@qnx/crypto

@qnx/crypto provides utility functions to generate and decrypt JSON Web Signatures (JWS) and JSON Web Encryption (JWE) using the jose cryptography library for secure data transmission.

✨ Features

• 🔐 JWT signing and verification
• 🔒 JWE encryption and decryption
• 🔁 Auth token generator/decryptor
• 📦 Built on the JOSE standard

📦 Installation

Install via your preferred package manager:

# npm
npm install @qnx/crypto

# yarn
yarn add @qnx/crypto

# pnpm
pnpm install @qnx/crypto

🔗 Peer Dependency

Install jose (required):

npm install jose

🚀 Usage

🔧 Core Functions

| Function | Purpose | | ------------ | ------------------------ | | jwtSign | Sign a JWT payload | | jwtVerify | Verify a JWT token | | jweEncrypt | Encrypt a payload to JWE | | jweDecrypt | Decrypt a JWE token |

✅ jwtSign

Signs and returns a JWT using a symmetric secret.

import { jwtSign, toSymmetricSecret } from '@qnx/crypto'

const data = { foo: 'bar' }
const secret = toSymmetricSecret('SECRET_STRING')

const jwt = await jwtSign({ data }, secret, { alg: 'HS256' })

✅ jwtVerify

Verifies the JWT format, signature, and claims set.

import { jwtVerify, toSymmetricSecret } from '@qnx/crypto'

const secret = toSymmetricSecret('SECRET_STRING')
const { payload } = await jwtVerify(jwt, secret)

🔐 jweEncrypt

Encrypts a string using JWE.

import { jweEncrypt, toPKCS8Secret } from '@qnx/crypto'

const secret = await toPKCS8Secret(process.env.ENCRYPTION_SECRET_JWE, 'ECDH-ES+A128KW')
const jwe = await jweEncrypt('this is message.', secret)

🔓 jweDecrypt

Decrypts a previously encrypted JWE string.

import { jweDecrypt, toPKCS8Secret } from '@qnx/crypto'

const secret = await toPKCS8Secret(process.env.ENCRYPTION_SECRET_JWE, 'ECDH-ES+A128KW')
const { plaintext } = await jweDecrypt(jwe, secret)

🔐 Auth Token Management

🔧 Environment Setup

Ensure these environment variables are set:

ENCRYPTION_SECRET_JWT=your_jwt_secret
ENCRYPTION_SECRET_JWE=your_jwe_secret

🛠️ generateAuthToken

Creates a signed and encrypted auth token.

import { generateAuthToken } from '@qnx/crypto'

const subject = 'userId'
const { token, dbToken } = await generateAuthToken(subject)

// token: Encrypted token for client
// dbToken: Unique identifier for storage

🥪 decryptAuthToken

Decrypts and verifies the encrypted auth token.

import { decryptAuthToken } from '@qnx/crypto'

const encryptedToken = '...' // Your token here

try {
  const decryptedPayload = await decryptAuthToken(encryptedToken)
  // Use the decrypted payload
} catch (error) {
  console.error('Token decryption failed:', error)
}

🤝 Contributing

Pull requests are welcome! For major changes, please open an issue first to discuss what you’d like to change. Make sure to update or add tests where appropriate.

📄 License

MIT License © 2023-PRESENT Yatendra Kushwaha