Initial Commit

src/utils/security.ts

@@ -0,0 +1,100 @@
+import keytar from 'keytar';
+import crypto from 'crypto';
+import { logger } from './logger';
+
+const SERVICE_NAME = 'AntigravityManager';
+const ACCOUNT_NAME = 'MasterKey';
+
+// Cache the key in memory to avoid frequent system calls
+let cachedMasterKey: Buffer | null = null;
+
+async function getOrGenerateMasterKey(): Promise<Buffer> {
+  if (cachedMasterKey) return cachedMasterKey;
+
+  try {
+    let hexKey = await keytar.getPassword(SERVICE_NAME, ACCOUNT_NAME);
+
+    if (!hexKey) {
+      logger.info('Security: Generating new master key...');
+      // Generate 256-bit key (32 bytes)
+      const buffer = crypto.randomBytes(32);
+      hexKey = buffer.toString('hex');
+      await keytar.setPassword(SERVICE_NAME, ACCOUNT_NAME, hexKey);
+    }
+
+    cachedMasterKey = Buffer.from(hexKey, 'hex');
+    return cachedMasterKey;
+  } catch (error) {
+    logger.error('Security: Failed to access keychain/credential manager', error);
+    // Fallback? If we can't store the key, we can't persistently encrypt.
+    // For now, throw to prevent data loss (better not to write than to write something we can't decrypt later or write plain text when promised encrypted)
+    throw new Error('Key management system unavailable');
+  }
+}
+
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 16;
+const AUTH_TAG_LENGTH = 16;
+
+/**
+ * Encrypts a string using AES-256-GCM.
+ * Output format: "iv_hex:auth_tag_hex:ciphertext_hex"
+ */
+export async function encrypt(text: string): Promise<string> {
+  try {
+    const key = await getOrGenerateMasterKey();
+    const iv = crypto.randomBytes(IV_LENGTH);
+
+    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+
+    const authTag = cipher.getAuthTag();
+
+    // Format: iv:authTag:encrypted
+    return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
+  } catch (error) {
+    logger.error('Security: Encryption failed', error);
+    throw error;
+  }
+}
+
+/**
+ * Decrypts a string using AES-256-GCM.
+ * Input format: "iv_hex:auth_tag_hex:ciphertext_hex"
+ */
+export async function decrypt(text: string): Promise<string> {
+  // Check if it's plain text (JSON) for backward compatibility
+  // Very rough check: starts with { or [
+  if (text.startsWith('{') || text.startsWith('[')) {
+    return text;
+  }
+
+  // Also checking if it follows our pattern
+  const parts = text.split(':');
+  if (parts.length !== 3) {
+    // Treat as plain text if it doesn't look like our encrypted format
+    return text;
+  }
+
+  try {
+    const key = await getOrGenerateMasterKey();
+
+    const [ivHex, authTagHex, encryptedHex] = parts;
+    const iv = Buffer.from(ivHex, 'hex');
+    const authTag = Buffer.from(authTagHex, 'hex');
+
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+
+    let decrypted = decipher.update(encryptedHex, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+
+    return decrypted;
+  } catch (error) {
+    logger.error('Security: Decryption failed', error);
+    // If decryption fails, it might be corrupted or using a different key.
+    throw error;
+  }
+}