Method encrypt

packages/shared/src/secrets/encryption.ts:40–66

(plaintext: string)

  }

  async encrypt(plaintext: string): Promise<SecretEncryptionMaterial> {
    const masterKey = await this.keyPromise;
    const iv = crypto.getRandomValues(new Uint8Array(12));
    const encoder = new TextEncoder();
    const encoded = encoder.encode(plaintext);

    const ciphertext = await crypto.subtle.encrypt(
      { name: 'AES-GCM', iv: SecretEncryption.toArrayBuffer(iv) },
      masterKey,
      SecretEncryption.toArrayBuffer(encoded)
    );

    const ciphertextBytes = new Uint8Array(ciphertext);
    if (ciphertextBytes.length < 16) {
      throw new Error('Encrypted payload shorter than authentication tag length.');
    }

    const dataBytes = ciphertextBytes.slice(0, ciphertextBytes.length - 16);
    const tagBytes = ciphertextBytes.slice(ciphertextBytes.length - 16);

    return {
      ciphertext: SecretEncryption.encode(dataBytes),
      authTag: SecretEncryption.encode(tagBytes),
      iv: SecretEncryption.encode(iv),
      keyId: this.keyId,
    };
  }

  async decrypt(material: SecretEncryptionMaterial): Promise<string> {
    const masterKey = await this.keyPromise;