Skip to content
ESEN
Contact
Back to projects

Case study · File transfer API

Secure Transfer

An Express API that creates an encrypted package for file transfer and stores it through Supabase Storage.

Demo unavailable · database deleted

View code
File path
CLIENT
File + public key
SERVER · EXPRESS
Encrypt · hash · sign · package
Supabase Storage
CLIENT → API → STORAGEExplanatory diagram

Technologies

  • Node.js
  • TypeScript
  • Express
  • Supabase

SECURE_TRANSFER

Problem and scope

The repository implements a backend flow that receives a file, builds a package with cryptographic material, and stores it. The flow shown here reflects the upload operations present in the code.

Architecture and flow

The client sends the file and recipient public key to the API. On the server, the code calculates a SHA-256 hash, creates an AES-256-GCM key for the file, wraps the session key with RSA-OAEP, and signs the hash with RSA-PSS before preparing the ZIP and uploading it to Supabase.

These are operations described by the code; they do not amount to an independent security audit.

Technical decisions

The content uses authenticated AES-GCM encryption; the session key is encrypted for the recipient, and the package stores a hash and signature alongside metadata. Key handling stays server-side while the package is created.

Documented validation

The repository includes local utilities and manual checks for cryptographic primitives, plus a flow demo. They were not run here; the public demo is unavailable.

Known limits

The complete ZIP extraction function is explicitly unimplemented and throws an error. The database was deleted, no demo is available, and no security review is confirmed. Individual authorship is also unconfirmed.