Ability to encrypt custom field / config arg data at rest

[michaelbromley]

Is your feature request related to a problem? Please describe.
Some data which is stored as config args or custom fields might be sensitive and would benefit from being stored encrypted in the DB.
For instance, the API keys of a payment plugin.

Describe the solution you'd like
I will investigate the feasibility of a new property on custom fields and configurable operation args, encrypt: true which uses some kind of symmetric encryption using a secret key (provided by an env var) to encrypt/decrypt these values on save/load.

Describe alternatives you've considered
Storing the values as env vars in the first place. This limits the utility of certain functions, e.g. we cannot then have channel-aware payment methods using different api keys for the same payment service.

[oroce]

hey, i wanted to chime in, we did something similar (not for custom fields for on our entities where we had to store passwords for an external invoicing integration).

We took leverage of the AfterLoad, BeforeInsert + BeforeUpdate. I hope it helps.

import Cryptr from 'cryptr';
import { AfterLoad, BeforeInsert, BeforeUpdate, Column, Entity } from 'typeorm';

const { ENCRYPTION_KEY } = process.env;

@Entity()
export class ExampleEntity extends VendureEntity {
  private readonly cryptr: Cryptr | null = null;
  constructor(input?: DeepPartial<ExampleEntity>) {
    super(input);
    if (ENCRYPTION_KEY != null) {
        this.cryptr = new Cryptr(ENCRYPTION_KEY);
    }
  }

  @Column({ type: 'varchar', nullable: true })
  password?: string | null;

  @BeforeInsert()
  @BeforeUpdate()
  encryptPassword() {
    if (!this.cryptr) {
      this.logger.verbose({
        message: 'Encryption key is not set in the config, password will not be encrypted',
      });
      return;
    }

    if (this.password != null && this.password !== '') {
      this.password = this.cryptr.encrypt(this.password);
    }
  }

  @AfterLoad()
  decryptPassword() {
    if (this.password == null || this.password === '') {
      return;
    }

    if (!this.cryptr) {
      this.logger.verbose({
        message: 'Encryption key is not set in the config, password will not be encrypted',
      });
      return;
    }

    try {
      this.password = this.cryptr.decrypt(this.password);
    } catch (ex) {
      this.logger.warn({
        message:
          'Failed to decrypt password, did you change the encryption key?'
        error: ex,
      });
    }
  }
}

[michaelbromley]

@oroce thank you, that's a very useful example!