Function encryptWithSymmetricKey

packages/encryption/src/encryption.ts:186–205

(value: string, keyBase64: string)

 * Format: iv:authTag:encrypted (all base64)
 */
export function encryptWithSymmetricKey(value: string, keyBase64: string): string {
  if (!keyBase64) {
    throw new EncryptionConfigurationError('Encryption key is required');
  }

  const key = Buffer.from(keyBase64, 'base64');
  if (key.length !== 32) {
    throw new EncryptionConfigurationError('Encryption key must be exactly 32 bytes (256 bits)');
  }

  const iv = randomBytes(16);
  const cipher = createCipheriv('aes-256-gcm', key, iv);

  let encrypted = cipher.update(value, 'utf8', 'base64');
  encrypted += cipher.final('base64');

  const authTag = cipher.getAuthTag();

  return `${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted}`;
}

/**
 * Decrypts a value encrypted with encryptWithSymmetricKey.