Classes

@system-inc/base-foundation · 515c140 · 2 symbols

EncryptedTokenService

class

Generic service for encrypting and decrypting typed payloads into token strings. Uses AES encryption with key rotation support.

Tokens are self-validating — successful decryption proves authenticity.

decrypt(token: string, authenticatedData?: string): Promise<T | null>
Decrypt a token string back into a typed payload. Returns null if the token is invalid or tampered with.
decryptFromUrl(token: string, authenticatedData?: string): Promise<T | null>
URL-decode and decrypt a token from a URL. Returns null if the token is invalid or tampered with.
encrypt(payload: T, authenticatedData?: string): Promise<string>
Encrypt a payload into a token string.
encryptForUrl(payload: T, authenticatedData?: string): Promise<string>
Encrypt a payload and URL-encode the result for use in URLs.

class

extends EncryptionKeyProvider

getEncryptionKey(id: string): EncryptionKey
Get an encryption key by its id.
getPreferredEncryptionKey(): EncryptionKey
Returns the preferred encryption key. Encryption keys can be cycled for various reasons, this function always returns the current preferred key.