pip install cryptography python-dotenv pydantic

npm install --save crypto dotenv typescript ts-node @types/node

import os
from cryptography.fernet import Fernet
from pydantic import BaseModel, EmailStr, ValidationError
from dotenv import load_dotenv

# Load environment variables
load_dotenv()

# 1. Define a strict schema for incoming data to prevent injection/malformed data
class UserDataSchema(BaseModel):
    user_id: str
    email: EmailStr
    sensitive_data: str  # This will be encrypted

class SecurityGateway:
    def __init__(self):
        # In production, fetch this from AWS KMS or HashiCorp Vault
        # NEVER hardcode keys. This is for demonstration.
        key = os.getenv("ENCRYPTION_KEY").encode()
        self.cipher = Fernet(key)

    def process_incoming_data(self, raw_data: dict):
        """
        Validates and encrypts data to ensure integrity and confidentiality.
        """
        try:
            # Step A: Schema Validation (Mitigates malformed data attacks)
            validated_data = UserDataSchema(**raw_data)
            
            # Step B: Encryption (Mitigates data breach impact)
            encrypted_payload = self._encrypt_field(validated_data.sensitive_data)
            
            return {
                "user_id": validated_data.user_id,
                "email": validated_data.email,
                "encrypted_payload": encrypted_payload,
                "status": "SECURE"
            }
        except ValidationError as e:
            return {"error": "Schema Validation Failed", "details": e.errors()}
        except Exception as e:
            return {"error": "Security Processing Error", "details": str(e)}

    def _encrypt_field(self, data: str) -> str:
        return self.cipher.encrypt(data.encode()).decode()

# --- Execution Example ---
if __name__ == "__main__":
    # Generate a key once and store it in.env
    # Fernet.generate_key()
    gateway = SecurityGateway()
    
    incoming_payload = {
        "user_id": "USR-12345",
        "email": "victim@example.com",
        "sensitive_data": "SSN-000-00-0000"
    }
    
    result = gateway.process_incoming_data(incoming_payload)
    print(f"Processed Result: {result}")

import * as crypto from 'crypto';
import 'dotenv/config';

// 1. Define strict interface for data integrity
interface UserData {
    userId: string;
    email: string;
    sensitiveData: string;
}

class SecurityGateway {
    private algorithm = 'aes-256-cbc';
    private key: Buffer;
    private iv: Buffer;

    constructor() {
        // Key should be 32 bytes for AES-256
        const keyHex = process.env.ENCRYPTION_KEY;
        if (!keyHex) throw new Error("ENCRYPTION_KEY missing");
        this.key = Buffer.from(keyHex, 'hex');
        this.iv = crypto.randomBytes(16);
    }

    /**
     * Encrypts sensitive strings using AES-256-CBC
     */
    private encrypt(text: string): string {
        const cipher = crypto.createCipheriv(this.algorithm, this.key, this.iv);
        let encrypted = cipher.update(text);
        encrypted = Buffer.concat([encrypted, cipher.final()]);
        // Return IV with ciphertext so it can be decrypted later
        return iv.toString('hex') + ':' + encrypted.toString('hex');
    }

    /**
     * Validates and secures data
     */
    public async secureData(data: any): Promise<any> {
        // Basic validation (In production, use Zod or Joi)
        if (!data.userId ||!data.email ||!data.sensitiveData) {
            throw new Error("Invalid Data Schema");
        }

        return {
            userId: data.userId,
            email: data.email,
            securePayload: this.encrypt(data.sensitiveData),
            timestamp: new Date().toISOString()
        };
    }
}

// --- Execution Example ---
async function run() {
    const gateway = new SecurityGateway();
    const rawData = {
        userId: "USR-999",
        email: "user@test.com",
        sensitiveData: "CreditCard-1234-5678"
    };

    try {
        const secured = await gateway.secureData(rawData);
        console.log("Secure Data Object:", secured);
    } catch (err) {
        console.error("Security Breach Attempt Blocked:", err.message);
    }
}

run();

# Generate via: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
ENCRYPTION_KEY=your_generated_base64_key_here
# For Node.js hex format:
# ENCRYPTION_KEY=64_character_hex_string