From 08890309c2ff1387f5045594220a057a772a8e00 Mon Sep 17 00:00:00 2001
From: Hide_D <hided62@gmail.com>
Date: Sat, 19 Aug 2023 06:58:38 +0000
Subject: [PATCH] =?UTF-8?q?SecureToken=EC=9D=84=20=ED=95=98=EB=82=98?=
 =?UTF-8?q?=EB=A1=9C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/SecureToken.ts | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/server/SecureToken.ts b/server/SecureToken.ts
index d715493..3f717ce 100644
--- a/server/SecureToken.ts
+++ b/server/SecureToken.ts
@@ -13,6 +13,7 @@ import { BSON } from "bson";
 
 export type SecureEncryptedToken = {
     nonce: string; // [key, iv] = SHA512(presharedSecret + nonce)
+    encrypted: 1;
     type: string; // aad[0]
     validUntil: string; // aad[1]
     payload: string; //BASE64(AES(BSON(aad),BSON(payload)))
@@ -20,12 +21,15 @@ export type SecureEncryptedToken = {
 
 export type SecurePlaintextToken = {
     nonce: string; // [key, iv] = SHA512(presharedSecret + nonce)
+    encrypted: 0;
     type: string; // aad[0]
     validUntil: string; // aad[1]
     payload: string; // JSON => aad[2]
     tag: string; //BASE64(AES(BSON(aad),null)))
 }
 
+export type SecureToken = SecureEncryptedToken | SecurePlaintextToken;
+
 const staticPresharedTokenSecret: string | undefined = process.env.PRESHARED_TOKEN_SECRET;
 
 export async function generateSecureEncryptedToken<T extends object>(validUntil: Date, type: string, payload: T, presharedTokenSecret?: string): Promise<SecureEncryptedToken> {
@@ -60,6 +64,7 @@ export async function generateSecureEncryptedToken<T extends object>(validUntil:
 
     return {
         nonce: nonce.toString('base64'),
+        encrypted: 1,
         type,
         validUntil: validUntilText,
         payload: ciphertext.toString('base64'),
@@ -73,6 +78,10 @@ export async function parseSecureEncryptedToken<T extends object>(secureToken: S
         throw new Error("token expired");
     }
 
+    if(!secureToken.encrypted) {
+        throw new Error("token is not encrypted");
+    }
+
     if (!presharedTokenSecret) {
         if (!staticPresharedTokenSecret) {
             throw new Error("PRESHARED_TOKEN_SECRET is not set");
@@ -135,6 +144,7 @@ export async function generateSecurePlaintextToken<T extends object>(validUntil:
 
     return {
         nonce: nonce.toString('base64'),
+        encrypted: 0,
         type,
         validUntil: validUntilText,
         payload: jsonPayload,
@@ -150,6 +160,10 @@ export async function parseSecurePlaintextToken<T extends object>(secureToken: S
         presharedTokenSecret = staticPresharedTokenSecret;
     }
 
+    if (secureToken.encrypted) {
+        throw new Error("token is encrypted");
+    }
+
     const secretLength = Buffer.byteLength(presharedTokenSecret, 'utf8');
     const secretBuffer = Buffer.alloc(secretLength + 16);
     secretBuffer.write(presharedTokenSecret, 0, secretLength, 'utf8');
@@ -169,4 +183,12 @@ export async function parseSecurePlaintextToken<T extends object>(secureToken: S
     await AES_GCM_Decrypt(key, iv, tag, aadRaw);
 
     return JSON.parse(secureToken.payload);
+}
+
+export async function parseSecureToken<T extends object>(secureToken: SecureToken, presharedTokenSecret?: string): Promise<T> {
+    if (secureToken.encrypted) {
+        return await parseSecureEncryptedToken(secureToken, presharedTokenSecret);
+    } else {
+        return await parseSecurePlaintextToken(secureToken, presharedTokenSecret);
+    }
 }
\ No newline at end of file