feat: extract crypto helpers and add comprehensive AES-256-GCM test s…

__tests__/crypto.test.ts

@@ -0,0 +1,101 @@
+import { encrypt, decrypt } from "../lib/crypto";
+
+describe("Crypto Utils", () => {
+  // Mock NEXTAUTH_SECRET to ensure tests don't fail based on local env
+  const OLD_ENV = process.env;
+
+  beforeAll(() => {
+    process.env = { ...OLD_ENV, NEXTAUTH_SECRET: "test-secret-key-32-chars-long-abc" };
+  });
+
+  afterAll(() => {
+    process.env = OLD_ENV;
+  });
+
+  describe("Round-Trip Data Integrity", () => {
+    it("should successfully encrypt and decrypt a standard string", () => {
+      const plaintext = "hello world!";
+      const ciphertext = encrypt(plaintext);
+      const decrypted = decrypt(ciphertext);
+      expect(decrypted).toBe(plaintext);
+    });
+
+    it("should handle empty strings", () => {
+      const plaintext = "";
+      const ciphertext = encrypt(plaintext);
+      const decrypted = decrypt(ciphertext);
+      expect(decrypted).toBe(plaintext);
+    });
+
+    it("should handle long strings", () => {
+      const plaintext = "a".repeat(10000);
+      const ciphertext = encrypt(plaintext);
+      const decrypted = decrypt(ciphertext);
+      expect(decrypted).toBe(plaintext);
+    });
+
+    it("should handle special characters and unicode", () => {
+      const plaintext = "hello 🌍🚀 ~!@#$%^&*()_+";
+      const ciphertext = encrypt(plaintext);
+      const decrypted = decrypt(ciphertext);
+      expect(decrypted).toBe(plaintext);
+    });
+  });
+
+  describe("Format and Delimiter Validation", () => {
+    it("should return a string separated by two colons into 3 parts", () => {
+      const ciphertext = encrypt("test");
+      const parts = ciphertext.split(":");
+      expect(parts).toHaveLength(3);
+
+      const [iv, tag, enc] = parts;
+      expect(iv.length).toBeGreaterThan(0);
+      expect(tag.length).toBeGreaterThan(0);
+      expect(enc.length).toBeGreaterThan(0);
+
+      // Should be valid hex
+      expect(/^[0-9a-f]+$/i.test(iv)).toBe(true);
+      expect(/^[0-9a-f]+$/i.test(tag)).toBe(true);
+      expect(/^[0-9a-f]+$/i.test(enc)).toBe(true);
+    });
+  });
+
+  describe("Initialization Vector (IV) Uniqueness", () => {
+    it("should generate a unique ciphertext for the same plaintext", () => {
+      const plaintext = "identical plaintext";
+      const first = encrypt(plaintext);
+      const second = encrypt(plaintext);
+      expect(first).not.toBe(second);
+
+      const firstParts = first.split(":");
+      const secondParts = second.split(":");
+      // IVs should be different
+      expect(firstParts[0]).not.toBe(secondParts[0]);
+    });
+  });
+
+  describe("Robust Error & Tamper Handling", () => {
+    it("should throw an error if the input string is malformed", () => {
+      expect(() => decrypt("not-a-valid-ciphertext")).toThrow();
+      expect(() => decrypt("one:two")).toThrow();
+    });
+
+    it("should throw an error if the ciphertext is modified", () => {
+      const original = encrypt("top secret");
+      const parts = original.split(":");
+      // Tamper with the encrypted data
+      parts[2] = parts[2].substring(1) + "0"; 
+      const tampered = parts.join(":");
+      expect(() => decrypt(tampered)).toThrow();
+    });
+
+    it("should throw an error if the authentication tag is altered", () => {
+      const original = encrypt("top secret");
+      const parts = original.split(":");
+      // Tamper with the auth tag
+      parts[1] = "00000000000000000000000000000000"; 
+      const tampered = parts.join(":");
+      expect(() => decrypt(tampered)).toThrow();
+    });
+  });
+});

jest.config.js

@@ -0,0 +1,12 @@
+/* eslint-disable @typescript-eslint/no-require-imports */
+const { createDefaultPreset } = require("ts-jest");
+
+const tsJestTransformCfg = createDefaultPreset().transform;
+
+/** @type {import("jest").Config} **/
+module.exports = {
+  testEnvironment: "node",
+  transform: {
+    ...tsJestTransformCfg,
+  },
+};

lib/crypto.ts

@@ -0,0 +1,29 @@
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+
+export function getKey(): Buffer {
+  const raw = process.env.NEXTAUTH_SECRET ?? "default-dev-secret-32-chars-long";
+  return createHash("sha256").update(raw).digest();
+}
+
+export function encrypt(plaintext: string): string {
+  const key = getKey();
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const enc = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("hex")}:${tag.toString("hex")}:${enc.toString("hex")}`;
+}
+
+export function decrypt(ciphertext: string): string {
+  const [ivHex, tagHex, dataHex] = ciphertext.split(":");
+  if (!ivHex || !tagHex || dataHex === undefined) {
+    throw new Error("Invalid ciphertext format");
+  }
+  const key = getKey();
+  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(ivHex, "hex"));
+  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
+  return (
+    decipher.update(Buffer.from(dataHex, "hex")).toString("utf8") +
+    decipher.final("utf8")
+  );
+}

lib/env-store.ts

@@ -11,36 +11,9 @@
  *  - multiple app instances  ✓  (shared Neon DB)
  */
 
-import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { encrypt, decrypt } from "./crypto";
 import { getDb, ensureTables } from "./db";
 
-// ── DB helpers ─────────────────────────────────────────────────────────────────
-
-function getKey(): Buffer {
-  const raw = process.env.NEXTAUTH_SECRET ?? "default-dev-secret-32-chars-long";
-  return createHash("sha256").update(raw).digest();
-}
-
-function encrypt(plaintext: string): string {
-  const key = getKey();
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const enc = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${iv.toString("hex")}:${tag.toString("hex")}:${enc.toString("hex")}`;
-}
-
-function decrypt(ciphertext: string): string {
-  const [ivHex, tagHex, dataHex] = ciphertext.split(":");
-  const key = getKey();
-  const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(ivHex, "hex"));
-  decipher.setAuthTag(Buffer.from(tagHex, "hex"));
-  return (
-    decipher.update(Buffer.from(dataHex, "hex")).toString("utf8") +
-    decipher.final("utf8")
-  );
-}
-
 // ── Public API ─────────────────────────────────────────────────────────────────
 
 /** Returns plaintext env vars for a project. */