CCU History Crypto (Go WASM)

Browser-side decryption package for /api/ccus/history protected payloads.

Build

cd wasm/ccu-history-crypto
./scripts/build.sh "your-arbitrary-key-string" "citizenshub.app"

• 1st arg: key material (arbitrary string / hex: / base64:)
• 2nd arg (optional): allowed hostname for origin check (default: citizenshub.app)

The build script will:

• derive a 16-byte key with SHA-256 (same rule as backend)
• compile src/main.go to pkg/chc.wasm
• copy Go runtime loader to pkg/wasm_exec.js

Usage

import { decryptCcuHistoryPayload } from './pkg/index.js';
import wasmUrl from './pkg/chc.wasm?url';
import wasmExecUrl from './pkg/wasm_exec.js?url';

const encrypted = await fetch('https://api.citizenshub.app/api/ccus/history').then((r) => r.json());

const history = await decryptCcuHistoryPayload(encrypted, {
  wasmUrl,
  wasmExecUrl
});

Behavior

• Uses Go syscall/js runtime.
• Origin check is performed in Go WASM by comparing window.location.hostname with build-time allowedHost.
• Supports deterministic payloads (no random salt/nonce rotation), so encrypted response can be cached.
• Supports optional gzip decompression when payload has compression: "gzip".