package com.talentcard.server.common;
|
|
import java.nio.charset.StandardCharsets;
|
import java.security.MessageDigest;
|
import java.security.SecureRandom;
|
import java.util.Base64;
|
|
import javax.crypto.Cipher;
|
import javax.crypto.spec.GCMParameterSpec;
|
import javax.crypto.spec.SecretKeySpec;
|
|
import org.springframework.beans.factory.annotation.Value;
|
import org.springframework.stereotype.Component;
|
|
@Component
|
public class SensitiveDataCrypto {
|
|
private static final SecureRandom RANDOM = new SecureRandom();
|
private final byte[] key;
|
|
public SensitiveDataCrypto(@Value("${app.privacy.encryption-key}") String encryptionKey) {
|
try {
|
this.key = MessageDigest.getInstance("SHA-256").digest(encryptionKey.getBytes(StandardCharsets.UTF_8));
|
} catch (Exception exception) {
|
throw new IllegalStateException("Unable to initialize sensitive-data encryption", exception);
|
}
|
}
|
|
public String encrypt(String plainText) {
|
if (plainText == null || plainText.isBlank()) return "";
|
try {
|
byte[] iv = new byte[12];
|
RANDOM.nextBytes(iv);
|
Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
|
cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, "AES"), new GCMParameterSpec(128, iv));
|
byte[] encrypted = cipher.doFinal(plainText.getBytes(StandardCharsets.UTF_8));
|
byte[] payload = new byte[iv.length + encrypted.length];
|
System.arraycopy(iv, 0, payload, 0, iv.length);
|
System.arraycopy(encrypted, 0, payload, iv.length, encrypted.length);
|
return "v1:" + Base64.getUrlEncoder().withoutPadding().encodeToString(payload);
|
} catch (Exception exception) {
|
throw new BusinessException(ErrorCode.INTERNAL_ERROR, "敏感信息加密失败");
|
}
|
}
|
}
|
