feat(security): Add centralized middleware for authentication, rate limiting and security headers

Author: Rakshak05

auth.ts

@@ -21,7 +21,7 @@ export const { handlers, auth, signIn, signOut } = NextAuth({
   callbacks: {
     async jwt({ token, account }) {
       if (account?.access_token) {
-        token.ghToken = encryptToken(account.access_token);
+        token.ghToken = await encryptToken(account.access_token);
       }
       return token;
     },

lib/crypto.empty-fallback.test.ts

@@ -10,75 +10,75 @@ afterEach(() => {
 });
 
 describe('crypto empty / missing inputs verification', () => {
-  it('encrypts and decrypts a normal token string', () => {
+  it('encrypts and decrypts a normal token string', async () => {
     const plain = 'gho_abc123def456token';
-    const encrypted = encryptToken(plain);
+    const encrypted = await encryptToken(plain);
     expect(encrypted).toBeDefined();
     expect(encrypted).not.toBe(plain);
     expect(encrypted.split('.')).toHaveLength(4);
-    expect(decryptToken(encrypted)).toBe(plain);
+    expect(await decryptToken(encrypted)).toBe(plain);
   });
 
-  it('handles empty string encryption and decryption', () => {
-    const encrypted = encryptToken('');
+  it('handles empty string encryption and decryption', async () => {
+    const encrypted = await encryptToken('');
     expect(encrypted.split('.')).toHaveLength(4);
-    expect(decryptToken(encrypted)).toBe('');
+    expect(await decryptToken(encrypted)).toBe('');
   });
 
-  it('rejects malformed payload with wrong number of parts', () => {
-    expect(() => decryptToken('only-one-part')).toThrow();
-    expect(() => decryptToken('two.parts')).toThrow();
-    expect(() => decryptToken('a.b.c.d')).toThrow();
+  it('rejects malformed payload with wrong number of parts', async () => {
+    await expect(decryptToken('only-one-part')).rejects.toThrow();
+    await expect(decryptToken('two.parts')).rejects.toThrow();
+    await expect(decryptToken('a.b.c.d')).rejects.toThrow();
   });
 
-  it('rejects payload with invalid base64', () => {
+  it('rejects payload with invalid base64', async () => {
     const payload = '!!!invalid-base64!!!.aaaa.aaaa';
-    expect(() => decryptToken(payload)).toThrow();
+    await expect(decryptToken(payload)).rejects.toThrow();
   });
 
-  it('rejects empty payload string', () => {
-    expect(() => decryptToken('')).toThrow();
+  it('rejects empty payload string', async () => {
+    await expect(decryptToken('')).rejects.toThrow();
   });
 
-  it('rejects tampered ciphertext (modified encrypted part)', () => {
+  it('rejects tampered ciphertext (modified encrypted part)', async () => {
     const plain = 'gho_secret_token';
-    const encrypted = encryptToken(plain);
+    const encrypted = await encryptToken(plain);
     const parts = encrypted.split('.');
     const tampered = [parts[0], parts[1], '////'].join('.');
-    expect(() => decryptToken(tampered)).toThrow();
+    await expect(decryptToken(tampered)).rejects.toThrow();
   });
 
-  it('rejects tampered auth tag (modified tag part)', () => {
+  it('rejects tampered auth tag (modified tag part)', async () => {
     const plain = 'gho_secret_token';
-    const encrypted = encryptToken(plain);
+    const encrypted = await encryptToken(plain);
     const parts = encrypted.split('.');
     const tampered = [parts[0], '////', parts[2]].join('.');
-    expect(() => decryptToken(tampered)).toThrow();
+    await expect(decryptToken(tampered)).rejects.toThrow();
   });
 
