Store property values encrypted

[bajtos]

We should provide an easy way how to encrypt property values on "save" and decrypt then on "load". At the moment, users have to implement operation hooks as a workaround.

Optionally, we can provide support for one-way encryption too, think of User.password.

loopbackio/loopback-datasource-juggler#441

The reason is: I need to encrypt/decrypt data in database.
So basically before save I can encrypt data with the key.
But I can't decrypt data after find.
I've tried with getter/setter but it doesn't work.

#1226

I need to manipulate data after it is validated ?
For example, after all my fields are validated I'd like to encrypt some of them and persist into datastore.

[bajtos]

One of many possible implementations:

{
  "name": "MyModel",
  "properties": {
    "name": { "type": "string", "encrypted": true }
  }
}

module.exports = function(MyModel) {
  MyModel._encryptPropertyValue = function(propertyName, value, cb) {
    // custom encryption algorithm
    cb(null, encryptedPropertyValue);
  };

  MyModel._decryptPropertyValue = function(propertyName, encryptedValue, cb) {
    // custom encryption algorithm
    cb(null, value);
  };
}

[fabien]

As pointed out here #1226 (comment) I think we should aim for an Encrypt mixin. Suggestion:

Model.mixin('Encrypt'); // will check property definitions for encrypted: true

The above will use Model.encryptAttribute(attr, data, options, cb); which will have a default implementation (once you run the mixin), which you can then override (in boot/ ... for example).

Model.mixin('Encrypt', { properties: ['data'] , encrypt: function(attr, data, options, cb) { ... }, decrypt: ... }');

Use the given properties; when an encrypt function is given, define Model.encryptAttribute with it.

[jmls]

has there been any more work on this ?

[bajtos]

@jmls loopbackio/loopback-datasource-juggler#599 added "loaded" hook and loopbackio/loopback-datasource-juggler#586 added "persist" hook. These two new hooks should allow you to implement encryption yourself. We don't have a higher-level support (like a mixin outlined above) yet.

[bajtos]

Let me add more context for anybody who may come across this closed issue: I personally agree with @fabien that encrypted properties can and thus should be implemented as a mixin. Additionally, I think it's best to keep this mixin outside of loopback core, to allow independent versioning and easier maintenance.

If it turns out that the two hooks "loaded" and "persist" are not enough to support property encryption/decryption, then please open a new issue describing what is needed from LoopBack core to support this feature.