Criptografia em rest e transit: do TLS 1.3 ao envelope encryption

# TLS 1.3 only (em 2026 já dá pra exigir)
ssl_protocols TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256;
ssl_prefer_server_ciphers off;       # TLS 1.3 client preference
ssl_session_tickets off;             # forward secrecy
ssl_stapling on;
ssl_stapling_verify on;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
# Mozilla Modern: https://ssl-config.mozilla.org/

import { KMSClient, GenerateDataKeyCommand, DecryptCommand } from '@aws-sdk/client-kms';
import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';

const kms = new KMSClient({ region: 'sa-east-1' });
const KEK_ARN = process.env.KMS_KEK_ARN!;

export interface EncryptedPayload {
  ciphertext: Buffer;
  ciphertextDek: Buffer;
  nonce: Buffer;
  tag: Buffer;
  aad?: Buffer;
}

export async function encrypt(plaintext: Buffer, aad?: Buffer): Promise<EncryptedPayload> {
  const { Plaintext, CiphertextBlob } = await kms.send(new GenerateDataKeyCommand({
    KeyId: KEK_ARN, KeySpec: 'AES_256',
  }));
  const dek = Buffer.from(Plaintext!);
  const nonce = randomBytes(12);
  const cipher = createCipheriv('aes-256-gcm', dek, nonce);
  if (aad) cipher.setAAD(aad);
  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
  const tag = cipher.getAuthTag();
  // CRITICAL: zerar DEK em memória
  dek.fill(0);
  return { ciphertext, ciphertextDek: Buffer.from(CiphertextBlob!), nonce, tag, aad };
}

export async function decrypt(p: EncryptedPayload): Promise<Buffer> {
  const { Plaintext } = await kms.send(new DecryptCommand({ CiphertextBlob: p.ciphertextDek }));
  const dek = Buffer.from(Plaintext!);
  const decipher = createDecipheriv('aes-256-gcm', dek, p.nonce);
  if (p.aad) decipher.setAAD(p.aad);
  decipher.setAuthTag(p.tag);
  const result = Buffer.concat([decipher.update(p.ciphertext), decipher.final()]);
  dek.fill(0);
  return result;
}