const crypto = require('crypto');
 
/**
 * Cashonrails encryption module for securing API payloads
 * @module cashonrails-encryption
 */
 
/**
 * Encrypt payload using AES-256-GCM
 * @param {Object} plaintext - The payload to encrypt
 * @param {string} encryptionKey - Your Cashonrails encryption key
 * @returns {string} Base64 encoded encrypted payload
 */
function encrypt(plaintext, encryptionKey) {
    const algorithm = 'aes-256-gcm';
    const iv = crypto.randomBytes(16);
    const key = Buffer.from(encryptionKey, 'utf8');
    
    const cipher = crypto.createCipheriv(algorithm, key, iv);
    cipher.setAAD(Buffer.alloc(0)); // Empty AAD
    
    const serializedData = JSON.stringify(plaintext);
    let encrypted = cipher.update(serializedData, 'utf8', 'base64');
    encrypted += cipher.final('base64');
    
    const tag = cipher.getAuthTag();
    
    const encryptionObject = {
        iv: iv.toString('base64'),
        value: encrypted,
        mac: '',
        tag: tag.toString('base64')
    };
    
    return Buffer.from(JSON.stringify(encryptionObject)).toString('base64');
}
 
/**
 * Decrypt response using AES-256-GCM
 * @param {string} cipherInput - Base64 encoded encrypted response
 * @param {string} encryptionKey - Your Cashonrails encryption key
 * @returns {Object} Decrypted response object
 */
function decrypt(cipherInput, encryptionKey) {
    const algorithm = 'aes-256-gcm';
    const key = Buffer.from(encryptionKey, 'utf8');
    
    const raw = Buffer.from(cipherInput, 'base64').toString('utf8');
    const obj = JSON.parse(raw);
    
    const iv = Buffer.from(obj.iv, 'base64');
    const tag = Buffer.from(obj.tag, 'base64');
    const ciphertext = obj.value;
    
    const decipher = crypto.createDecipheriv(algorithm, key, iv);
    decipher.setAAD(Buffer.alloc(0)); // Empty AAD
    decipher.setAuthTag(tag);
    
    let decrypted = decipher.update(ciphertext, 'base64', 'utf8');
    decrypted += decipher.final('utf8');
    
    return JSON.parse(decrypted);
}
 
// Export the functions if using as a module
module.exports = { encrypt, decrypt };
 
// Usage Example
const encryptionKey = 'your-encryption-key';
 
const payload = {
    Account_number: "0232983020",
    account_name: "Owolana Ayomide",
    bank_code: "000013",
    Amount: "100",
    currency: "NGN",
    sender_name: "John",
    narration: "John",
    reference: "VRZ-PYO-6834885B6E334-1748273243"
};
 
const encryptedPayload = encrypt(payload, encryptionKey);
console.log('Encrypted:', encryptedPayload);
 
// For decrypting responses
const decryptedResponse = decrypt(encryptedResponseFromAPI, encryptionKey);
console.log('Decrypted:', decryptedResponse);

<?php
 
namespace App\Services;
 
/**
 * Cashonrails encryption service for Laravel applications
 */
class CashOnRailsEncryption
{
    /**
     * Your Cashonrails encryption key
     * You should store this in your .env file
     */
    protected $encryptionKey;
    
    /**
     * Constructor
     */
    public function __construct()
    {
        $this->encryptionKey = config('cashonrails.encryption_key');
    }
    
    /**
     * Encrypt payload using AES-256-GCM
     *
     * @param mixed $plaintext The payload to encrypt
     * @return string Base64 encoded encrypted payload
     */
    public function encrypt($plaintext)
    {
        $key = $this->encryptionKey;
        $aad = ''; // Additional authenticated data (empty in this case)
 
        $cipher = 'aes-256-gcm'; // encryption algorithm
        $ivlen = openssl_cipher_iv_length($cipher); 
        $iv = openssl_random_pseudo_bytes($ivlen); // generate a random initialization vector
 
        $tag = ''; // The tag will be filled by openssl_encrypt
        $ciphertext = openssl_encrypt(
            serialize($plaintext), // Serialize the data for encryption
            $cipher,              // Encryption algorithm
            $key,                 // Your Cashonrails encryption key
            0,                    // Encryption options
            $iv,                  // Initialization vector
            $tag,                 // Authentication tag (output)
            $aad,                 // Additional authenticated data
            16                    // Tag length
        );
 
        // Create the encryption object in the format Cashonrails expects
        $encryptionObject = json_encode([
            "iv" => base64_encode($iv),
            "value" => $ciphertext,
            "mac" => "",
            "tag" => base64_encode($tag)
        ]);
        
        // Return the Base64 encoded encryption object
        return base64_encode($encryptionObject);
    }
    
    /**
     * Decrypt response using AES-256-GCM
     *
     * @param string $cipherInput Base64 encoded encrypted response
     * @return mixed Decrypted response
     * @throws \Exception When decryption fails
     */
    public function decrypt($cipherInput)
    {
        $key = $this->encryptionKey;
        $aad = '';
        $cipher = 'aes-256-gcm';
        
        // Decode the base64 input
        $raw = base64_decode($cipherInput);
        $obj = json_decode($raw);
        
        if (!$obj || !isset($obj->iv) || !isset($obj->value) || !isset($obj->tag)) {
            throw new \Exception("Invalid encrypted payload format");
        }
 
        // Extract components needed for decryption
        $iv = base64_decode($obj->iv);
        $tag = base64_decode($obj->tag);
        $ciphertext = $obj->value;
        
        // Perform decryption
        $data = openssl_decrypt(
            $ciphertext,
            $cipher,
            $key,
            0,
            $iv,
            $tag,
            $aad
        );
 
        if ($data === false) {
            throw new \Exception("Decryption failed. Check your encryption key.");
        }
 
        // Unserialize the decrypted data
        return unserialize($data);
    }
}
 
<?php
// config/cashonrails.php
return [
    'encryption_key' => env('CASHONRAILS_ENCRYPTION_KEY', ''),
    'api_key' => env('CASHONRAILS_API_KEY', ''),
    'api_url' => env('CASHONRAILS_API_URL', 'https://api.cashonrails.com'),
];
 
// In .env file
CASHONRAILS_ENCRYPTION_KEY=your-32-byte-encryption-key
?>
 
 
<?php
// In your controller
public function initiateTransfer(Request $request)
{
    $payload = [
        'Account_number' => $request->account_number,
        'account_name' => $request->account_name,
        'bank_code' => $request->bank_code,
        'Amount' => $request->amount,
        'currency' => 'NGN',
        'sender_name' => $request->sender_name,
        'narration' => $request->narration,
        'reference' => $this->generateReference(), // Your reference generator
    ];
    
    $encryptionService = app(CashOnRailsEncryption::class);
    $encryptedPayload = $encryptionService->encrypt($payload);
    
    $response = Http::withHeaders([
        'Authorization' => 'Bearer ' . config('cashonrails.api_key'),
        'Content-Type' => 'application/json',
        'X-Encrypted-Payload' => 'true',
        'X-Encrypt-Response' => 'true',
    ])->post(config('cashonrails.api_url') . '/v1/transfers', $encryptedPayload);
    
    if ($response->successful()) {
        $decryptedResponse = $encryptionService->decrypt($response->body());
        return response()->json($decryptedResponse);
    }
    
    return response()->json(['error' => 'Transfer initiation failed'], 500);
}
?>