Encrypted URLs

https://upcdn.io/W142hJk/image/photo.jpg?enc=1.BMCyGyFk.6Kfhg5wI8t9AOaY1.tP2Q5uCTv

// Credentials (from: Bytescale Dashboard > Security > API Keys > Edit > Secure URLs)
const apiKeyId     = "****dk7S";                 // ⬅️️ REPLACE with your API Key ID
const secureUrlKey = "********************AA=="; // ⬅️️ REPLACE with your Secure URL Key

/**
 * ⬇️️ REPLACE with a constant JWK return value.
 *
 * Currently, this method generates a new JWK on each call, which will cause CDN cache misses.
 *
 * To fix:
 * 1. Run this function once to log the JWK.
 * 2. Replace the method body with a hardcoded return value, or better, load from config (see commented-out code below).
 */
async function getIvSigningKeyJwk() {
  // Example:
  // return {"key_ops":["sign","verify"],"ext":true,"kty":"oct","k":"eHtVy8zSNbg2xDLaCONo_cxSMoHCgvaCmgyK5DgNtDEVujFLg8Rnhw_EuHKjHmg1uvZoNhAkaMWXrlCF-oVCEw","alg":"HS512"}
  const key = await crypto.subtle.generateKey(
    {
      name: "HMAC",
      hash: { name: "SHA-512" },
      length: 512, // in bits
    },
    true, // extractable (so we can export it)
    ["sign", "verify"]
  );
  const jwk = await crypto.subtle.exportKey("jwk", key);
  console.log(`New JWK used for IV (FIX ME): ${JSON.stringify(jwk)}`)
  return jwk;
}

/**
 * Encrypts a Bytescale File URL using AES-GCM with deterministic IVs (to improve cache hits).
 *
 * @param fileUrl            E.g. "https://upcdn.io/W142hJk/image/example/photo.jpg?w=800&h=600"
 *                           Must be a valid URL (i.e. must already be URL encoded)."
 * @param encryptFilePath    If true, moves the file path into the query string as `path`, allowing it to be encrypted (and thus hidden).
 *                           If false, the path remains in plaintext.
 * @param ttlSeconds         How long (from now) the URL should remain valid (default: 10 minutes).
 * @param ttlIncrementSize   Rounds expiration to this interval to improve CDN caching (default: 60 seconds).
 * @returns A URL with the query string encrypted in an `enc` parameter.
 */
async function getEncryptedUrl(fileUrl, encryptFilePath, ttlSeconds = 600, ttlIncrementSize = 60) {
  if (!/^(https?:)?\/\//i.test(fileUrl)) {
    throw new Error("Invalid URL: must start with http://, https://, or //");
  }
  if (ttlSeconds < 1 || ttlSeconds > 604800) {
    throw new Error("Invalid TTL: must be between 1 second and 7 days.");
  }
  if (ttlIncrementSize < 1 || ttlIncrementSize > 604800) {
    throw new Error("Invalid TTL increment: must be between 1 second and 7 days.");
  }

  // 1. Import encryption key (AES-GCM)
  const keyData = Buffer.from(secureUrlKey, "base64"); // Bytescale URL Security Keys are Base64-encoded and decode to a valid AES key length.
  const encryptionKey = await crypto.subtle.importKey("raw", keyData, "AES-GCM", false, ["encrypt"]);

  // 2. Import IV signing key (for deterministic IV generation)
  const ivSigningKey = await crypto.subtle.importKey(
    "jwk",
    await getIvSigningKeyJwk(),
    { name: "HMAC", hash: "SHA-512" },
    false,
    ["sign"]
  );

  // 3. Calculate rounded expiration time (the 'exp' parameter is mandatory for encrypted URLs)
  const now = Math.floor(Date.now() / 1000);
  const expiration = Math.ceil((now + ttlSeconds) / ttlIncrementSize) * ttlIncrementSize;
  const expirationParam = `exp=${expiration}`;
  const urlWithExpiration = fileUrl.includes("?") ? `${fileUrl}&${expirationParam}` : `${fileUrl}?${expirationParam}`;

  // 4. Extract file path & query string
  const [baseUrl, query] = urlWithExpiration.split("?");
  const match = baseUrl.match(/((?:https?:)?\/\/(?:[^\/]+\/){3})(.*)$/);
  if (!match) {
    throw new Error("Invalid Bytescale URL format");
  }

  const fileUrlPrefix = match[1]; // E.g. "https://upcdn.io/FW25aki/image/"
  const filePath = "/" + match[2]; // E.g. "/example/photo.jpg"

  // 5. Optionally move the file path into the query string
  const finalBaseUrl = encryptFilePath ? fileUrlPrefix : baseUrl;
  const encodeForQuery = str => str.replace(/[&=]/g, c => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
  const finalQuery = encryptFilePath ? `${query}&path=${encodeForQuery(filePath)}` : query;
  const queryData = new TextEncoder().encode(finalQuery);

  // 6. Generate a deterministic IV using HMAC(urlWithExpiration)
  const ivInput = new TextEncoder().encode(urlWithExpiration);
  const fullIv = new Uint8Array(await crypto.subtle.sign("HMAC", ivSigningKey, ivInput));
  const iv = fullIv.slice(0, 12); // 96-bit IV required by AES-GCM
  const ivBase64 = Buffer.from(iv).toString("base64url");

  // 7. Encrypt the query string using AES-GCM
  const ciphertext = await crypto.subtle.encrypt(
    { name: "AES-GCM", iv, tagLength: 128 },
    encryptionKey,
    queryData
  );
  const ciphertextBase64 = Buffer.from(ciphertext).toString("base64url");

  // 8. Return the final Encrypted URL using the `enc` parameter
  const enc = `enc=1.${apiKeyId}.${ivBase64}.${ciphertextBase64}`;
  return `${finalBaseUrl}?${enc}`;
}

// Returns: "https://upcdn.io/W142hJk/image/?enc=..."
console.log(
  await getEncryptedUrl("https://upcdn.io/W142hJk/image/example.jpg?w=800&h=600", true)
);