crypto.ts

import { encodeBase64 } from "@sigma/rust-base64";
import { decodeBase64 } from "@std/encoding/base64";
import { z } from "zod";

const key = await crypto.subtle.importKey(
	"jwk",
	JSON.parse(Deno.readTextFileSync("./secret/key.json")),
	{ name: "AES-GCM", length: 256 },
	true,
	["encrypt", "decrypt"],
);
const prefix = "THINGS-AES-GCM-1984";
if (prefix.includes(":")) {
	console.error("Prefix shouldn't contain the separating character (:)");
	Deno.exit(1);
}
export async function thingsEncryptText(text: string): Promise<string> {
	if (text.startsWith(`${prefix}:`)) {
		// already encrypted
		return text;
	}
	const iv = crypto.getRandomValues(new Uint8Array(12)); // 12-byte IV for AES-GCM

	const encryptedData = await crypto.subtle.encrypt(
		{
			name: "AES-GCM",
			iv: iv, // Initialization vector must be unique for each encryption
		},
		key,
		new TextEncoder().encode(text),
	);

	return `${prefix}:${encodeBase64(iv)}:${encodeBase64(
		new Uint8Array(encryptedData),
	)}`;
}

export async function thingsDecryptText(text: string): Promise<string> {
	if (!text.startsWith(`${prefix}:`)) {
		// nothing to decrypt
		return text;
	}

	// perf: we could remove the Zod check
	const [textPrefix, ivString, dataEncryptedBase64] = z
		.array(z.string())
		.min(3)
		.max(3)
		.parse(text.split(":"));
	if (prefix !== textPrefix) {
		// perf: we could remove this check
		throw new Error(`Invalid prefix found: ${textPrefix}`);
	}

	const decryptedData = await crypto.subtle.decrypt(
		{
			name: "AES-GCM",
			// Must be the same IV as the one used for encryption
			iv: decodeBase64(ivString),
		},
		key, // The same key used for encryption
		decodeBase64(dataEncryptedBase64), // The encrypted data to decrypt
	);

	return new TextDecoder().decode(decryptedData);
}