chore: typescript / bumps / test framework

.eslintrc.json

@@ -0,0 +1,19 @@
+{
+  "parser": "@typescript-eslint/parser",
+   "parserOptions": {
+     "project": "./tsconfig.json"
+   },
+  "env": {
+    "node": true,
+    "es6": true,
+    "jest/globals": true
+  },
+  "plugins": ["jest", "@typescript-eslint"],
+  "extends": [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/eslint-recommended",
+    "plugin:@typescript-eslint/recommended",
+    "prettier",
+    "prettier/@typescript-eslint"
+  ]
+}

.prettierrc.json

@@ -0,0 +1,6 @@
+{
+  "arrowParens": "always",
+  "trailingComma": "all",
+  "singleQuote": true,
+  "htmlWhitespaceSensitivity": "ignore"
+}

.travis.yml

@@ -1,10 +1,21 @@
 dist: bionic
 sudo: false
 language: node_js
+cache: npm
 
 node_js:
   - "12"
 
+install:
+  - npm ci
+
+script:
+  - npm run build
+  - npm run lint
+
+after_success:
+  - npm run semantic-release
+
 addons:
   hosts:
     - db

README.md

@@ -97,3 +97,5 @@ To achieve a zero-downtime rotation from `oldKey` to `newKey`:
 ## License
 
 MIT
+
+Originally based on work by [defunctzombie](https://github.com/defunctzombie).

index.ts

@@ -0,0 +1,127 @@
+import * as crypto from 'crypto';
+import {
+  DataTypeAbstract,
+  DefineAttributeColumnOptions,
+  Instance,
+} from 'sequelize';
+
+type Key = string;
+
+export interface FieldOptions {
+  algorithm?: string;
+  iv_length?: number;
+  extraDecryptionKeys?: Key | Key[];
+}
+
+export interface SequelizeConstants {
+  BLOB: DataTypeAbstract;
+  VIRTUAL: DataTypeAbstract;
+}
+
+export class EncryptedField {
+  _algorithm: string;
+  _iv_length: number;
+  encrypted_field_name: string | undefined = undefined;
+  encryptionKey: Buffer;
+  decryptionKeys: Buffer[];
+  Sequelize: SequelizeConstants;
+
+  constructor(Sequelize: SequelizeConstants, key: Key, opt?: FieldOptions) {
+    opt = opt || {};
+    this._algorithm = opt.algorithm || 'aes-256-cbc';
+    this._iv_length = opt.iv_length || 16;
+
+    let extraDecryptionKeys: Key[] = [];
+    if (opt.extraDecryptionKeys) {
+      extraDecryptionKeys = Array.isArray(opt.extraDecryptionKeys)
+        ? opt.extraDecryptionKeys
+        : Array(opt.extraDecryptionKeys);
+    }
+    this.decryptionKeys = [key].concat(extraDecryptionKeys).map(function (key) {
+      return Buffer.from(key, 'hex');
+    });
+    this.encryptionKey = this.decryptionKeys[0];
+    this.Sequelize = Sequelize;
+  }
+
+  vault(name: string): DefineAttributeColumnOptions {
+    if (this.encrypted_field_name) {
+      throw new Error('vault already initialized');
+    }
+
+    this.encrypted_field_name = name;
+
+    const self = this;
+
+    return {
+      type: self.Sequelize.BLOB,
+      get: function (this: Instance<unknown>) {
+        const stored: string | null = this.getDataValue(name);
+        if (!stored) {
+          return {};
+        }
+
+        const previous: Buffer = Buffer.from(stored);
+
+        function decrypt(key: Buffer) {
+          const iv = previous.slice(0, self._iv_length);
+          const content = previous.slice(self._iv_length, previous.length);
+          const decipher = crypto.createDecipheriv(self._algorithm, key, iv);
+
+          const json =
+            decipher.update(content, undefined, 'utf8') +
+            decipher.final('utf8');
+          return JSON.parse(json);
+        }
+
+        const keyCount = self.decryptionKeys.length;
+        for (let i = 0; i < keyCount; i++) {
+          try {
+            return decrypt(self.decryptionKeys[i]);
+          } catch (error) {
+            if (i >= keyCount - 1) {
+              throw error;
+            }
+          }
+        }
+      },
+      set: function (this: Instance<unknown>, value: any) {
+        // if new data is set, we will use a new IV
+        const new_iv = crypto.randomBytes(self._iv_length);
+
+        const cipher = crypto.createCipheriv(
+          self._algorithm,
+          self.encryptionKey,
+          new_iv,
+        );
+
+        cipher.end(JSON.stringify(value), 'utf-8');
+        const enc_final = Buffer.concat([new_iv, cipher.read()]);
+        this.setDataValue(name, enc_final);
+      },
+    };
+  }
+
+  field(name: string): DefineAttributeColumnOptions {
+    if (!this.encrypted_field_name) {
+      throw new Error(
+        'you must initialize the vault field before using encrypted fields',
+      );
+    }
+
+    const encrypted_field_name = this.encrypted_field_name;
+
+    return {
+      type: this.Sequelize.VIRTUAL,
+      set: function (this: any, val) {
+        // the proxying breaks if you don't use this local
+        const encrypted = this[encrypted_field_name];
+        encrypted[name] = val;
+        this[encrypted_field_name] = encrypted;
+      },
+      get: function (this: any) {
+        return this[encrypted_field_name][name];
+      },
+    };
+  }
+}

