IEncryptionProvider Interface

The pluggable cipher adapter interface used by the Katlux encryption pipeline. Implement this interface to replace the built-in CWebCryptoEncryptionProvider (AES-256-GCM) with a custom algorithm — HSM-backed encryption, ChaCha20-Poly1305, RSA-OAEP, or a completely custom scheme.

🔒 CWebCryptoEncryptionProvider (Built-in) · 🏛️ AEncryptionProvider (Base Class) · 📋 IProviderEncryptionOptions · 📖 Encryption Guide

Custom Cipher Adapter

Implement both encrypt and decrypt methods directly, or extend AEncryptionProvider to inherit key-management utilities, then pass the instance via the customProvider option in IProviderEncryptionOptions:

import type { IEncryptionProvider, IEncryptedPayload } from '@katlux/providers'

class MyHSMEncryptionProvider implements IEncryptionProvider {
  async encrypt(data: any): Promise<IEncryptedPayload> {
    const json = JSON.stringify(data)
    const { ciphertext, iv } = await callHSMApi('encrypt', json)
    return { __encrypted: true, ciphertext, iv, alg: 'HSM-AES256' }
  }

  async decrypt(payload: IEncryptedPayload): Promise<any> {
    const json = await callHSMApi('decrypt', payload.ciphertext, payload.iv)
    return JSON.parse(json)
  }
}

const provider = new CAPIFlatClientDataProvider({
  encryption: {
    enabled: true,
    customProvider: new MyHSMEncryptionProvider()
  }
})