KI-AGENT: Verschlüssele Bankverbindungen beim Import neu

backend/src/utils/crypt.ts

@@ -2,11 +2,18 @@ import crypto from "crypto";
 import {secrets} from "./secrets"
 const ALGORITHM = "aes-256-gcm";
 
+function getEncryptionKey() {
+    const key = secrets.ENCRYPTION_KEY || ""
 
+    if (!/^[a-f0-9]{64}$/i.test(key)) {
+        throw new Error("ENCRYPTION_KEY muss ein 64 Zeichen langer Hex-String sein. Beispiel: openssl rand -hex 32")
+    }
 
+    return Buffer.from(key, "hex")
+}
 
 export function encrypt(text) {
-    const ENCRYPTION_KEY = Buffer.from(secrets.ENCRYPTION_KEY, "hex");
+    const ENCRYPTION_KEY = getEncryptionKey();
     const iv = crypto.randomBytes(16);
     const cipher = crypto.createCipheriv(ALGORITHM, ENCRYPTION_KEY, iv);
 
@@ -21,7 +28,7 @@ export function encrypt(text) {
 }
 
 export function decrypt({ iv, content, tag }) {
-    const ENCRYPTION_KEY = Buffer.from(secrets.ENCRYPTION_KEY, "hex");
+    const ENCRYPTION_KEY = getEncryptionKey();
     const decipher = crypto.createDecipheriv(
         ALGORITHM,
         ENCRYPTION_KEY,