-  it('rejects tampered IV (modified iv part)', () => {
+  it('rejects tampered IV (modified iv part)', async () => {
     const plain = 'gho_secret_token';
-    const encrypted = encryptToken(plain);
+    const encrypted = await encryptToken(plain);
     const parts = encrypted.split('.');
     const tampered = ['////', parts[1], parts[2]].join('.');
-    expect(() => decryptToken(tampered)).toThrow();
+    await expect(decryptToken(tampered)).rejects.toThrow();
   });
 });
 
 describe('crypto key errors', () => {
-  it('throws when ENCRYPTION_KEY is missing', () => {
+  it('throws when ENCRYPTION_KEY is missing', async () => {
     vi.stubEnv('ENCRYPTION_KEY', '');
-    expect(() => encryptToken('test')).toThrow(/ENCRYPTION_KEY/i);
+    await expect(encryptToken('test')).rejects.toThrow(/ENCRYPTION_KEY/i);
   });
 
-  it('throws when ENCRYPTION_KEY is too short', () => {
+  it('throws when ENCRYPTION_KEY is too short', async () => {
     vi.stubEnv('ENCRYPTION_KEY', 'short');
-    expect(() => encryptToken('test')).toThrow(/ENCRYPTION_KEY/i);
+    await expect(encryptToken('test')).rejects.toThrow(/ENCRYPTION_KEY/i);
   });
 
-  it('throws on decrypt with wrong key', () => {
-    const encrypted = encryptToken('secret');
+  it('throws on decrypt with wrong key', async () => {
+    const encrypted = await encryptToken('secret');
     vi.stubEnv('ENCRYPTION_KEY', 'a-different-key-that-is-32-char!!');
-    expect(() => decryptToken(encrypted)).toThrow();
+    await expect(decryptToken(encrypted)).rejects.toThrow();
   });
 });

lib/crypto.massive-scaling.test.ts

@@ -10,50 +10,50 @@ afterEach(() => {
 });
 
 describe('crypto massive scaling', () => {
-  it('handles very long token strings without truncation', () => {
+  it('handles very long token strings without truncation', async () => {
     const long = 'a'.repeat(10_000);
-    const encrypted = encryptToken(long);
-    expect(decryptToken(encrypted)).toBe(long);
+    const encrypted = await encryptToken(long);
+    expect(await decryptToken(encrypted)).toBe(long);
   });
 
-  it('handles unicode characters including emoji', () => {
+  it('handles unicode characters including emoji', async () => {
     const unicode = '🚀🔥💯 commitpulse 测试 テスト тест';
-    const encrypted = encryptToken(unicode);
-    expect(decryptToken(encrypted)).toBe(unicode);
+    const encrypted = await encryptToken(unicode);
+    expect(await decryptToken(encrypted)).toBe(unicode);
   });
 
-  it('handles strings with special characters', () => {
+  it('handles strings with special characters', async () => {
     const special = '!@#$%^&*()_+-=[]{}|;:\'",.<>?/`~';
-    const encrypted = encryptToken(special);
-    expect(decryptToken(encrypted)).toBe(special);
+    const encrypted = await encryptToken(special);
+    expect(await decryptToken(encrypted)).toBe(special);
   });
 
-  it('handles JSON-serialized payload', () => {
+  it('handles JSON-serialized payload', async () => {
     const payload = JSON.stringify({
       access_token: 'gho_xxx',
       scope: 'repo,user',
       token_type: 'bearer',
     });
-    const encrypted = encryptToken(payload);
-    expect(decryptToken(encrypted)).toBe(payload);
+    const encrypted = await encryptToken(payload);
+    expect(await decryptToken(encrypted)).toBe(payload);
   });
 
-  it('maintains round-trip integrity for repeated encryptions of same plaintext (different IV)', () => {
+  it('maintains round-trip integrity for repeated encryptions of same plaintext (different IV)', async () => {
     const plain = 'gho_consistent_token_value';
     const results = new Set<string>();
     for (let i = 0; i < 10; i++) {
-      results.add(encryptToken(plain));
+      results.add(await encryptToken(plain));
     }
     expect(results.size).toBe(10);
-    results.forEach((enc) => {
-      expect(decryptToken(enc)).toBe(plain);
-    });
+    for (const enc of Array.from(results)) {
+      expect(await decryptToken(enc)).toBe(plain);
+    }
   });
 
