root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(FN-4884): finalize docs and keep workspace gates green

Browse Source 
Fusion-Task-Id: FN-4884
Fusion-Task-Lineage: b906ade4-a9f1-4f2e-b684-4ebf49c3e7e6
This commit is contained in:
Fusion (runfusion.ai)
2026-05-17 07:25:29 -07:00
committed by gsxdsm
parent 030a27b40d
commit 96a19309ae
7 changed files with 55 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
packages/core/src/secrets-sync.ts
View File

@@ -1,9 +1,32 @@
import { createCipheriv, createDecipheriv, randomBytes, scrypt as scryptCallback } from "node:crypto";
import { promisify } from "node:util";
import type { SecretAccessPolicy } from "./types.js";
import type { SecretScope } from "./secrets-store.js";
const scrypt = promisify(scryptCallback);
function deriveKey(
passphrase: string,
salt: Buffer,
keyLen: number,
params: { N: number; r: number; p: number },
): Promise<Buffer> {
return new Promise((resolve, reject) => {
scryptCallback(
passphrase,
salt,
keyLen,
{
...params,
maxmem: 64 * 1024 * 1024,
},
(error, derivedKey) => {
if (error) {
reject(error);
return;
}
resolve(derivedKey as Buffer);
},
);
});
}
export interface WrappedSecretsBundle {
ciphertext: string;
@@ -37,12 +60,7 @@ const DEFAULT_KDF_PARAMS = { N: 32768, r: 8, p: 1, keyLen: 32 } as const;
export async function wrapSecretsBundle(records: SecretsSyncRecord[], passphrase: string): Promise<WrappedSecretsBundle> {
const salt = randomBytes(16);
const nonce = randomBytes(12);
const key = await scrypt(passphrase, salt, DEFAULT_KDF_PARAMS.keyLen, {
N: DEFAULT_KDF_PARAMS.N,
r: DEFAULT_KDF_PARAMS.r,
p: DEFAULT_KDF_PARAMS.p,
maxmem: 64 * 1024 * 1024,
}) as Buffer;
const key = await deriveKey(passphrase, salt, DEFAULT_KDF_PARAMS.keyLen, DEFAULT_KDF_PARAMS);
const cipher = createCipheriv("aes-256-gcm", key, nonce);
const payload = Buffer.from(JSON.stringify(records), "utf8");
@@ -72,12 +90,7 @@ export async function unwrapSecretsBundle(envelope: WrappedSecretsBundle, passph
const authTag = packed.subarray(packed.length - 16);
const encrypted = packed.subarray(0, packed.length - 16);
const key = await scrypt(passphrase, salt, envelope.kdfParams.keyLen, {
N: envelope.kdfParams.N,
r: envelope.kdfParams.r,
p: envelope.kdfParams.p,
maxmem: 64 * 1024 * 1024,
}) as Buffer;
const key = await deriveKey(passphrase, salt, envelope.kdfParams.keyLen, envelope.kdfParams);
const decipher = createDecipheriv("aes-256-gcm", key, nonce);
decipher.setAuthTag(authTag);