Security Measures

const encrypted = crypto.publicEncrypt(
  {
    key: publicKey,
    padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
  },
  buffer,
);

private readonly MAX_KEY_GEN_PER_DEVICE = 5;
private readonly KEY_GEN_WINDOW_MS = 24 * 60 * 60 * 1000; // 24 hours

private enforceKeyGenerationRateLimit(deviceId: string): void {
  const now = Date.now();
  const deviceLimits = this.deviceKeyGenLimits.get(deviceId) || {
    count: 0,
    resetTime: now + this.KEY_GEN_WINDOW_MS,
  };
  
  // Reset counter if time window has passed
  if (now > deviceLimits.resetTime) {
    deviceLimits.count = 0;
    deviceLimits.resetTime = now + this.KEY_GEN_WINDOW_MS;
  }
  
  // Increment counter and update
  deviceLimits.count++;
  this.deviceKeyGenLimits.set(deviceId, deviceLimits);
}

@Injectable()
export class CustomThrottlerGuard extends ThrottlerGuard {
  protected getTrack(context: ExecutionContext): string {
    const ctx = GqlExecutionContext.create(context);
    const req = ctx.getContext().req;
    
    return req?.ip || req?.headers['x-forwarded-for'] || 'unknown-ip';
  }
}

private readonly maxEncryptedDataSize: number;

constructor(
  private readonly configService: ConfigService,
) {
  this.maxEncryptedDataSize = this.configService.get(
    'MAX_ENCRYPTED_DATA_SIZE',
    2048,  // Default: 2048 bytes
  );
}

private validateEncryptedDataSize(encryptedData: string): void {
  if (encryptedData.length > this.maxEncryptedDataSize) {
    this.logger.warn(
      `Encrypted data exceeds maximum allowed size: ${encryptedData.length} > ${this.maxEncryptedDataSize}`
    );
    throw new Error('Encrypted data size exceeds limit');
  }
}

async decryptWithPrivateKey(
  encryptedData: string,
  keyId: string,
): Promise<string> {
  // Validate encrypted data size BEFORE decryption
  this.validateEncryptedDataSize(encryptedData);
  
  const privateKey = await this.getPrivateKey(keyId);
  const decryptedData = await decryptData(encryptedData, privateKey);
  
  return decryptedData;
}

private async getPrivateKey(keyId: string): Promise<string> {
  const keyEntry = await this.prismaService.clientEncryptionKey.findUnique({
    where: { id: keyId },
  });
  
  if (!keyEntry) {
    throw new Error('Encryption key not found');
  }
  
  // Check if key has expired
  if (keyEntry.expiresAt && keyEntry.expiresAt < new Date()) {
    this.logger.warn(`Key with ID ${keyId} has expired`);
    throw new Error('Encryption key has expired');
  }
  
  return keyEntry.privateKey;
}

async validateKeyId(keyId: string): Promise<boolean> {
  const keyEntry = await this.prismaService.clientEncryptionKey.findUnique({
    where: { id: keyId },
  });
  
  if (!keyEntry) return false;
  
  // Check if key has expired
  if (keyEntry.expiresAt && keyEntry.expiresAt < new Date()) {
    return false;
  }
  
  return true;
}

async recordMetric(
  operation: 'encrypt' | 'decrypt' | 'generate',
  status: 'success' | 'failure',
  {
    keyId = null,
    deviceId = null,
    errorReason = null,
    duration = 0,
  }
): Promise<void> {
  await this.prismaService.encryptionMetric.create({
    data: {
      keyId,
      deviceId,
      operation,
      status,
      errorReason,
      duration,
      timestamp: new Date(),
    },
  });
}

async generateMetricsSummary(timeframeHours: number = 24): Promise<any> {
  const timeThreshold = new Date();
  timeThreshold.setHours(timeThreshold.getHours() - timeframeHours);
  
  // Get total counts by operation and status
  const metrics = await this.prismaService.$queryRaw`
    SELECT 
      operation, 
      status, 
      COUNT(*) as count,
      AVG(duration) as avg_duration
    FROM "EncryptionMetric"
    WHERE timestamp >= ${timeThreshold}
    GROUP BY operation, status
  `;
  
  // Get failure rates
  const failureRates = await this.prismaService.$queryRaw`
    SELECT 
      operation,
      SUM(CASE WHEN status = 'failure' THEN 1 ELSE 0 END) * 100.0 / COUNT(*) as failure_rate
    FROM "EncryptionMetric"
    WHERE timestamp >= ${timeThreshold}
    GROUP BY operation
  `;
  
  // Top failure reasons
  const topFailures = await this.prismaService.$queryRaw`
    SELECT 
      operation,
      "errorReason" AS reason,  
      COUNT(*) AS count
    FROM "EncryptionMetric"
    WHERE status = 'failure' AND timestamp >= ${timeThreshold}
    GROUP BY operation, "errorReason"
    ORDER BY count DESC
    LIMIT 10
  `;
  
  return { metrics, failureRates, topFailures, timeframeHours };
}

query GetMetrics {
  getEncryptionMetricsSummary(timeframeHours: 24)
}

/**
 * Retrieves the private key for a given keyId
 * Never exposes private key to clients
 */
private async getPrivateKey(keyId: string): Promise<string> {
  // Private method - not accessible via API
  const keyEntry = await this.prismaService.clientEncryptionKey.findUnique({
    where: { id: keyId },
  });
  
  return keyEntry.privateKey;
}

try {
  const decryptedData = await decryptData(encryptedData, privateKey);
  return decryptedData;
} catch (error) {
  // Log detailed error server-side
  this.logger.error(`Decryption failed: ${error.message}`, error.stack);
  this.recordDecryptionFailureMetric(keyId, error.message);
  
  // Return generic error to client
  throw new Error('Failed to decrypt data');
}

# .env file

# Encryption Configuration
ENCRYPTION_KEY_ROTATION_DAYS=30
ENCRYPTION_KEY_RETENTION_DAYS=90
MAX_ENCRYPTED_DATA_SIZE=2048

# Database Security
DATABASE_URL=postgresql://user:pass@host:5432/db?sslmode=require

# Rate Limiting (NestJS Throttler)
THROTTLE_TTL=60
THROTTLE_LIMIT=10