Managing a card's PIN

import crypto from 'crypto';
import { readFileSync } from 'node:fs';
import { randomUUID } from 'crypto';

// pin-crypto-public.pem from GET /business/pin-crypto-key
const pem = readFileSync('pin-crypto-public.pem', 'utf8');

const sessionKey = randomUUID().replace(/-/g, ''); // 32-character hex string
const sessionKeyBase64 = Buffer.from(sessionKey, 'hex').toString('base64');
const sessionKeyBase64Buffer = Buffer.from(sessionKeyBase64, 'utf-8');

const encryptedSessionId = crypto.publicEncrypt(
  {
    key: pem,
    padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
    oaepHash: 'sha1',
  },
  sessionKeyBase64Buffer,
).toString('base64');

// sessionKey         -> save locally; AES key for encrypt/decrypt
// encryptedSessionId -> SessionId header on PIN API requests

function encryptPin(pin, sessionKey) {
  if (pin.length < 4 || pin.length > 12) {
    throw new Error('PIN must be between 4 and 12 digits');
  }

  const formattedPin = `2${pin.length.toString(16)}${pin}${'F'.repeat(14 - pin.length)}`;
  const iv = crypto.randomBytes(16);
  const key = Buffer.from(sessionKey, 'hex').slice(0, 16);
  const cipher = crypto.createCipheriv('aes-128-gcm', key, iv);
  const encrypted = Buffer.concat([cipher.update(formattedPin, 'utf8'), cipher.final()]);
  const authTag = cipher.getAuthTag();
  const encryptedWithAuthTag = Buffer.concat([encrypted, authTag]);
  const encryptedPin = encryptedWithAuthTag.toString('base64');
  const encodedIv = iv.toString('base64');

  return { encryptedPin, encodedIv };
}

POST /cards/{cardId}/pin
SessionId: <encryptedSessionId>
Content-Type: application/json

{
  "encryptedPin": {
    "iv": "<encodedIv>",
    "data": "<encryptedPin>"
  }
}

GET /cards/{cardId}/pin
SessionId: <encryptedSessionId from the same sessionKey you saved>

{
  "id": "...",
  "encryptedPin": {
    "iv": "<base64>",
    "data": "<base64>"
  }
}

function decryptPin(base64Secret, base64Iv, sessionKey) {
  const secret = Buffer.from(base64Secret, 'base64');
  const iv = Buffer.from(base64Iv, 'base64');
  const secretKey = Buffer.from(sessionKey, 'hex');

  const decipher = crypto.createDecipheriv('aes-128-gcm', secretKey, iv);
  decipher.setAutoPadding(false);

  const decrypted = decipher.update(secret).toString('utf-8');
  const retrievedPin = decrypted.substring(2, Number(decrypted[1]) + 2);

  return { decrypted, retrievedPin };
}