mirror of
https://github.com/documenso/documenso.git
synced 2025-11-13 08:13:56 +10:00
d766b58f42
## Description Currently we are required to ensure PII data is not passed around in search parameters and in the open for GDPR reasons. Allowing us to encrypt and decrypt values with expiry dates will allow us to ensure this doesn't happen. ## Changes Made - Added TPRC router for encryption method ## Testing Performed - Tested encrypting and decrypting data with and without `expiredAt` - Tested via directly accessing API and also via trpc in react components - Tested parsing en email search param in a page and decrypting it successfully ## Checklist - [X] I have tested these changes locally and they work as expected. - [X] I have followed the project's coding style guidelines.
43 lines
1.1 KiB
TypeScript
43 lines
1.1 KiB
TypeScript
import { z } from 'zod';
|
|
|
|
import { DOCUMENSO_ENCRYPTION_SECONDARY_KEY } from '@documenso/lib/constants/crypto';
|
|
import { symmetricEncrypt } from '@documenso/lib/universal/crypto';
|
|
import type { TEncryptSecondaryDataMutationSchema } from '@documenso/trpc/server/crypto/schema';
|
|
|
|
export const ZEncryptedDataSchema = z.object({
|
|
data: z.string(),
|
|
expiresAt: z.number().optional(),
|
|
});
|
|
|
|
export type EncryptDataOptions = {
|
|
data: string;
|
|
|
|
/**
|
|
* When the data should no longer be allowed to be decrypted.
|
|
*
|
|
* Leave this empty to never expire the data.
|
|
*/
|
|
expiresAt?: number;
|
|
};
|
|
|
|
/**
|
|
* Encrypt the passed in data. This uses the secondary encrypt key for miscellaneous data.
|
|
*
|
|
* @returns The encrypted data.
|
|
*/
|
|
export const encryptSecondaryData = ({ data, expiresAt }: TEncryptSecondaryDataMutationSchema) => {
|
|
if (!DOCUMENSO_ENCRYPTION_SECONDARY_KEY) {
|
|
throw new Error('Missing encryption key');
|
|
}
|
|
|
|
const dataToEncrypt: z.infer<typeof ZEncryptedDataSchema> = {
|
|
data,
|
|
expiresAt,
|
|
};
|
|
|
|
return symmetricEncrypt({
|
|
key: DOCUMENSO_ENCRYPTION_SECONDARY_KEY,
|
|
data: JSON.stringify(dataToEncrypt),
|
|
});
|
|
};
|