'
|
||
|
|
|
||
|
|
const ENCRYPTION_KEY_HEX = process.env.BOTFIGHTS_WALLET_ENCRYPTION_KEY
|
||
|
|
let encryptionKey: Buffer
|
||
|
|
|
||
|
|
if (ENCRYPTION_KEY_HEX) {
|
||
|
|
encryptionKey = Buffer.from(ENCRYPTION_KEY_HEX, 'hex')
|
||
|
|
} else if (process.env.NODE_ENV === 'production') {
|
||
|
|
throw new Error('CRITICAL: BOTFIGHTS_WALLET_ENCRYPTION_KEY not set. Cannot start in production.')
|
||
|
|
} else {
|
||
|
|
encryptionKey = randomBytes(32)
|
||
|
|
console.warn('[crypto] WARNING: No BOTFIGHTS_WALLET_ENCRYPTION_KEY set. Generated random key — wallet data will be lost on restart.')
|
||
|
|
}
|
||
|
|
|
||
|
|
export function encrypt(plaintext: string): string {
|
||
|
|
const iv = randomBytes(16)
|
||
|
|
const cipher = createCipheriv('aes-256-gcm', encryptionKey, iv)
|
||
|
|
const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
|
||
|
|
const authTag = cipher.getAuthTag()
|
||
|
|
return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted.toString('hex')
|
||
|
|
}
|
||
|
|
|
||
|
|
export function decrypt(ciphertext: string): string {
|
||
|
|
const [ivHex, authTagHex, encryptedHex] = ciphertext.split(':')
|
||
|
|
const iv = Buffer.from(ivHex, 'hex')
|
||
|
|
const authTag = Buffer.from(authTagHex, 'hex')
|
||
|
|
const encrypted = Buffer.from(encryptedHex, 'hex')
|
||
|
|
const decipher = createDecipheriv('aes-256-gcm', encryptionKey, iv)
|
||
|
|
decipher.setAuthTag(authTag)
|
||
|
|
return decipher.update(encrypted) + decipher.final('utf8')
|
||
|
|
}
|