-  it('handles maximum token length (512 bytes) typical for GitHub tokens', () => {
+  it('handles maximum token length (512 bytes) typical for GitHub tokens', async () => {
     const typical = 'ghp_' + 'a'.repeat(508);
     expect(typical.length).toBe(512);
-    const encrypted = encryptToken(typical);
-    expect(decryptToken(encrypted)).toBe(typical);
+    const encrypted = await encryptToken(typical);
+    expect(await decryptToken(encrypted)).toBe(typical);
   });
 });

lib/crypto.test.ts

@@ -13,52 +13,52 @@ afterAll(() => {
 });
 
 describe('encryptToken / decryptToken', () => {
-  it('round-trips a plain text token', () => {
+  it('round-trips a plain text token', async () => {
     const plain = 'ghp_test123token';
-    const enc = encryptToken(plain);
+    const enc = await encryptToken(plain);
     expect(enc).not.toBe(plain);
-    expect(decryptToken(enc)).toBe(plain);
+    expect(await decryptToken(enc)).toBe(plain);
   });
 
-  it('produces different ciphertexts for the same input (random salt/IV)', () => {
+  it('produces different ciphertexts for the same input (random salt/IV)', async () => {
     const plain = 'same-value';
-    const a = encryptToken(plain);
-    const b = encryptToken(plain);
+    const a = await encryptToken(plain);
+    const b = await encryptToken(plain);
     expect(a).not.toBe(b);
   });
 
-  it('rejects a tampered ciphertext', () => {
-    const enc = encryptToken('secret');
+  it('rejects a tampered ciphertext', async () => {
+    const enc = await encryptToken('secret');
     const parts = enc.split('.');
     parts[2] = Buffer.from('ffffffffffffffff').toString('base64');
-    expect(() => decryptToken(parts.join('.'))).toThrow();
+    await expect(decryptToken(parts.join('.'))).rejects.toThrow();
   });
 
-  it('throws on invalid payload format', () => {
-    expect(() => decryptToken('not-a-valid-format')).toThrow();
+  it('throws on invalid payload format', async () => {
+    await expect(decryptToken('not-a-valid-format')).rejects.toThrow();
   });
 
-  it('handles empty string', () => {
-    const enc = encryptToken('');
-    expect(decryptToken(enc)).toBe('');
+  it('handles empty string', async () => {
+    const enc = await encryptToken('');
+    expect(await decryptToken(enc)).toBe('');
   });
 
-  it('handles special characters', () => {
+  it('handles special characters', async () => {
     const plain = 'abc123!@#$%^&*()_+=-[]{}|;:,.<>?/~`';
-    expect(decryptToken(encryptToken(plain))).toBe(plain);
+    expect(await decryptToken(await encryptToken(plain))).toBe(plain);
   });
 
-  it('throws when ENCRYPTION_KEY is missing', () => {
+  it('throws when ENCRYPTION_KEY is missing', async () => {
     const saved = process.env.ENCRYPTION_KEY;
     delete process.env.ENCRYPTION_KEY;
-    expect(() => encryptToken('x')).toThrow('ENCRYPTION_KEY');
+    await expect(encryptToken('x')).rejects.toThrow('ENCRYPTION_KEY');
     process.env.ENCRYPTION_KEY = saved;
   });
 
-  it('throws when ENCRYPTION_KEY is too short', () => {
+  it('throws when ENCRYPTION_KEY is too short', async () => {
     const saved = process.env.ENCRYPTION_KEY;
     process.env.ENCRYPTION_KEY = 'short';
-    expect(() => encryptToken('x')).toThrow('ENCRYPTION_KEY');
+    await expect(encryptToken('x')).rejects.toThrow('ENCRYPTION_KEY');
     process.env.ENCRYPTION_KEY = saved;
   });
 });

lib/crypto.ts

@@ -1,28 +1,78 @@
 import 'server-only';
-import crypto from 'node:crypto';
 
-const ALGO = 'aes-256-gcm';
+// Polyfill global crypto for older environments if needed
+const webCrypto = typeof crypto !== 'undefined' ? crypto : globalThis.crypto;
 
