feat(fips): fips inside, AWS patch-up and docker improvements

backend/src/lib/aws/hashing.ts

@@ -0,0 +1,57 @@
+/* eslint-disable no-underscore-dangle */
+import type { SourceData } from "@smithy/types";
+import { Hash, Hmac } from "crypto";
+
+import { crypto } from "@app/lib/crypto";
+
+export class CustomAWSHasher {
+  public algorithmIdentifier: string = "sha256";
+
+  public secret: SourceData | undefined;
+
+  public hash: Hash | Hmac | undefined;
+
+  private _hash: Hash | Hmac | undefined;
+
+  constructor(secret?: SourceData) {
+    this.secret = secret;
+    this.reset();
+  }
+
+  reset() {
+    if (this.secret) {
+      // Convert any secret type to Buffer
+      let secretBuffer = this.secret as Buffer;
+      if (this.secret instanceof ArrayBuffer) {
+        secretBuffer = Buffer.from(this.secret);
+      } else if (ArrayBuffer.isView && ArrayBuffer.isView(this.secret)) {
+        secretBuffer = Buffer.from(this.secret.buffer, this.secret.byteOffset, this.secret.byteLength);
+      }
+      this._hash = crypto.rawCrypto.createHmac(this.algorithmIdentifier, secretBuffer);
+    } else {
+      this._hash = crypto.rawCrypto.createHash(this.algorithmIdentifier);
+    }
+    return this;
+  }
+
+  update(data: SourceData) {
+    // Handle all possible data types
+    let buffer: Buffer = data as Buffer;
+    if (typeof data === "string") {
+      buffer = Buffer.from(data, "utf8");
+    } else if (data instanceof ArrayBuffer) {
+      buffer = Buffer.from(data);
+    } else if (ArrayBuffer.isView && ArrayBuffer.isView(data)) {
+      buffer = Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+    }
+
+    this._hash?.update(buffer);
+    return this;
+  }
+
+  digest(): Promise<Uint8Array> {
+    const result = new Uint8Array(this._hash?.digest() || []);
+    this.reset();
+    return Promise.resolve(result);
+  }
+}

backend/src/lib/crypto/cryptography.ts

@@ -193,13 +193,12 @@ const encryptAsymmetricFipsValidated = (data: string, publicKey: string, private
     format: "der"
   });
 
-  // Generate shared secret using X25519
+  // Generate shared secret using x25519 curve
   const sharedSecret = crypto.diffieHellman({
     privateKey: privKeyObj,
     publicKey: pubKeyObj
   });
 
-  // Generate 24-byte nonce (same as NaCl)
   const nonce = crypto.randomBytes(24);
 
   // Derive 32-byte key from shared secret
@@ -209,7 +208,7 @@ const encryptAsymmetricFipsValidated = (data: string, publicKey: string, private
   const iv = nonce.subarray(0, 12);
 
   // Encrypt with AES-256-GCM
-  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+  const cipher = crypto.createCipheriv(SecretEncryptionAlgo.AES_256_GCM, key, iv);
 
   const ciphertext = cipher.update(data, "utf8");
   cipher.final();
@@ -665,7 +664,8 @@ const cryptographyFactory = () => {
       },
       constants: crypto.constants,
       X509Certificate: crypto.X509Certificate,
-      KeyObject: crypto.KeyObject
+      KeyObject: crypto.KeyObject,
+      Hash: crypto.Hash
     }
   };
 };