pip install cryptography python-dotenv

npm install dotenv
# For modern web apps, Web Crypto API is built-in

import os
from cryptography.fernet import Fernet
from dotenv import load_dotenv

# Load environment variables
load_dotenv()

class SecureHealthDataVault:
    def __init__(self, user_derived_key: bytes):
        """
        Initializes the vault using a key derived from the user's password.
        The server NEVER stores this key in plain text.
        """
        try:
            self.cipher = Fernet(user_derived_key)
        except Exception as e:
            raise ValueError("Invalid Key Format. Ensure key is 32 url-safe base32-encoded bytes.") from e

    def encrypt_sensitive_data(self, data_string: str) -> bytes:
        """Encrypts health data (e.g., 'Period Started: 2023-10-01')"""
        if not data_string:
            raise ValueError("Data to encrypt cannot be empty")
        
        return self.cipher.encrypt(data_string.encode())

    def decrypt_sensitive_data(self, encrypted_data: bytes) -> str:
        """Decrypts data for the user's view only."""
        try:
            return self.cipher.decrypt(encrypted_data).decode()
        except Exception:
            return "ERROR: Decryption failed. Invalid key or corrupted data."

# --- TEST SUITE ---
if __name__ == "__main__":
    # In production, this key is derived via PBKDF2 from the user's password
    # It is sent from the client and never stored on the server's disk
    mock_user_key = Fernet.generate_key()
    
    vault = SecureHealthDataVault(mock_user_key)
    
    # The sensitive data the user entered in the app
    sensitive_input = "Cycle Start: 2023-10-25, Flow: Heavy, Mood: Anxious"
    
    print(f"Original Data: {sensitive_input}")
    
    # 1. Encrypting for storage
    encrypted_blob = vault.encrypt_sensitive_data(sensitive_input)
    print(f"Encrypted (What goes in Database): {encrypted_blob.hex()[:50]}...")
    
    # 2. Decrypting for the user
    decrypted_output = vault.decrypt_sensitive_data(encrypted_blob)
    print(f"Decrypted (What user sees): {decrypted_output}")

/**
 * Client-Side Privacy Module
 * Ensures health data is encrypted before transmission.
 */

// Note: In a real browser app, use the Web Crypto API.
// This example uses a simplified approach for demonstration.
import { Buffer } from 'buffer'; // Use standard crypto in browsers

export class PrivacyEngine {
  private key: CryptoKey;

  /**
   * Generates a key from a user's password using PBKDF2
   * This ensures the server never sees the raw password or the raw data.
   */
  async deriveKeyFromPassword(password: string, salt: Uint8Array): Promise<void> {
    const encoder = new TextEncoder();
    const baseKey = await crypto.subtle.importKey(
      'raw',
      encoder.encode(password),
      'PBKDF2',
      false,
      ['deriveKey']
    );

    this.key = await crypto.subtle.deriveKey(
      {
        name: 'PBKDF2',
        salt: salt,
        iterations: 100000,
        hash: 'SHA-256',
      },
      baseKey,
      { name: 'AES-GCM', length: 256 },
      true,
      ['encrypt', 'decrypt']
    );
  }

  async encryptData(plainText: string): Promise<ArrayBuffer> {
    const encoder = new TextEncoder();
    const iv = crypto.getRandomValues(new Uint8Array(12)); // Initialization Vector
    const encrypted = await crypto.subtle.encrypt(
      { name: 'AES-GCM', iv: iv },
      this.key,
      encoder.encode(plainText)
    );

    // We must store the IV alongside the ciphertext to decrypt it later
    // Combine IV + Encrypted Data
    const combined = new Uint8Array(iv.length + encrypted.byteLength);
    combined.set(iv);
    combined.set(new Uint8Array(encrypted), iv.length);
    
    return combined.buffer;
  }
}

// --- USAGE EXAMPLE ---
async function handleFormSubmission(userPassword: string, healthData: string) {
  const engine = new PrivacyEngine();
  const salt = new Uint8Array(16); // In production, fetch this from server
  crypto.getRandomValues(salt);

  await engine.deriveKeyFromPassword(userPassword, salt);
  const encryptedBlob = await engine.encryptData(healthData);

  console.log("Ready to send to API:", encryptedBlob);
  // API.post('/sync', { data: encryptedBlob, salt: salt });
}

# DO NOT store user keys here. Only store system-level secrets.
DATABASE_URL="postgresql://user:password@localhost:5432/health_db"
SESSION_SECRET="super-secret-random-string"
ENCRYPTION_ALGORITHM="AES-256-GCM"

import hashlib

def secure_hash(email: str):
    # Use a unique salt per user in production
    salt = os.urandom(16)
    return hashlib.pbkdf2_hmac('sha256', email.encode(), salt, 100000)