Change the createCipher to createDecipheriv as it is deprecated

flake.nix

@@ -0,0 +1,34 @@
+{
+  description = "Postiz";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/master";
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+    }:
+    flake-utils.lib.eachDefaultSystem (
+      system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+      in
+      {
+        devShell = pkgs.mkShell {
+          nativeBuildInputs = [ pkgs.bashInteractive ];
+          buildInputs = with pkgs; [
+            nodePackages.prisma
+            nodePackages.npm
+            nodejs-slim
+          ];
+          shellHook = with pkgs; ''
+            export PRISMA_SCHEMA_ENGINE_BINARY="${prisma-engines}/bin/schema-engine"
+            export PRISMA_QUERY_ENGINE_BINARY="${prisma-engines}/bin/query-engine"
+            export PRISMA_QUERY_ENGINE_LIBRARY="${prisma-engines}/lib/libquery_engine.node"
+            export PRISMA_FMT_BINARY="${prisma-engines}/bin/prisma-fmt"
+          '';
+        };
+      }
+    );
+}

libraries/helpers/src/auth/auth.service.ts

@@ -17,12 +17,29 @@ export class AuthService {
     return verify(token, process.env.JWT_SECRET!);
   }
 
+  private static deriveKey(key: string) {
+    return Buffer.from(
+      crypto.hkdfSync(
+        'sha256',
+        key,
+        Buffer.alloc(0),
+        'FIXED-CRYPTO-FOR-SOME-REASON???',
+        32
+      )
+    );
+  }
+
   static fixedEncryption(value: string) {
     // encryption algorithm
     const algorithm = 'aes-256-cbc';
 
+    // derive a key of the correct length
+    // (assuming the JWT secret is high entropy, making the use of HKDF okay)
+    const key = AuthService.deriveKey(process.env.JWT_SECRET);
+
     // create a cipher object
-    const cipher = crypto.createCipher(algorithm, process.env.JWT_SECRET);
+    const iv = Buffer.alloc(16); // just as secure as the whole idea of using unauthenticated CBC crypto
+    const cipher = crypto.createCipheriv(algorithm, key, iv);
 
     // encrypt the plain text
     let encrypted = cipher.update(value, 'utf8', 'hex');
@@ -33,7 +50,8 @@ export class AuthService {
 
   static fixedDecryption(hash: string) {
     const algorithm = 'aes-256-cbc';
-    const decipher = crypto.createDecipher(algorithm, process.env.JWT_SECRET);
+    const key = AuthService.deriveKey(process.env.JWT_SECRET);
+    const decipher = crypto.createDecipheriv(algorithm, key, Buffer.alloc(16));
 
     // decrypt the encrypted text
     let decrypted = decipher.update(hash, 'hex', 'utf8');