thatcher 1.0.78 → 1.0.79

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thatcher",
-  "version": "1.0.78",
+  "version": "1.0.79",
   "description": "A config-driven application framework for building data-intensive web apps without code.",
   "main": "src/index.js",
   "type": "module",

package/src/lib/busybase/store.js

@@ -196,7 +196,9 @@ export async function list(entity, where = {}, options = {}) {
     const lim = options.limit ? parseInt(options.limit, 10) : rows.length;
     rows = rows.slice(off, off + lim);
   }
-  return attachRefDisplays(entity, rows);
+  const { decryptFields } = await import('../field-encryption.js');
+  const decryptedRows = rows.map(r => decryptFields(r, spec.fields));
+  return attachRefDisplays(entity, decryptedRows);
 }
 
 export async function count(entity, where = {}, options = {}) {
@@ -227,7 +229,9 @@ export async function get(entity, id, options = {}) {
     const { permissionService } = await import('../services/permission.service.js');
     if (!permissionService.checkRowAccess(options.user, spec, row)) return null;
   }
-  const [withDisplay] = await attachRefDisplays(entity, [row]);
+  const { decryptFields } = await import('../field-encryption.js');
+  const decrypted = decryptFields(row, spec.fields);
+  const [withDisplay] = await attachRefDisplays(entity, [decrypted]);
   return withDisplay;
 }
 
@@ -255,15 +259,23 @@ export async function create(entity, data, user) {
     if (field.auto === 'uuid' && !record[key]) record[key] = genId();
     if (field.auto === 'timestamp' && !record[key]) record[key] = now();
   }
+  // Encrypt any field marked encrypted:true BEFORE the null/undefined
+  // sentinel coercion below, so a real value never reaches the insert as
+  // plaintext -- this is the single choke point every create() call passes
+  // through, so no caller needs to know the field is encrypted at all.
+  const { encryptFields } = await import('../field-encryption.js');
+  const encryptedRecord = encryptFields(record, spec.fields);
   // LanceDB cannot infer a column's type from a null on first insert; coerce any
   // null/undefined to a typed sentinel ('' for strings) so the insert schema is stable.
-  for (const k of Object.keys(record)) {
-    if (record[k] === null || record[k] === undefined) record[k] = '';
+  for (const k of Object.keys(encryptedRecord)) {
+    if (encryptedRecord[k] === null || encryptedRecord[k] === undefined) encryptedRecord[k] = '';
   }
-  unwrap(await client().from(tbl).insert(record), 'create');
+  unwrap(await client().from(tbl).insert(encryptedRecord), 'create');
   // Always return the locally-constructed record: it holds the genId we put in
   // the TEXT id column. The store's insert() may return a rowid/driver shape, so
-  // trusting `created` would hand callers the wrong id.
+  // trusting `created` would hand callers the wrong id. Return the UNENCRYPTED
+  // record -- the caller gets back plaintext, matching what get()/list() will
+  // also return after decrypting the stored ciphertext.
   return record;
 }
 
@@ -284,14 +296,19 @@ export async function create(entity, data, user) {
 // unconditional-write behaviour, unchanged for every existing caller; _version
 // is added as a new column, ignored by every reader that doesn't ask for it.
 export async function update(entity, id, data, opts = {}) {
-  specOf(entity);
+  const spec = specOf(entity);
   const tbl = tableName(entity);
 
   const existing = await get(entity, id);
   if (!existing) throw new Error(`${entity} with id ${id} not found`);
 
   const currentVersion = Number(existing._version) || 0;
-  const patch = { ...data, updated_at: now(), _version: currentVersion + 1 };
+  const { encryptFields } = await import('../field-encryption.js');
+  // Encrypt only the fields actually present in this partial update -- a
+  // caller updating an unrelated field must not force-decrypt/re-encrypt an
+  // encrypted field it never touched (encryptFields already skips fields
+  // absent from the object, so this is naturally a no-op for those).
+  const patch = encryptFields({ ...data, updated_at: now(), _version: currentVersion + 1 }, spec.fields);
   let builder = client().from(tbl).update(patch).eq('id', id);
   if (opts.expectedVersion != null) {
     builder = builder.eq('_version', opts.expectedVersion);

