"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.AesGcmEncryptionService = void 0;
const crypto_1 = __importDefault(require("crypto"));
const env_1 = require("../../main/config/env");
const ALGORITHM = 'aes-256-gcm';
const IV_LENGTH = 16;
const AUTH_TAG_LENGTH = 16;
const SEPARATOR = ':';
class AesGcmEncryptionService {
    masterKey;
    constructor() {
        this.masterKey = Buffer.from(env_1.env.ENCRYPTION_MASTER_KEY, 'hex');
        if (this.masterKey.length !== 32) {
            throw new Error('ENCRYPTION_MASTER_KEY must decode to exactly 32 bytes');
        }
    }
    encrypt(plaintext) {
        const iv = crypto_1.default.randomBytes(IV_LENGTH);
        const cipher = crypto_1.default.createCipheriv(ALGORITHM, this.masterKey, iv);
        const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
        const authTag = cipher.getAuthTag();
        return [iv.toString('hex'), encrypted.toString('hex'), authTag.toString('hex')].join(SEPARATOR);
    }
    decrypt(ciphertext) {
        const parts = ciphertext.split(SEPARATOR);
        if (parts.length !== 3) {
            throw new Error('Invalid ciphertext format');
        }
        const [ivHex, encryptedHex, authTagHex] = parts;
        const iv = Buffer.from(ivHex, 'hex');
        const encrypted = Buffer.from(encryptedHex, 'hex');
        const authTag = Buffer.from(authTagHex, 'hex');
        if (iv.length !== IV_LENGTH || authTag.length !== AUTH_TAG_LENGTH) {
            throw new Error('Invalid ciphertext component lengths');
        }
        const decipher = crypto_1.default.createDecipheriv(ALGORITHM, this.masterKey, iv);
        decipher.setAuthTag(authTag);
        const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
        return decrypted.toString('utf8');
    }
}
exports.AesGcmEncryptionService = AesGcmEncryptionService;
//# sourceMappingURL=aes-gcm-encryption-service.js.map