1 files changed, 52 insertions, 2 deletions
diff --git a/lib/app.js b/lib/app.js
index 1705d1c..5cc4e62 100644
--- a/lib/app.js
+++ b/lib/app.js
@@ -14,6 +14,10 @@ var Git = require('./git')
 var cat = require('pull-cat')
 var proc = require('child_process')
 var toPull = require('stream-to-pull-stream')
+var BoxStream = require('pull-box-stream')
+var crypto = require('crypto')
+
+var zeros = new Buffer(24); zeros.fill(0)
 
 module.exports = App
 
@@ -198,8 +202,54 @@ App.prototype.wantSizeBlob = function (id, cb) {
   })
 }
 
-App.prototype.addBlob = function (cb) {
-  return this.sbot.blobs.add(cb)
+App.prototype.addBlobRaw = function (cb) {
+  var done = multicb({pluck: 1, spread: true})
+  var sink = pull(
+    u.pullLength(done()),
+    this.sbot.blobs.add(done())
+  )
+  done(function (err, size, hash) {
+    if (err) return cb(err)
+    cb(null, {link: hash, size: size})
+  })
+  return sink
+}
+
+App.prototype.addBlob = function (isPrivate, cb) {
+  if (!isPrivate) return this.addBlobRaw(cb)
+  else return this.addBlobPrivate(cb)
+}
+
+App.prototype.addBlobPrivate = function (cb) {
+  var bufs = []
+  var self = this
+  // use the hash of the cleartext as the key to encrypt the blob
+  var hash = crypto.createHash('sha256')
+  return pull.drain(function (buf) {
+    bufs.push(buf)
+    hash.update(buf)
+  }, function (err) {
+    if (err) return cb(err)
+    var secret = hash.digest()
+    pull(
+      pull.values(bufs),
+      BoxStream.createBoxStream(secret, zeros),
+      self.addBlobRaw(function (err, link) {
+        if (err) return cb(err)
+        link.key = secret.toString('base64')
+        cb(null, link)
+      })
+    )
+  })
+}
+
+App.prototype.getBlob = function (id, key) {
+  if (!key) return this.sbot.blobs.get(id)
+  if (typeof key === 'string') key = new Buffer(key, 'base64')
+  return pull(
+    this.sbot.blobs.get(id),
+    BoxStream.createUnboxStream(key, zeros)
+  )
 }
 
 App.prototype.pushBlob = function (id, cb) {