tsmx / mongoose-aes-encryption / 25018140595

98%

master: 100%

push

github

Add searchable fields feature via HMAC shadow fields

Adds searchable: true field option that enables equality queries on
encrypted fields without weakening encryption. A __search_<fieldname>
shadow field is automatically maintained on save, containing an
HMAC-SHA-256 digest of the plaintext. The HMAC key is derived from the
master key via HKDF-SHA-256, keeping keys cryptographically separate.
The encrypted field itself retains full random-IV AES-256-GCM security.

New exports: encryptForSearch(value, { key }) for use in find() queries.
New test suite: test/searchable.test.js (22 tests).
README updated with feature docs and comparison table row.

133 of 136 branches covered (97.79%)

Branch coverage included in aggregate %.

38 of 39 new or added lines in 2 files covered. (97.44%)

126 of 127 relevant lines covered (99.21%)

459.35 hits per line