fix(service-settings): WebContainer AES-GCM support with @noble/ciphers

Author: os-zhuang

.changeset/service-settings-webcontainer-aes-gcm.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/service-settings': minor
+---
+
+`InMemoryCryptoProvider` now auto-detects WebContainer (StackBlitz) and swaps `node:crypto`'s AES-256-GCM for a pure-JS implementation from `@noble/ciphers/aes.js`.
+
+**Why:** WebContainer's `node:crypto` ships `createCipheriv`/`createDecipheriv` stubs that throw `TypeError: y.run is not a function` when called with `'aes-256-gcm'`. Any code path that persists an encrypted setting through `sys_secret` would crash on StackBlitz.
+
+**How it works:**
+- Detection: `process.versions.webcontainer` / `SHELL=jsh` / `STACKBLITZ` env.
+- The ciphertext layout `iv(12) || tag(16) || cipher` is preserved, so handles written on one runtime decrypt cleanly on the other.
+- AAD binding (`namespace|key`) and `digest()` are unchanged.
+- In non-WebContainer runtimes the code path is identical to before.
+
+If `@noble/ciphers` cannot be loaded for any reason, the provider falls back to `node:crypto` and lets it throw, surfacing the misconfiguration clearly.

packages/services/service-settings/package.json

@@ -18,6 +18,7 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "@noble/ciphers": "^2.2.0",
     "@objectstack/core": "workspace:*",
     "@objectstack/platform-objects": "workspace:*",
     "@objectstack/spec": "workspace:*"

packages/services/service-settings/src/in-memory-crypto-provider.ts

@@ -34,21 +34,78 @@ import { createHash, randomBytes, createCipheriv, createDecipheriv } from 'node:
  * folded into AES-GCM AAD so a ciphertext rewrapped from a different
  * (ns, key) tuple fails decryption — guards against operators
  * accidentally copying rows between namespaces.
+ *
+ * WebContainer (StackBlitz) note: `node:crypto.createCipheriv('aes-256-gcm', …)`
+ * is not implemented in WebContainer. When we detect that runtime, we
+ * swap to a pure-JS AES-GCM from `@noble/ciphers/aes.js`, producing the
+ * same `iv || tag || ciphertext` byte layout so the handle shape is
+ * unchanged. The swap is best-effort: if the dependency is missing,
+ * we fall back to the Node implementation and let it throw, surfacing
+ * the configuration problem clearly.
  */
+const isWebContainerRuntime = (): boolean => {
+  const g = globalThis as any;
+  return (
+    typeof g !== 'undefined' &&
+    (Boolean(g.process?.versions?.webcontainer) ||
+      Boolean(g.process?.env?.SHELL?.includes?.('jsh')) ||
+      Boolean(g.process?.env?.STACKBLITZ))
+  );
+};
+
+type GcmFactory = (key: Uint8Array, nonce: Uint8Array, aad?: Uint8Array) => {
+  encrypt: (plain: Uint8Array) => Uint8Array;
+  decrypt: (cipher: Uint8Array) => Uint8Array;
+};
+
+let nobleGcmPromise: Promise<GcmFactory | undefined> | undefined;
+const loadNobleGcm = (): Promise<GcmFactory | undefined> => {
+  if (!nobleGcmPromise) {
+    nobleGcmPromise = (async () => {
+      try {
+        const mod = await import('@noble/ciphers/aes.js');
+        return mod.gcm as unknown as GcmFactory;
+      } catch (err: any) {
+        console.warn(
+          `[InMemoryCryptoProvider] WebContainer detected but @noble/ciphers not installed: ${err?.message ?? err}. Falling back to node:crypto (will throw).`,
+        );
+        return undefined;
+      }
+    })();
+  }
+  return nobleGcmPromise;
+};
+
 export class InMemoryCryptoProvider implements ICryptoProvider {
   private readonly key: Buffer;
+  private readonly useNoble: boolean;
 
   constructor(opts: { key?: Buffer } = {}) {
     this.key = opts.key ?? randomBytes(32);
+    this.useNoble = isWebContainerRuntime();
   }
 
   async encrypt(plain: string, ctx: CryptoContext): Promise<CryptoHandle> {
     const iv = randomBytes(12);
-    const cipher = createCipheriv('aes-256-gcm', this.key, iv);
-    cipher.setAAD(Buffer.from(this.aadOf(ctx), 'utf8'));
-    const enc = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
-    const tag = cipher.getAuthTag();
-    const blob = Buffer.concat([iv, tag, enc]).toString('base64');
+    const aad = Buffer.from(this.aadOf(ctx), 'utf8');
+    const plainBytes = Buffer.from(plain, 'utf8');
+
+    let blob: string;
+    if (this.useNoble) {
+      const gcm = await loadNobleGcm();
+      if (gcm) {
+        const cipher = gcm(this.key, iv, aad);
+        const ctWithTag = cipher.encrypt(plainBytes); // ciphertext || tag(16)
+        const ct = ctWithTag.subarray(0, ctWithTag.length - 16);
+        const tag = ctWithTag.subarray(ctWithTag.length - 16);
+        blob = Buffer.concat([iv, Buffer.from(tag), Buffer.from(ct)]).toString('base64');
+      } else {
+        blob = this.encryptNode(plainBytes, iv, aad);
+      }
+    } else {
+      blob = this.encryptNode(plainBytes, iv, aad);
+    }
+
     return {
       id: 'sec_' + randomBytes(16).toString('hex'),
       kmsKeyId: 'local:in-memory:v1',
@@ -63,8 +120,19 @@ export class InMemoryCryptoProvider implements ICryptoProvider {
     const iv = buf.subarray(0, 12);
     const tag = buf.subarray(12, 28);
     const data = buf.subarray(28);
+    const aad = Buffer.from(this.aadOf(ctx), 'utf8');
+
+    if (this.useNoble) {
+      const gcm = await loadNobleGcm();
+      if (gcm) {
+        const cipher = gcm(this.key, iv, aad);
+        const ctWithTag = Buffer.concat([data, tag]); // noble expects ciphertext || tag
+        const out = cipher.decrypt(ctWithTag);
+        return Buffer.from(out).toString('utf8');
+      }
+    }
     const decipher = createDecipheriv('aes-256-gcm', this.key, iv);
-    decipher.setAAD(Buffer.from(this.aadOf(ctx), 'utf8'));
+    decipher.setAAD(aad);
     decipher.setAuthTag(tag);
     return Buffer.concat([decipher.update(data), decipher.final()]).toString('utf8');
   }
@@ -84,6 +152,14 @@ export class InMemoryCryptoProvider implements ICryptoProvider {
     return 'sha256:' + createHash('sha256').update(plain, 'utf8').digest('hex');
   }
 
+  private encryptNode(plainBytes: Buffer, iv: Buffer, aad: Buffer): string {
+    const cipher = createCipheriv('aes-256-gcm', this.key, iv);
+    cipher.setAAD(aad);
+    const enc = Buffer.concat([cipher.update(plainBytes), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return Buffer.concat([iv, tag, enc]).toString('base64');
+  }
+
   private aadOf(ctx: CryptoContext): string {
     // Bind ciphertext to (namespace,key) so a row cannot be moved across
     // specifiers. Tenant binding is intentionally omitted because the