Function encryptSecret

packages/plugins/encrypted-secrets/src/index.ts:45–60

(key: Buffer, plaintext: string)

const deriveKey = (master: string): Buffer => scryptSync(master, KEY_SALT, 32);

const encryptSecret = (key: Buffer, plaintext: string): Effect.Effect<string, StorageError> =>
  Effect.try({
    try: () => {
      const iv = randomBytes(12);
      const cipher = createCipheriv("aes-256-gcm", key, iv);
      const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
      const tag = cipher.getAuthTag();
      return [
        PAYLOAD_VERSION,
        iv.toString("base64"),
        tag.toString("base64"),
        ciphertext.toString("base64"),
      ].join(".");
    },
    catch: (cause) => new StorageError({ message: "Failed to encrypt secret", cause }),
  });

const decryptSecret = (key: Buffer, payload: string): Effect.Effect<string, StorageError> =>
  Effect.try({