Member Junction
    Preparing search index...

    Class EnvVarKeySource

    Encryption key source that retrieves keys from environment variables.

    This is the default and recommended key source for:

    • Development environments
    • Docker/Kubernetes deployments with secret injection
    • Serverless functions with environment configuration

    Keys are expected to be base64-encoded strings in the environment. The provider decodes them to raw bytes for crypto operations.

    // The provider is automatically instantiated by ClassFactory
    // based on database configuration. For manual usage:

    import { EnvVarKeySource } from '@memberjunction/encryption';

    const source = new EnvVarKeySource();

    // Check if key exists
    if (await source.KeyExists('MJ_ENCRYPTION_KEY_PII')) {
      const keyBytes = await source.GetKey('MJ_ENCRYPTION_KEY_PII');
      console.log(`Key length: ${keyBytes.length} bytes`);
    }

    Hierarchy (View Summary)

    Index

    Constructors

    constructor

    Properties

    _config

    Accessors

    SourceName

    Methods

    Dispose GetKey Initialize KeyExists ValidateConfiguration ValidateKeyAccessibility

    Constructors

    Properties

    Protected_config

    _config: EncryptionKeySourceConfig

    Configuration passed during instantiation. Contains lookupValue and any source-specific additional config.

    Accessors

    Methods

    • Optional cleanup for sources with connections or resources.

      Called during graceful shutdown to release resources. Use this for:

      • Closing vault connections
      • Releasing pooled resources
      • Flushing any pending operations

      The default implementation is a no-op for stateless sources.

      Override in subclasses that hold resources

      Returns Promise<void>

    • Retrieves key material from an environment variable.

      The environment variable should contain a base64-encoded key. For versioned keys, the version is appended with an underscore:

      • KEY_NAME for version 1 (default)
      • KEY_NAME_V2 for version 2
      • etc.

      Parameters

      • lookupValue: string

        The environment variable name

      • OptionalkeyVersion: string

        Optional version number (defaults to '1')

      Returns Promise<Buffer>

      Promise resolving to the decoded key bytes

      Error if the environment variable is not set

      Error if the value is not valid base64

      // Get current key
      const key = await source.GetKey('MJ_ENCRYPTION_KEY_PII');

      // Get specific version during rotation
      const oldKey = await source.GetKey('MJ_ENCRYPTION_KEY_PII', '1');
      const newKey = await source.GetKey('MJ_ENCRYPTION_KEY_PII', '2');
      // The above looks for MJ_ENCRYPTION_KEY_PII_V2

    • Optional async initialization for sources that need setup.

      Called once by the encryption engine before first use. Use this for:

      • Loading config files
      • Establishing connections to vault services
      • Authenticating with cloud key management
      • Caching frequently-accessed metadata

      The default implementation is a no-op for simple sources.

      Override in subclasses that need async initialization

      Returns Promise<void>

    • Validates that the encryption key in the specified environment variable is accessible and usable.

      Checks: env var exists, is non-empty, contains valid base64, and (if specified) has correct length. Key material is decoded internally for validation only — never returned to the caller.

      Parameters

      • lookupValue: string
      • OptionalkeyVersion: string
      • OptionalexpectedKeyLengthBytes: number

      Returns Promise<KeyValidationResult>

    Settings

    Member Visibility

    On This Page

    Constructors
    Properties
    Accessors
    Methods