feat(iam): encrypt password at the client before sending the HTTP request

.github/workflows/build-docker-image.yml

@@ -92,6 +92,7 @@ jobs:
             NEXT_PUBLIC_SITE_KEY=${{ secrets.NEXT_PUBLIC_SITE_KEY }}
             NEXT_PUBLIC_PHOTO_API=${{ secrets.NEXT_PUBLIC_PHOTO_API }}
             NEXT_PUBLIC_PHOTO_API_KEY=${{ secrets.NEXT_PUBLIC_PHOTO_API_KEY }}
+            NEXT_PUBLIC_CRYPTO_KEY=${{ secrets.NEXT_PUBLIC_CRYPTO_KEY }}
           # To improve build speeds, for each branch we push an additional image to the registry,
           # to be used as the caching layer, using the `max` caching mode.
           #
@@ -106,4 +107,4 @@ jobs:
             type=registry,ref=${{ inputs.registry }}/${{ inputs.app_name }}:${{ env.GITHUB_REF_SLUG_URL }}-cache
             type=registry,ref=${{ inputs.registry }}/${{ inputs.app_name }}:${{ github.event.repository.default_branch }}-cache
           cache-to: |
-            type=registry,ref=${{ inputs.registry }}/${{ inputs.app_name }}:${{ env.GITHUB_REF_SLUG_URL }}-cache,mode=max
+            type=registry,ref=${{ inputs.registry }}/${{ inputs.app_name }}:${{ env.GITHUB_REF_SLUG_URL }}-cache,mode=min

.github/workflows/cloudrun-deploy.yml

@@ -36,7 +36,7 @@ jobs:
 
   deploy:
     name: Deploy to Cloud Run
-    needs: ["versioning"]
+    needs: ['versioning']
     timeout-minutes: 10
     runs-on: ubuntu-latest
     permissions:
@@ -73,6 +73,7 @@ jobs:
             NEXT_PUBLIC_PHOTO_API=${{ secrets.NEXT_PUBLIC_PHOTO_API }},
             NEXT_PUBLIC_PHOTO_API_KEY=${{ secrets.NEXT_PUBLIC_PHOTO_API_KEY }},
             NEXT_PUBLIC_COOKIE_KEY=${{ secrets.NEXT_PUBLIC_COOKIE_KEY }},
+            NEXT_PUBLIC_CRYPTO_KEY=${{ secrets.NEXT_PUBLIC_CRYPTO_KEY }},
 
       - name: Allow unauthenticated calls to the service
         run: |

Dockerfile

@@ -35,6 +35,9 @@ ENV NEXT_PUBLIC_CEDULA_API_KEY=${NEXT_PUBLIC_CEDULA_API_KEY}
 ARG NEXT_PUBLIC_SITE_KEY
 ENV NEXT_PUBLIC_SITE_KEY=${NEXT_PUBLIC_SITE_KEY}
 
+ARG NEXT_PUBLIC_CRYPTO_KEY
+ENV NEXT_PUBLIC_CRYPTO_KEY=${NEXT_PUBLIC_CRYPTO_KEY}
+
 # ===================== Install Deps =====================
 FROM base as deps
 

next.config.js

@@ -7,7 +7,8 @@ const nextConfig = {
     NEXT_PUBLIC_CEDULA_API: process.env.NEXT_PUBLIC_CEDULA_API,
     NEXT_PUBLIC_CEDULA_API_KEY: process.env.NEXT_PUBLIC_CEDULA_API_KEY,
     NEXT_PUBLIC_SITE_KEY: process.env.NEXT_PUBLIC_SITE_KEY,
-    NEXT_PUBLIC_COOKIE_KEY: process.env.NEXT_PUBLIC_COOKIE_KEY
+    NEXT_PUBLIC_COOKIE_KEY: process.env.NEXT_PUBLIC_COOKIE_KEY,
+    NEXT_PUBLIC_CRYPTO_KEY: process.env.NEXT_PUBLIC_CRYPTO_KEY
   },
   reactStrictMode: false,
   output: 'standalone'

package.json

@@ -25,6 +25,7 @@
     "axios": "^1.4.0",
     "check-password-strength": "^2.0.7",
     "cookie": "^0.5.0",
+    "cryptr": "^6.2.0",
     "eslint": "^8.40.0",
     "eslint-config-next": "13.2.3",
     "next": "13.2.3",