-function key(salt: Buffer): Buffer {
+const ALGO = 'AES-GCM';
+
+async function deriveKey(salt: Uint8Array): Promise<CryptoKey> {
   const k = process.env.ENCRYPTION_KEY;
   if (!k || k.length < 32) {
     throw new Error('ENCRYPTION_KEY must be at least 32 characters');
   }
-  return crypto.pbkdf2Sync(k, salt, 100000, 32, 'sha512');
+
+  const baseKey = await webCrypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(k),
+    'PBKDF2',
+    false,
+    ['deriveKey']
+  );
+
+  return webCrypto.subtle.deriveKey(
+    {
+      name: 'PBKDF2',
+      salt: salt as BufferSource,
+      iterations: 100000,
+      hash: 'SHA-512',
+    },
+    baseKey,
+    { name: ALGO, length: 256 },
+    false,
+    ['encrypt', 'decrypt']
+  );
 }
 
-export function encryptToken(plain: string): string {
-  const salt = crypto.randomBytes(16);
-  const iv = crypto.randomBytes(12);
-  const cipher = crypto.createCipheriv(ALGO, key(salt), iv);
-  const enc = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return [salt, iv, tag, enc].map((b) => b.toString('base64')).join('.');
+export async function encryptToken(plain: string): Promise<string> {
+  const salt = webCrypto.getRandomValues(new Uint8Array(16));
+  const iv = webCrypto.getRandomValues(new Uint8Array(12));
+  const derivedKey = await deriveKey(salt);
+
+  const encoded = new TextEncoder().encode(plain);
+  const encryptedBuffer = await webCrypto.subtle.encrypt(
+    { name: ALGO, iv, tagLength: 128 },
+    derivedKey,
+    encoded
+  );
+
+  const encryptedBytes = new Uint8Array(encryptedBuffer);
+  const enc = encryptedBytes.slice(0, -16);
+  const tag = encryptedBytes.slice(-16);
+
+  const toBase64 = (arr: Uint8Array) => Buffer.from(arr).toString('base64');
+
+  return [toBase64(salt), toBase64(iv), toBase64(tag), toBase64(enc)].join('.');
 }
 
-export function decryptToken(payload: string): string {
-  const [salt, iv, tag, enc] = payload.split('.').map((p) => Buffer.from(p, 'base64'));
-  const decipher = crypto.createDecipheriv(ALGO, key(salt), iv);
-  decipher.setAuthTag(tag);
-  return Buffer.concat([decipher.update(enc), decipher.final()]).toString('utf8');
+export async function decryptToken(payload: string): Promise<string> {
+  const parts = payload.split('.');
+  if (parts.length !== 4) {
+    throw new Error('Invalid payload format');
+  }
+
+  const [salt, iv, tag, enc] = parts.map((p) => new Uint8Array(Buffer.from(p, 'base64')));
+
+  const derivedKey = await deriveKey(salt);
+
+  const cipherTextWithTag = new Uint8Array(enc.length + tag.length);
+  cipherTextWithTag.set(enc);
+  cipherTextWithTag.set(tag, enc.length);
+
+  const decryptedBuffer = await webCrypto.subtle.decrypt(
+    { name: ALGO, iv, tagLength: 128 },
+    derivedKey,
+    cipherTextWithTag
+  );
+
+  return new TextDecoder().decode(decryptedBuffer);
 }

lib/githubtoken.test.ts

@@ -24,7 +24,7 @@ describe('getUserGitHubToken', () => {
 
   it('decrypts the GitHub token from the JWT cookie', async () => {
     const plainToken = 'gho_test_access_token';
-    vi.mocked(getToken).mockResolvedValue({ ghToken: encryptToken(plainToken) });
+    vi.mocked(getToken).mockResolvedValue({ ghToken: await encryptToken(plainToken) });
 
     await expect(getUserGitHubToken()).resolves.toBe(plainToken);
     expect(getToken).toHaveBeenCalledWith(

lib/githubtoken.ts

@@ -25,7 +25,7 @@ export async function getUserGitHubToken(): Promise<string | undefined> {
   if (!jwt?.ghToken || typeof jwt.ghToken !== 'string') return undefined;
 
   try {
-    return decryptToken(jwt.ghToken);
+    return await decryptToken(jwt.ghToken);
   } catch {
     return undefined; // corrupt/expired -> use global fallback
   }