Add full monorepo: virtual-banker, backend, frontend, docs, scripts, deployment

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/security/kms.go

@@ -0,0 +1,38 @@
+package security
+
+import (
+	"context"
+)
+
+// KMS handles key management
+type KMS struct {
+	provider KMSProvider
+}
+
+// NewKMS creates a new KMS handler
+func NewKMS(provider KMSProvider) *KMS {
+	return &KMS{provider: provider}
+}
+
+// KMSProvider interface for key management
+type KMSProvider interface {
+	Encrypt(ctx context.Context, keyID string, data []byte) ([]byte, error)
+	Decrypt(ctx context.Context, keyID string, encrypted []byte) ([]byte, error)
+	Sign(ctx context.Context, keyID string, data []byte) ([]byte, error)
+}
+
+// Encrypt encrypts data using KMS
+func (k *KMS) Encrypt(ctx context.Context, keyID string, data []byte) ([]byte, error) {
+	return k.provider.Encrypt(ctx, keyID, data)
+}
+
+// Decrypt decrypts data using KMS
+func (k *KMS) Decrypt(ctx context.Context, keyID string, encrypted []byte) ([]byte, error) {
+	return k.provider.Decrypt(ctx, keyID, encrypted)
+}
+
+// Sign signs data using KMS
+func (k *KMS) Sign(ctx context.Context, keyID string, data []byte) ([]byte, error) {
+	return k.provider.Sign(ctx, keyID, data)
+}
+

backend/security/privacy/tokenizer.go

@@ -0,0 +1,81 @@
+package privacy
+
+import (
+	"context"
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"fmt"
+	"io"
+)
+
+// Tokenizer handles PII tokenization and encryption
+type Tokenizer struct {
+	key []byte
+}
+
+// NewTokenizer creates a new tokenizer
+func NewTokenizer(key []byte) (*Tokenizer, error) {
+	if len(key) != 32 {
+		return nil, fmt.Errorf("key must be 32 bytes")
+	}
+	return &Tokenizer{key: key}, nil
+}
+
+// Encrypt encrypts sensitive data
+func (t *Tokenizer) Encrypt(ctx context.Context, plaintext []byte) ([]byte, error) {
+	block, err := aes.NewCipher(t.key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create cipher: %w", err)
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create GCM: %w", err)
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, fmt.Errorf("failed to generate nonce: %w", err)
+	}
+
+	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
+	return ciphertext, nil
+}
+
+// Decrypt decrypts sensitive data
+func (t *Tokenizer) Decrypt(ctx context.Context, ciphertext []byte) ([]byte, error) {
+	block, err := aes.NewCipher(t.key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create cipher: %w", err)
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create GCM: %w", err)
+	}
+
+	nonceSize := gcm.NonceSize()
+	if len(ciphertext) < nonceSize {
+		return nil, fmt.Errorf("ciphertext too short")
+	}
+
+	nonce, ciphertext := ciphertext[:nonceSize], ciphertext[nonceSize:]
+	plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decrypt: %w", err)
+	}
+
+	return plaintext, nil
+}
+
+// Tokenize creates a token for PII
+func (t *Tokenizer) Tokenize(ctx context.Context, pii string) (string, error) {
+	encrypted, err := t.Encrypt(ctx, []byte(pii))
+	if err != nil {
+		return "", err
+	}
+	// Return base64 encoded token
+	return fmt.Sprintf("tok_%x", encrypted), nil
+}
+