web / lib/utils/encryption
lib/utils/encryption
Field-level encryption utilities for sensitive data at rest.
Uses AES-256-GCM authenticated encryption, keyed by PAYLOAD_SECRET.
Encrypted values are stored as iv:authTag:ciphertext (hex-encoded).
Functions
encryptField()
encryptField(
plaintext,secret):string
Encrypt a plaintext string using AES-256-GCM.
Parameters
plaintext
string
secret
string
Returns
string
Encrypted string in format iv:authTag:ciphertext (hex-encoded)
decryptField()
decryptField(
encrypted,secret):string
Decrypt an encrypted field value.
Parameters
encrypted
string
Value in format iv:authTag:ciphertext (hex-encoded)
secret
string
Returns
string
Decrypted plaintext string
Throws
If the value is tampered with or the wrong key is used
isEncrypted()
isEncrypted(
value):boolean
Check whether a value appears to be encrypted (matches the iv:authTag:ciphertext format).
Used for gradual migration of existing plaintext values.
Parameters
value
string
Returns
boolean