Function decodeKey

apps/api/src/lib/crypto/aes-gcm.utils.ts:19–45

(raw: string)

const CIPHER_ALGORITHM = "aes-256-gcm";

const decodeKey = (raw: string): Buffer => {
  if (raw === "") {
    throw ApiErrors.internal(
      "MFA_ENCRYPTION_KEY is empty. Generate one with `openssl rand -base64 32` and set it before enabling MFA."
    );
  }

  let key: Buffer;

  try {
    key = Buffer.from(raw, "base64");
  } catch {
    throw ApiErrors.internal(
      "MFA_ENCRYPTION_KEY is not valid base64. Generate a fresh key with `openssl rand -base64 32`."
    );
  }

  if (key.length !== AES_256_KEY_BYTES) {
    throw ApiErrors.internal(
      `MFA_ENCRYPTION_KEY decoded to ${String(key.length)} bytes; expected ${String(
        AES_256_KEY_BYTES
      )}. Regenerate with \`openssl rand -base64 32\`.`
    );
  }

  return key;
};

/**
 * AES-256-GCM string encryption with a versioned ciphertext format.