jest.config.js

@@ -0,0 +1,10 @@
+module.exports = {
+  testEnvironment: 'node',
+  transform: {
+    '^.+\\.(ts)?$': 'ts-jest',
+  },
+  testRegex: '(/test/.*|(\\.|/)(spec.jest))(?<!.d)\\.(js?|ts?)$',
+  collectCoverageFrom: ['*.ts'],
+  coverageReporters: ['text-summary', 'html'],
+  moduleFileExtensions: ['ts', 'js'],
+};

package.json

@@ -1,33 +1,47 @@
 {
-  "name": "sequelize-encrypted",
+  "name": "@snyk/sequelize-encrypted",
   "version": "0.1.0",
   "description": "encrypted sequelize fields",
-  "main": "index.js",
+  "main": "dist/index.js",
   "scripts": {
-    "test": "mocha"
+    "build": "tsc",
+    "format": "npx prettier --write '*.?s' 'test/*.?s'",
+    "lint": "eslint '*.?s' 'test/*.?s'",
+    "test": "jest --detectOpenHandles",
+    "semantic-release": "semantic-release",
+    "prepare": "npm run build"
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/defunctzombie/sequelize-encrypted.git"
+    "url": "https://github.com/snyk/sequelize-encrypted.git"
   },
   "keywords": [
     "sequelize",
     "encrypted"
   ],
-  "author": "Roman Shtylman <shtylman@gmail.com>",
+  "author": "snyk.io",
   "license": "MIT",
   "bugs": {
-    "url": "https://github.com/defunctzombie/sequelize-encrypted/issues"
+    "url": "https://github.com/snyk/sequelize-encrypted/issues"
   },
-  "homepage": "https://github.com/defunctzombie/sequelize-encrypted",
+  "homepage": "https://github.com/snyk/sequelize-encrypted",
   "devDependencies": {
-    "babel-plugin-transform-async-to-generator": "6.8.0",
-    "babel-plugin-transform-es2015-modules-commonjs": "6.10.3",
-    "babel-polyfill": "6.9.1",
-    "babel-preset-es2015": "6.9.0",
-    "babel-register": "6.9.0",
-    "mocha": "2.0.1",
-    "pg": "6.0.1",
-    "sequelize": "3.23.4"
+    "@types/jest": "^25.2.1",
+    "@types/node": "^12.12.36",
+    "@types/sequelize": "^3.30.13",
+    "@typescript-eslint/eslint-plugin": "^2.28.0",
+    "@typescript-eslint/parser": "^2.28.0",
+    "eslint": "^6.8.0",
+    "eslint-config-prettier": "^6.10.1",
+    "eslint-plugin-jest": "^23.8.2",
+    "jest": "^25.3.0",
+    "pg": "^6.4.2",
+    "semantic-release": "^17.0.6",
+    "sequelize": "^3.35.1",
+    "ts-jest": "^25.4.0",
+    "typescript": "^3.8.3"
+  },
+  "publishConfig": {
+    "access": "restricted"
   }
 }