src/helpers/cryptr.ts

@@ -0,0 +1,22 @@
+import getConfig from 'next/config';
+import Cryptr from 'cryptr';
+
+const DEFAULT_KEY = 'sf_d23424bdsdfkj@f42e@wdn5fgsdfdm**2asbn!d';
+const { publicRuntimeConfig } = getConfig();
+const NEXT_PUBLIC_CRYPTO_KEY =
+  publicRuntimeConfig.NEXT_PUBLIC_CRYPTO_KEY || DEFAULT_KEY;
+
+const cryptr = new Cryptr(NEXT_PUBLIC_CRYPTO_KEY, {
+  pbkdf2Iterations: 10000,
+  saltLength: 10,
+});
+
+export class Crypto {
+  static encrypt(str: string): string {
+    return cryptr.encrypt(str);
+  }
+
+  static decrypt(token: string): string {
+    return cryptr.decrypt(token);
+  }
+}

src/helpers/index.ts

@@ -1 +1,2 @@
 export { getRekognitionClient } from './rekognition';
+export { Crypto } from './cryptr';

src/pages/api/iam/index.ts

@@ -5,6 +5,7 @@ import {
   CitizensBasicInformationResponse,
   VerifyIamUserResponse,
 } from '../types';
+import { Crypto } from '@/helpers';
 
 export default async function handler(
   req: NextApiRequest,
@@ -29,7 +30,8 @@ export default async function handler(
     return res.status(200).json(data);
   } else if (req.method === 'POST') {
     const { body } = req;
-    const { username, email, password } = body;
+    const { username, email } = body;
+    const password = Crypto.decrypt(body.password);
 
     let success = true;
     let statusCode = 201;

src/pages/register/stepper/step3.tsx

@@ -1,19 +1,20 @@
+import { passwordStrength } from 'check-password-strength';
 import { yupResolver } from '@hookform/resolvers/yup';
 import { useForm } from 'react-hook-form';
 import { useState } from 'react';
 import * as yup from 'yup';
 import axios from 'axios';
-import { passwordStrength } from 'check-password-strength';
 
 import { AlertError, AlertWarning } from '@/components/elements/alert';
 import { GridContainer, GridItem } from '@/components/elements/grid';
 import LoadingBackdrop from '@/components/elements/loadingBackdrop';
+import PasswordLevel from '@/components/elements/passwordLevel';
 import { TextBody } from '@/components/elements/typography';
 import { FormControlApp } from '@/components/form/input';
 import { ButtonApp } from '@/components/elements/button';
 import { InputApp } from '@/themes/form/input';
 import { labels } from '@/constants/labels';
-import PasswordLevel from '@/components/elements/passwordLevel';
+import { Crypto } from '@/helpers';
 
 interface IFormInputs {
   email: string;
@@ -65,11 +66,13 @@ export default function Step3({ handleNext, infoCedula }: any) {
     if (passwordLevel.id !== 3) return;
     setLoading(true);
 
+    const password = Crypto.encrypt(data.password);
+
     axios
       .post('/api/iam', {
         email: data.email,
         username: infoCedula.id,
-        password: data.password,
+        password,
       })
       .then(() => {
         handleNext();

yarn.lock

@@ -7294,6 +7294,11 @@ cross-spawn@^7.0.2, cross-spawn@^7.0.3:
     shebang-command "^2.0.0"
     which "^2.0.1"
 
+cryptr@^6.2.0:
+  version "6.2.0"
+  resolved "https://registry.yarnpkg.com/cryptr/-/cryptr-6.2.0.tgz#30dd4754447f9f5d18d5ea8a8dfbae08f00e5cbb"
+  integrity sha512-jYi8SxvOFebTT7EYOABiPpHKY6lwWaP9IVcvT/aIVJUVoFdzTgi0ySPCL78q1ig8w2kwfXFCZACXoCXaye57aw==
+
 csscolorparser@~1.0.3:
   version "1.0.3"
   resolved "https://registry.yarnpkg.com/csscolorparser/-/csscolorparser-1.0.3.tgz#b34f391eea4da8f3e98231e2ccd8df9c041f171b"