@sprout-idws/sprout-crypto

NestJS AES-256-GCM encryption and decryption service keyed from configuration—useful for protecting sensitive payloads at rest or in transit within your domain (not a substitute for TLS or Swarm secrets for infrastructure credentials).

Purpose

• Provide a single injectable CryptoService with encrypt / decrypt using Node crypto:
  • Algorithm: AES-256-GCM
  • Key: scryptSync(ENCRYPTION_SECRET, 'salt', 32)
  • Ciphertext format: base64-encoded iv || authTag || ciphertext

Installation

npm install @sprout-idws/sprout-crypto @nestjs/config

Peer dependencies: @nestjs/common, @nestjs/config (v10+ / v3+).

Configuration

| Variable | Required | Description | |----------|----------|-------------| | ENCRYPTION_SECRET | Yes | Secret string used to derive the 32-byte key. If unset, CryptoService throws at construction time. |

Usage

import { Module } from '@nestjs/common';
import { ConfigModule } from '@nestjs/config';
import { CryptoModule } from '@sprout-idws/sprout-crypto';

@Module({
  imports: [ConfigModule, CryptoModule],
})
export class AppModule {}

import { Injectable } from '@nestjs/common';
import { CryptoService } from '@sprout-idws/sprout-crypto';

@Injectable()
export class TokensService {
  constructor(private readonly crypto: CryptoService) {}

  seal(plain: string) {
    return this.crypto.encrypt(plain);
  }

  open(sealed: string) {
    return this.crypto.decrypt(sealed);
  }
}

Security notes

• Treat ENCRYPTION_SECRET like any other application secret (Swarm secret, vault, etc.).
• The module uses a fixed salt in code for key derivation; rotating secrets requires a migration strategy for existing ciphertext.

Repository

sprout-typescript-backend — packages/sprout-crypto.