homeio

1import "server-only";
2
3import {
4  createCipheriv,
5  createDecipheriv,
6  hkdfSync,
7  randomBytes,
8} from "node:crypto";
9import { serverEnv } from "@/lib/server/env";
10
11const ALGORITHM = "aes-256-gcm" as const;
12const KEY_BYTES = 32;
13const IV_BYTES = 12;
14const TAG_BYTES = 16;
15const HKDF_DIGEST = "sha256" as const;
16const HKDF_SALT = Buffer.from("homeio.totp.v1.salt", "utf8");
17const HKDF_INFO = Buffer.from("homeio.totp.secret-encryption", "utf8");
18const PACKED_PART_COUNT = 3;
19const PACKED_SEPARATOR = ".";
20
21const INVALID_FORMAT_MESSAGE = "Invalid encrypted secret format";
22
23function decodeExplicitKey(base64: string): Buffer {
24  const decoded = Buffer.from(base64, "base64");
25  if (decoded.length !== KEY_BYTES) {
26    throw new Error(
27      `AUTH_TOTP_ENCRYPTION_KEY must decode to ${KEY_BYTES} bytes`,
28    );
29  }
30  return decoded;
31}
32
33function deriveKeyFromSessionSecret(sessionSecret: string): Buffer {
34  // RFC 5869 HKDF — salt + info give domain separation so a future key
35  // derived from the same AUTH_SESSION_SECRET cannot collide with this one.
36  const derived = hkdfSync(
37    HKDF_DIGEST,
38    sessionSecret,
39    HKDF_SALT,
40    HKDF_INFO,
41    KEY_BYTES,
42  );
43  return Buffer.from(derived);
44}
45
46function resolveEncryptionKey(): Buffer {
47  const explicit = serverEnv.AUTH_TOTP_ENCRYPTION_KEY?.trim();
48  if (explicit) {
49    return decodeExplicitKey(explicit);
50  }
51  return deriveKeyFromSessionSecret(serverEnv.AUTH_SESSION_SECRET);
52}
53
54/**
55 * Encrypts a TOTP secret (or backup-code JSON) with AES-256-GCM and packs
56 * the IV, ciphertext, and authentication tag into a single base64 string
57 * of the form `<iv>.<cipher>.<tag>`. A fresh 96-bit IV is generated per
58 * call — never reuse an IV with the same key.
59 */
60export function encryptSecret(plaintext: string): string {
61  const key = resolveEncryptionKey();
62  const iv = randomBytes(IV_BYTES);
63  const cipher = createCipheriv(ALGORITHM, key, iv);
64
65  const ciphertext = Buffer.concat([
66    cipher.update(plaintext, "utf8"),
67    cipher.final(),
68  ]);
69  const tag = cipher.getAuthTag();
70
71  return [
72    iv.toString("base64"),
73    ciphertext.toString("base64"),
74    tag.toString("base64"),
75  ].join(PACKED_SEPARATOR);
76}
77
78/**
79 * Reverses {@link encryptSecret}. Throws if the packed format is malformed
80 * or if AES-GCM authentication fails (tampering, wrong key, truncated tag).
81 */
82export function decryptSecret(packed: string): string {
83  const parts = packed.split(PACKED_SEPARATOR);
84  if (parts.length !== PACKED_PART_COUNT) {
85    throw new Error(INVALID_FORMAT_MESSAGE);
86  }
87  const [ivPart, cipherPart, tagPart] = parts;
88
89  const iv = Buffer.from(ivPart, "base64");
90  const ciphertext = Buffer.from(cipherPart, "base64");
91  const tag = Buffer.from(tagPart, "base64");
92
93  if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES) {
94    throw new Error(INVALID_FORMAT_MESSAGE);
95  }
96
97  const key = resolveEncryptionKey();
98  const decipher = createDecipheriv(ALGORITHM, key, iv);
99  decipher.setAuthTag(tag);
100
101  const plaintext = Buffer.concat([
102    decipher.update(ciphertext),
103    decipher.final(),
104  ]);
105
106  return plaintext.toString("utf8");
107}
108