encryption.ts — astro Source File

Source Code

import { decodeBase64, decodeHex, encodeBase64, encodeHexUpperCase } from '@oslojs/encoding';
import type { CspAlgorithm } from '../types/public/index.js';
import { ALGORITHMS, type CspHash } from './csp/config.js';

// Chose this algorithm for no particular reason, can change.
// This algo does check against text manipulation though. See
// https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/encrypt#aes-gcm
const ALGORITHM = 'AES-GCM';

/**
 * Creates a CryptoKey object that can be used to encrypt any string.
 */
export async function createKey() {
	const key = await crypto.subtle.generateKey(
		{
			name: ALGORITHM,
			length: 256,
		},
		true,
		['encrypt', 'decrypt'],
	);
	return key;
}

// The environment variable name that can be used to provide the encrypted key.
const ENVIRONMENT_KEY_NAME = 'ASTRO_KEY' as const;

/**
 * Get the encoded value of the ASTRO_KEY env var.
 */
function getEncodedEnvironmentKey(): string {
	return process.env[ENVIRONMENT_KEY_NAME] || '';
}

/**
 * See if the environment variable key ASTRO_KEY is set.
 */
export function hasEnvironmentKey(): boolean {
	return getEncodedEnvironmentKey() !== '';
}

/**
 * Get the environment variable key and decode it into a CryptoKey.
 */
export async function getEnvironmentKey(): Promise<CryptoKey> {
	// This should never happen, because we always check `hasEnvironmentKey` before this is called.
	if (!hasEnvironmentKey()) {
		throw new Error(
			`There is no environment key defined. If you see this error there is a bug in Astro.`,
		);
	}
	const encodedKey = getEncodedEnvironmentKey();
	return decodeKey(encodedKey);
}

/**
 * Encodes a CryptoKey to base64 string, so that it can be embedded in JSON / JavaScript
 */
export async function encodeKey(key: CryptoKey) {
	const exported = await crypto.subtle.exportKey('raw', key);
// ... (80 more lines)