DorianandClaude Opus 4.6
673961580c
Move crypto key init from module-level throw to lazy getKey() — only errors when encrypt/decrypt are actually called. Downgrade env var check in index.ts from fatal exit to warning. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
39 lines
1.5 KiB
TypeScript
39 lines
1.5 KiB
TypeScript
import { createCipheriv, createDecipheriv, randomBytes } from 'crypto'
|
|
|
|
let encryptionKey: Buffer | null = null
|
|
|
|
function getKey(): Buffer {
|
|
if (encryptionKey) return encryptionKey
|
|
|
|
const hex = process.env.BOTFIGHTS_WALLET_ENCRYPTION_KEY
|
|
if (hex) {
|
|
encryptionKey = Buffer.from(hex, 'hex')
|
|
} else if (process.env.NODE_ENV === 'production') {
|
|
throw new Error('BOTFIGHTS_WALLET_ENCRYPTION_KEY not set. Wallet operations unavailable.')
|
|
} else {
|
|
encryptionKey = randomBytes(32)
|
|
console.warn('[crypto] WARNING: No BOTFIGHTS_WALLET_ENCRYPTION_KEY set. Generated random key — wallet data will be lost on restart.')
|
|
}
|
|
return encryptionKey
|
|
}
|
|
|
|
export function encrypt(plaintext: string): string {
|
|
const key = getKey()
|
|
const iv = randomBytes(16)
|
|
const cipher = createCipheriv('aes-256-gcm', key, iv)
|
|
const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])
|
|
const authTag = cipher.getAuthTag()
|
|
return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted.toString('hex')
|
|
}
|
|
|
|
export function decrypt(ciphertext: string): string {
|
|
const key = getKey()
|
|
const [ivHex, authTagHex, encryptedHex] = ciphertext.split(':')
|
|
const iv = Buffer.from(ivHex, 'hex')
|
|
const authTag = Buffer.from(authTagHex, 'hex')
|
|
const encrypted = Buffer.from(encryptedHex, 'hex')
|
|
const decipher = createDecipheriv('aes-256-gcm', key, iv)
|
|
decipher.setAuthTag(authTag)
|
|
return decipher.update(encrypted) + decipher.final('utf8')
|
|
}
|