Полный продакшен-рефактор fix25: split peer/admin, удаление legacy, шифрование secret, auth_id, новые API/роуты и зачистка subscription

apps/util/encrypt.go

@@ -1,11 +1,16 @@
 package util
 
 import (
+	"crypto/aes"
+	"crypto/cipher"
 	"crypto/hmac"
+	"crypto/rand"
 	"crypto/sha256"
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"os"
+	"io"
 	"strings"
 
 	"golang.org/x/crypto/bcrypt"
@@ -56,6 +61,69 @@ func HmacSHA256Hex(payload string, secret string) string {
 	return str
 }
 
+
+func DecodeBase64Key(raw string, expectedLen int) ([]byte, error) {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return nil, errors.New("empty key")
+	}
+	decoded, err := base64.StdEncoding.DecodeString(raw)
+	if err != nil {
+		return nil, err
+	}
+	if len(decoded) != expectedLen {
+		return nil, fmt.Errorf("invalid key length: expected %d, got %d", expectedLen, len(decoded))
+	}
+	return decoded, nil
+}
+
+func EncryptAESGCM(plainText string, key []byte) (string, error) {
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err = io.ReadFull(rand.Reader, nonce); err != nil {
+		return "", err
+	}
+	cipherText := gcm.Seal(nil, nonce, []byte(plainText), nil)
+	payload := append(nonce, cipherText...)
+	return "v1:" + base64.StdEncoding.EncodeToString(payload), nil
+}
+
+func DecryptAESGCM(cipherText string, key []byte) (string, error) {
+	if !strings.HasPrefix(cipherText, "v1:") {
+		return "", errors.New("unsupported ciphertext version")
+	}
+	encoded := strings.TrimPrefix(cipherText, "v1:")
+	payload, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil {
+		return "", err
+	}
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return "", err
+	}
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return "", err
+	}
+	nonceSize := gcm.NonceSize()
+	if len(payload) < nonceSize {
+		return "", errors.New("invalid ciphertext")
+	}
+	nonce, enc := payload[:nonceSize], payload[nonceSize:]
+	plain, err := gcm.Open(nil, nonce, enc, nil)
+	if err != nil {
+		return "", err
+	}
+	return string(plain), nil
+}
+
 func PeerSecretDigest(rawSecret string) string {
 	secretKey := strings.TrimSpace(os.Getenv("HY2XS_PEER_SECRET_KEY"))
 	if secretKey == "" {