Verschlüsselung & Hashing

use security

// Passwort hashen (beim Registrieren)
let hash = security.hashPassword("GeheimesPasswort123");
// hash ist z.B. "$argon2id$v=19$m=4096,t=3,p=1$..."

// Passwort verifizieren (beim Login)
let isValid = security.verifyPassword("Eingabe123", hash);

if (!isValid) {
    throw HttpError.Unauthorized("Falsches Passwort");
}

use security

@POST("/register")
fn register(email: string, password: string): User {
    // Prüfen ob Email bereits existiert
    if (db.findBy(User, "email", email) != null) {
        throw HttpError.BadRequest("Email bereits registriert");
    }
    
    let user = User {
        id: utils.uuid(),
        email: email,
        passwordHash: security.hashPassword(password),
        createdAt: datetime.now(),
    };
    
    return db.save(user);
}

@POST("/login")
fn login(email: string, password: string): LoginResponse {
    let user = db.findBy(User, "email", email);
    
    if (!user || !security.verifyPassword(password, user.passwordHash)) {
        throw HttpError.Unauthorized("Falsche Zugangsdaten");
    }
    
    let token = auth.createToken({
        sub: user.id,
        exp: datetime.now().addHours(24)
    });
    
    return LoginResponse { token, user };
}

use encryption

let secretKey = config.get("ENCRYPTION_KEY");

// Verschlüsseln (AES-256-GCM)
let encrypted = encryption.aes_encrypt("Sensible Daten", secretKey);

// Entschlüsseln
let plain = encryption.aes_decrypt(encrypted, secretKey);

log.info(plain); // "Sensible Daten"

use encryption

struct UserApiKey {
    id: string,
    userId: string,
    encryptedKey: string,  // Verschlüsselt gespeichert
    name: string,
    createdAt: string,
}

@Auth
@POST("/api/keys")
fn createApiKey(name: string): ApiKeyResponse {
    let user = currentUser();
    let masterKey = config.get("ENCRYPTION_KEY");
    
    // Generiere neuen API Key
    let rawKey = utils.generateSecureKey(32);
    
    // Verschlüsseln vor dem Speichern
    let encrypted = encryption.aes_encrypt(rawKey, masterKey);
    
    let apiKey = UserApiKey {
        id: utils.uuid(),
        userId: user.id,
        encryptedKey: encrypted,
        name: name,
        createdAt: datetime.now(),
    };
    
    db.save(apiKey);
    
    // Key nur EINMAL im Klartext zurückgeben
    return ApiKeyResponse { 
        id: apiKey.id, 
        key: rawKey,  // Nur bei Erstellung!
        name: name 
    };
}

use encryption

// RSA Schlüsselpaar generieren
let keypair = encryption.rsa_generate_keypair(2048);

// Asymmetrische Verschlüsselung
let rsaEncrypted = encryption.rsa_encrypt("data", keypair.public_key);
let rsaDecrypted = encryption.rsa_decrypt(rsaEncrypted, keypair.private_key);

// Fernet (Symmetrische Verschlüsselung mit Zeitstempel)
let fernetKey = encryption.fernet_generate_key();
let fernetEncrypted = encryption.fernet_encrypt("secret", fernetKey);
let fernetDecrypted = encryption.fernet_decrypt(fernetEncrypted, fernetKey);

// Schlüsselverwaltung
encryption.store_key("user_key_1", secretKey, "main_vault");
let retrievedKey = encryption.retrieve_key("user_key_1");

// Hashing (für Checksums, nicht Passwörter!)
let shaHash = encryption.sha256("data");

// HMAC für Message Authentication
let hmac = encryption.hmac("message", secretKey);

// Sichere Zufallszahlen
let randomBytes = encryption.random_bytes(32);
let randomInt = encryption.random_int(1, 100);