Payload Encryption & SSR Security

import { CAPIFlatClientDataProvider, RequestProvider, CWebCryptoEncryptionProvider } from '@katlux/providers'

// 1. Data Provider with End-to-End Encryption & SSR Memory Guard
const customerProvider = new CAPIFlatClientDataProvider({
    idKey: 'id',
    apiUrl: '/api/customers',
    encryption: {
        enabled: true,
        key: () => useAuth().getSessionSecret(), // Dynamic async key
        decryptOnSSR: false                      // Prevents plaintext in server memory
    }
})

// 2. Direct RequestProvider Outbound/Inbound Encryption using CWebCryptoEncryptionProvider
const requestProvider = new RequestProvider()
requestProvider.setEncryption({
    enabled: true,
    key: () => useAuth().getSessionSecret(), // Obtain dynamically from authenticated session
    // Custom cipher instance implementing IEncryptionProvider:
    // customProvider: new CWebCryptoEncryptionProvider('passphrase')
})

// Outbound mutations (POST/PUT/PATCH) are automatically encrypted
await requestProvider.request('/api/customers', {
    method: 'POST',
    body: { name: 'Alice Smith', balance: 50000 }
})

import { CKeyManager, CWebCryptoEncryptionProvider } from '@katlux/providers'

// 1. Account Creation: Generate high-entropy Account Data Encryption Key (ADEK)
const adek = await CKeyManager.generateAccountDataKey()

// 2. Wrap ADEK for each authorized user's public key
const userAPair = await CKeyManager.generateRSAKeyPair(2048)
const userBPair = await CKeyManager.generateRSAKeyPair(2048)

const wrappedForUserA = await CKeyManager.wrapAccountKeyForUser(adek, userAPair.publicKey)
const wrappedForUserB = await CKeyManager.wrapAccountKeyForUser(adek, userBPair.publicKey)

// 3. User A inserts customer record encrypted with ADEK (pure whitelist fields)
const providerA = new CWebCryptoEncryptionProvider(adek)
const encryptedRecord = await providerA.encrypt(
    { id: 101, name: 'Alice Enterprise', ssn: '999-00-1234', revenue: 5000000 },
    { fields: ['ssn', 'revenue'] }
)

// 4. User B logs in, unwraps ADEK using their own private key
const userB_ADEK = await CKeyManager.unwrapAccountKeyForUser(wrappedForUserB, userBPair.privateKey)
const providerB = new CWebCryptoEncryptionProvider(userB_ADEK)

// 5. User B decrypts record seamlessly
const decryptedRecord = await providerB.decrypt(encryptedRecord, { fields: ['ssn', 'revenue'] })
// Result: ssn and revenue restored with 100% fidelity; id remains queryable plaintext

import { CFlatClientDataProvider, CTreeClientDataProvider } from '@katlux/providers'

// 1. Local Flat Client DataProvider with Field-Level Encryption & Blind Index Search
const customerProvider = new CFlatClientDataProvider({
    idKey: 'id',
    pageSize: 10,
    encryption: {
        enabled: true,
        key: 'master-tenant-secret-key-32b!',
        fields: ['name', 'ssn'],
        searchIndex: true // Enables search/filter on encrypted fields
    }
})

// 2. Eager Encryption on Ingest: allData holds ciphertext, pageData is decrypted
await customerProvider.setData([
    { id: 1, name: 'Alice Smith', ssn: '123-45-6789', role: 'Admin' },
    { id: 2, name: 'Bob Jones',   ssn: '987-65-4321', role: 'User'  }
])

// 3. Chunked Ingestion for Large Datasets (Non-Blocking UI Thread)
await customerProvider.setDataChunked(tenThousandRecords, {
    chunkSize: 1000,
    onProgress: (p) => console.log(`Encrypted ${p.percent}%`)
})

// 4. Exact Match and Substring Search on Encrypted Fields
customerProvider.setFilter({
    operator: '==',
    field: { name: 'Alice Smith' },
    active: true
})
await customerProvider.loadPageData()