Feat/certificate (#68)

* feat: implement certificate encoding and decoding functionality with AES encryption

* feat: blank cert

* Refactor code structure for improved readability and maintainability

apps/hackathon/src/utils/aesclient.ts

@@ -0,0 +1,86 @@
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+
+function randBytes(len: number): Uint8Array {
+  const b = new Uint8Array(len);
+  crypto.getRandomValues(b);
+  return b;
+}
+
+function bufToBase64(buf: ArrayBuffer): string {
+  const bytes = new Uint8Array(buf);
+  let s = '';
+  for (let i = 0; i < bytes.length; i++) s += String.fromCharCode(bytes[i]);
+  return btoa(s);
+}
+
+function base64ToBuf(b64: string): ArrayBuffer {
+  const s = atob(b64);
+  const arr = new Uint8Array(s.length);
+  for (let i = 0; i < s.length; i++) arr[i] = s.charCodeAt(i);
+  return arr.buffer;
+}
+
+async function deriveKeyFromPassphrase(passphrase: string, salt: Uint8Array, iterations = 100_000) {
+  const passKey = await crypto.subtle.importKey(
+    'raw',
+    enc.encode(passphrase),
+    { name: 'PBKDF2' },
+    false,
+    ['deriveKey']
+  );
+
+  return crypto.subtle.deriveKey(
+    {
+      name: 'PBKDF2',
+      salt,
+      iterations,
+      hash: 'SHA-256'
+    },
+    passKey,
+    { name: 'AES-GCM', length: 256 },
+    false,
+    ['encrypt', 'decrypt']
+  );
+}
+
+/**
+ * Encrypts plaintext with passphrase -> returns base64(salt||iv||ciphertext)
+ */
+export async function encryptText(plaintext: string, passphrase: string) {
+  const salt = randBytes(16); // 128-bit salt
+  const iv = randBytes(12);   // 96-bit IV recommended for GCM
+  const key = await deriveKeyFromPassphrase(passphrase, salt);
+
+  const cipher = await crypto.subtle.encrypt(
+    { name: 'AES-GCM', iv },
+    key,
+    enc.encode(plaintext)
+  );
+
+  // concat salt + iv + ciphertext
+  const out = new Uint8Array(salt.length + iv.length + cipher.byteLength);
+  out.set(salt, 0);
+  out.set(iv, salt.length);
+  out.set(new Uint8Array(cipher), salt.length + iv.length);
+
+  return bufToBase64(out.buffer);
+}
+
+/**
+ * Decrypts base64(salt||iv||ciphertext) with passphrase -> plaintext
+ */
+export async function decryptText(b64combined: string, passphrase: string) {
+  const combined = new Uint8Array(base64ToBuf(b64combined));
+  const salt = combined.slice(0, 16);
+  const iv = combined.slice(16, 28);
+  const cipher = combined.slice(28);
+
+  const key = await deriveKeyFromPassphrase(passphrase, salt);
+  const plainBuf = await crypto.subtle.decrypt(
+    { name: 'AES-GCM', iv },
+    key,
+    cipher
+  );
+  return dec.decode(plainBuf);
+}

apps/hackathon/src/utils/certificate.ts

@@ -0,0 +1,41 @@
+import { decryptText, encryptText } from "./aesclient";
+
+const SECRET_KEY = 'imphnen-hackathon-2025';
+
+/**
+ * Encode teamId and submissionId into a certificate ID
+ * Uses base64 encoding for simple obfuscation
+ * @param teamId - The team ID
+ * @param submissionId - The submission ID
+ * @returns Encoded certificate ID
+ */
+export const encodeCertificateId = async (teamId: string, submissionId: string): Promise<string> => {
+  const combined = `${teamId}::${submissionId}`;
+  return encryptText(combined, SECRET_KEY);
+};
+
+/**
+ * Decode certificate ID back to teamId and submissionId
+ * @param certId - The encoded certificate ID
+ * @returns Object containing teamId and submissionId
+ */
+export const decodeCertificateId = async (certId: string): Promise<{ teamId: string; submissionId: string }> => {
+  try {
+    const decoded = await decryptText(certId, SECRET_KEY);
+    const [teamId, submissionId] = decoded.split('::');
+    return { teamId, submissionId };
+  } catch {
+    throw new Error('Invalid certificate ID');
+  }
+};
+
+/**
+ * For development: Create a certId using created_at timestamp
+ * @param teamId - The team ID
+ * @param createdAt - The creation timestamp
+ * @returns Encoded certificate ID
+ */
+export const encodeCertificateIdWithTimestamp = (teamId: string, createdAt: string): string => {
+  const combined = `${teamId}::${createdAt}`;
+  return Buffer.from(combined).toString('base64');
+};