Software: Apache. PHP/8.1.30 

uname -a: Linux server1.tuhinhossain.com 5.15.0-163-generic #173-Ubuntu SMP Tue Oct 14 17:51:00 UTC
2025 x86_64 

uid=1002(picotech) gid=1003(picotech) groups=1003(picotech),0(root)  

Safe-mode: OFF (not secure)

/home/picotech/domains/note.picotech.app/public_html/src/services/   drwxr-xr-x
Free 25.88 GB of 117.98 GB (21.93%)
                            Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Self remove    Logout    

Viewing file:     encryptionService.js (4.4 KB)      -rw-r--r--

const crypto = require('crypto');
const fs = require('fs').promises;
const path = require('path');

// Encryption configuration
const ALGORITHM = 'aes-256-gcm';
const KEY_LENGTH = 32; // 256 bits
const IV_LENGTH = 16; // 128 bits for GCM
const SALT_LENGTH = 64;
const TAG_LENGTH = 16;

// Get encryption key from environment - required for security
const getEncryptionKey = () => {
  const key = process.env.ENCRYPTION_KEY;
  if (!key) {
    throw new Error('ENCRYPTION_KEY environment variable is required');
  }
  if (key.length !== 64) {
    throw new Error('ENCRYPTION_KEY must be a 64-character hex string (256 bits)');
  }
  return Buffer.from(key, 'hex');
};

// Generate a random salt for key derivation
const generateSalt = () => {
  return crypto.randomBytes(SALT_LENGTH);
};

// Derive encryption key from password and salt
const deriveKey = (password, salt) => {
  return crypto.scryptSync(password, salt, KEY_LENGTH);
};

// Encrypt data using AES-GCM
const encrypt = (data) => {
  const key = getEncryptionKey();
  const iv = crypto.randomBytes(IV_LENGTH);
  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);

  let encrypted = cipher.update(data, 'utf8', 'hex');
  encrypted += cipher.final('hex');

  const authTag = cipher.getAuthTag();

  return {
    encryptedData: encrypted,
    iv: iv.toString('hex'),
    tag: authTag.toString('hex')
  };
};

// Decrypt data using AES-GCM
const decrypt = (encryptedData, iv, tag) => {
  const key = getEncryptionKey();
  const decipher = crypto.createDecipheriv(ALGORITHM, key, Buffer.from(iv, 'hex'));
  decipher.setAuthTag(Buffer.from(tag, 'hex'));

  let decrypted = decipher.update(encryptedData, 'hex', 'utf8');
  decrypted += decipher.final('utf8');

  return decrypted;
};

// Encrypt file using AES-GCM
const encryptFile = async (inputPath, outputPath) => {
  try {
    const key = getEncryptionKey();
    const iv = crypto.randomBytes(IV_LENGTH);
    const cipher = crypto.createCipheriv(ALGORITHM, key, iv);

    const inputBuffer = await fs.readFile(inputPath);
    const encrypted = Buffer.concat([
      cipher.update(inputBuffer),
      cipher.final()
    ]);

    const authTag = cipher.getAuthTag();

    // Write encrypted data with IV and auth tag prepended
    const outputBuffer = Buffer.concat([
      iv,
      authTag,
      encrypted
    ]);

    await fs.writeFile(outputPath, outputBuffer);
    return true;
  } catch (error) {
    console.error('File encryption failed:', error);
    throw new Error('Failed to encrypt file');
  }
};

// Decrypt file using AES-GCM
const decryptFile = async (inputPath, outputPath) => {
  try {
    const key = getEncryptionKey();
    const inputBuffer = await fs.readFile(inputPath);

    // Extract IV, auth tag, and encrypted data
    const iv = inputBuffer.subarray(0, IV_LENGTH);
    const authTag = inputBuffer.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
    const encryptedData = inputBuffer.subarray(IV_LENGTH + TAG_LENGTH);

    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
    decipher.setAuthTag(authTag);

    const decrypted = Buffer.concat([
      decipher.update(encryptedData),
      decipher.final()
    ]);

    await fs.writeFile(outputPath, decrypted);
    return true;
  } catch (error) {
    console.error('File decryption failed:', error);
    throw new Error('Failed to decrypt file');
  }
};

// Encrypt text data for database storage
const encryptForDB = (text) => {
  if (!text) return text;
  const encrypted = encrypt(text);
  return JSON.stringify({
    data: encrypted.encryptedData,
    iv: encrypted.iv,
    tag: encrypted.tag
  });
};

// Decrypt text data from database storage
const decryptFromDB = (encryptedText) => {
  if (!encryptedText) return encryptedText;

  try {
    const parsed = JSON.parse(encryptedText);
    return decrypt(parsed.data, parsed.iv, parsed.tag);
  } catch (error) {
    console.error('Database decryption failed:', error);
    throw new Error('Failed to decrypt database data');
  }
};

// Check if file is encrypted (by checking for our format)
const isFileEncrypted = async (filePath) => {
  try {
    const buffer = await fs.readFile(filePath, null, IV_LENGTH + TAG_LENGTH);
    // Our encrypted files start with IV (16 bytes) + Auth Tag (16 bytes)
    return buffer.length >= IV_LENGTH + TAG_LENGTH;
  } catch (error) {
    return false;
  }
};

module.exports = {
  encrypt,
  decrypt,
  encryptFile,
  decryptFile,
  encryptForDB,
  decryptFromDB,
  isFileEncrypted,
  getEncryptionKey
};