package/src/lib/field-encryption.js

@@ -0,0 +1,85 @@
+import crypto from 'crypto';
+
+// AES-256-GCM: authenticated encryption, so a tampered ciphertext fails
+// decryption loudly instead of silently returning corrupted plaintext. A
+// fresh random IV per value (never reused) is required for GCM's security
+// guarantee -- reusing an IV with the same key breaks confidentiality.
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const ENCRYPTED_PREFIX = 'enc:v1:';
+
+let _key = null;
+function getKey() {
+  if (_key) return _key;
+  const raw = process.env.FIELD_ENCRYPTION_KEY;
+  if (!raw) {
+    // Fail loud, never silently store plaintext under an encrypted:true field
+    // just because the operator forgot to configure a key.
+    throw new Error('FIELD_ENCRYPTION_KEY environment variable is not set; cannot encrypt/decrypt a field marked encrypted:true');
+  }
+  // Accept either a 64-char hex string or any string, hashed to a stable
+  // 32-byte key -- never echoed, never logged, this function's return value
+  // is the only place the raw key material appears in memory.
+  const key = /^[0-9a-fA-F]{64}$/.test(raw) ? Buffer.from(raw, 'hex') : crypto.createHash('sha256').update(raw).digest();
+  _key = key;
+  return _key;
+}
+
+export function encryptValue(plaintext) {
+  const key = getKey();
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
+  const serialized = typeof plaintext === 'string' ? plaintext : JSON.stringify(plaintext);
+  const ciphertext = Buffer.concat([cipher.update(serialized, 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return ENCRYPTED_PREFIX + Buffer.concat([iv, authTag, ciphertext]).toString('base64');
+}
+
+export function isEncrypted(value) {
+  return typeof value === 'string' && value.startsWith(ENCRYPTED_PREFIX);
+}
+
+export function decryptValue(stored) {
+  if (!isEncrypted(stored)) return stored;
+  const key = getKey();
+  const raw = Buffer.from(stored.slice(ENCRYPTED_PREFIX.length), 'base64');
+  const iv = raw.subarray(0, IV_LENGTH);
+  const authTag = raw.subarray(IV_LENGTH, IV_LENGTH + 16);
+  const ciphertext = raw.subarray(IV_LENGTH + 16);
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+  // setAuthTag + final() throws on any tampering (wrong key, flipped bytes,
+  // truncated ciphertext) -- this is the loud-failure guarantee; there is no
+  // catch here, a decrypt failure must propagate to the caller as an error.
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+  try {
+    return JSON.parse(decrypted);
+  } catch {
+    return decrypted;
+  }
+}
+
+// Field-def-driven encrypt of every field marked encrypted:true. Fields not
+// present in `record` or not marked are passed through unchanged.
+export function encryptFields(record, specFields) {
+  if (!specFields) return record;
+  const result = { ...record };
+  for (const [key, fieldDef] of Object.entries(specFields)) {
+    if (!fieldDef.encrypted) continue;
+    if (result[key] === undefined || result[key] === null || result[key] === '') continue;
+    if (isEncrypted(result[key])) continue; // already encrypted, don't double-wrap
+    result[key] = encryptValue(result[key]);
+  }
+  return result;
+}
+
+export function decryptFields(record, specFields) {
+  if (!record || !specFields) return record;
+  const result = { ...record };
+  for (const [key, fieldDef] of Object.entries(specFields)) {
+    if (!fieldDef.encrypted) continue;
+    if (result[key] === undefined || result[key] === null) continue;
+    result[key] = decryptValue(result[key]);
+  }
+  return result;
+}