Vaultrice Security Guide

import { NonLocalStorage } from '@vaultrice/sdk';

// Standard initialization provides SF 0 security by default.
// All communication is encrypted in transit (HTTPS)
// All stored data is encrypted at rest automatically
const nls = new NonLocalStorage({
  projectId: 'your-project-id',
  apiKey: 'your-api-key',
  apiSecret: 'your-api-secret'
}, 'my-public-object-id');

await nls.setItem('page_visits', 150);

import { NonLocalStorage } from '@vaultrice/sdk';

// This API key has been restricted to "https://your-app.com" in the UI.
// Even if someone steals this key, they cannot use it from another domain.
const nls = new NonLocalStorage({
  projectId: 'your-project-id',
  apiKey: 'restricted-api-key', // Only works on your domain
  apiSecret: 'your-api-secret'
}, 'my-object-id');

// This request will be rejected if made from any other domain
await nls.setItem('user_data', 'secure');

// On your trusted backend server
const objectId = 'user-profile-12345';
const keyVersion = 2;

// You implement this signing logic using your private key
const signature = signDataWithYourPrivateKey(objectId, keyVersion);

// Send the objectId, signature, and keyVersion to your client
return { objectId, signature, keyVersion };

// --- In Your Client-Side SDK ---
import { NonLocalStorage } from '@vaultrice/sdk';

// Get signature from your backend
const { objectId, signature, keyVersion } = await fetchSignatureForUser();

// Initialize the SDK with the signature from your backend
const nls = new NonLocalStorage(credentials, {
  id: objectId,
  idSignature: signature,
  idSignatureKeyVersion: keyVersion
});

// The Vaultrice API will now REJECT this request if the signature is invalid,
// even if the API key is correct.
await nls.setItem('username', 'Ada');

// --- Backend: Generate a JWT for the user ---
import jwt from 'jsonwebtoken';

const payload = { 
  sub: 'user-123', // The user's unique ID
  name: 'Alice', 
  role: 'moderator' 
};
const identityToken = jwt.sign(payload, PRIVATE_KEY, { algorithm: 'RS256' });

// --- In Your Client-Side SDK ---
import { NonLocalStorage } from '@vaultrice/sdk';

const nls = new NonLocalStorage(credentials, 'private-room-456');
const auth = { identityToken };

// Authenticate when joining the room
await nls.join({ id: 'user-123', name: 'Alice', customData: 'some-value' }, auth);

// AND authenticate when sending a message
await nls.send({ type: 'chat', text: 'Hello world!', userId: 'user-123' }, { auth });

import { NonLocalStorage } from '@vaultrice/sdk';

// If SF 3 is enabled in the UI for the 'encrypted-user-data' class,
// data is automatically encrypted with an additional layer on the server.
const userPrefs = new NonLocalStorage(credentials, {
  id: 'user-preferences-123',
  class: 'encrypted-user-data' // The class configured for At-Rest Encryption
});

// This data is encrypted transparently - no changes to your code needed
await userPrefs.setItem('theme', 'dark');
await userPrefs.setItem('api_tokens', 'sensitive-token');

import { NonLocalStorage } from '@vaultrice/sdk';

const nls = new NonLocalStorage(credentials, {
  id: 'my-secret-journal',
  passphrase: 'a-very-strong-and-secret-passphrase'
});

// Fetch initial settings. This can override the default salt length.
// If saltLength is omitted, the project's configured e2eSaltLength is used.
await nls.getEncryptionSettings({ saltLength: 16 });

// This value is encrypted on YOUR device before being sent to Vaultrice.
// Even Vaultrice cannot decrypt this data without the passphrase.
await nls.setItem('diary_entry_1', 'This is a top secret message.');
await nls.setItem('financial_data', { account: '***', balance: 50000 });