From 3e64cfd30a8eea66857b55682f0822a02de6aa52 Mon Sep 17 00:00:00 2001
From: grimsi <9295182+grimsi@users.noreply.github.com>
Date: Sun, 22 Sep 2024 19:29:42 +0200
Subject: [PATCH] Implemented field-level encryption for the database

---
 .run/GameyfinApplication.run.xml              |  3 +
 .../gameyfin/config/entities/ConfigEntry.kt   |  3 +-
 .../core/security/EncryptionConverter.kt      | 58 +++++++++++++++++++
 .../users/entities/PasswordResetToken.kt      |  7 +--
 .../de/grimsi/gameyfin/users/entities/User.kt |  2 +
 5 files changed, 68 insertions(+), 5 deletions(-)
 create mode 100644 src/main/kotlin/de/grimsi/gameyfin/core/security/EncryptionConverter.kt

diff --git a/.run/GameyfinApplication.run.xml b/.run/GameyfinApplication.run.xml
index 6afba1e..795dfd6 100644
--- a/.run/GameyfinApplication.run.xml
+++ b/.run/GameyfinApplication.run.xml
@@ -2,6 +2,9 @@
   <configuration default="false" name="GameyfinApplication" type="SpringBootApplicationConfigurationType" factoryName="Spring Boot" nameIsGenerated="true">
     <option name="ACTIVE_PROFILES" value="dev" />
     <option name="ALTERNATIVE_JRE_PATH" value="BUNDLED" />
+    <envs>
+      <env name="APP_KEY" value="8ODYedBBEA6qTd2Z/dZiWA==" />
+    </envs>
     <module name="gameyfin.main" />
     <option name="SHORTEN_COMMAND_LINE" value="ARGS_FILE" />
     <option name="SPRING_BOOT_MAIN_CLASS" value="de.grimsi.gameyfin.GameyfinApplication" />
diff --git a/src/main/kotlin/de/grimsi/gameyfin/config/entities/ConfigEntry.kt b/src/main/kotlin/de/grimsi/gameyfin/config/entities/ConfigEntry.kt
index e447717..af0f7f3 100644
--- a/src/main/kotlin/de/grimsi/gameyfin/config/entities/ConfigEntry.kt
+++ b/src/main/kotlin/de/grimsi/gameyfin/config/entities/ConfigEntry.kt
@@ -1,5 +1,6 @@
 package de.grimsi.gameyfin.config.entities
 
+import de.grimsi.gameyfin.core.security.EncryptionConverter
 import jakarta.persistence.*
 import jakarta.validation.constraints.NotNull
 
@@ -12,7 +13,7 @@ class ConfigEntry(
     val key: String,
 
     @NotNull
-    @Lob
     @Column(name = "`value`")
+    @Convert(converter = EncryptionConverter::class)
     var value: String
 )
\ No newline at end of file
diff --git a/src/main/kotlin/de/grimsi/gameyfin/core/security/EncryptionConverter.kt b/src/main/kotlin/de/grimsi/gameyfin/core/security/EncryptionConverter.kt
new file mode 100644
index 0000000..05787c1
--- /dev/null
+++ b/src/main/kotlin/de/grimsi/gameyfin/core/security/EncryptionConverter.kt
@@ -0,0 +1,58 @@
+package de.grimsi.gameyfin.core.security
+
+import jakarta.persistence.AttributeConverter
+import jakarta.persistence.Converter
+import java.util.*
+import javax.crypto.Cipher
+import javax.crypto.spec.SecretKeySpec
+
+@Converter
+class EncryptionConverter : AttributeConverter<String, String> {
+
+    companion object {
+        private const val ALGORITHM = "AES"
+        private val SECRET_KEY: SecretKeySpec
+
+        init {
+            val base64Key = System.getenv("APP_KEY")
+                ?: throw IllegalStateException("APP_KEY environment variable is not set or empty")
+
+            val decodedKey = Base64.getDecoder().decode(base64Key)
+
+            // Ensure the key length is valid for AES (128, 192, or 256 bits)
+            if (decodedKey.size !in listOf(16, 24, 32)) {
+                throw IllegalArgumentException("Invalid AES key length. Key must be 128, 192, or 256 bits.")
+            }
+
+            SECRET_KEY = SecretKeySpec(decodedKey, ALGORITHM)
+        }
+    }
+
+    override fun convertToDatabaseColumn(attribute: String?): String? {
+        return attribute?.let {
+            try {
+                val cipher = Cipher.getInstance(ALGORITHM).apply {
+                    init(Cipher.ENCRYPT_MODE, SECRET_KEY)
+                }
+                val encryptedBytes = cipher.doFinal(it.toByteArray())
+                Base64.getEncoder().encodeToString(encryptedBytes)
+            } catch (e: Exception) {
+                throw RuntimeException("Error during encryption", e)
+            }
+        }
+    }
+
+    override fun convertToEntityAttribute(dbData: String?): String? {
+        return dbData?.let {
+            try {
+                val cipher = Cipher.getInstance(ALGORITHM).apply {
+                    init(Cipher.DECRYPT_MODE, SECRET_KEY)
+                }
+                val decryptedBytes = cipher.doFinal(Base64.getDecoder().decode(it))
+                String(decryptedBytes)
+            } catch (e: Exception) {
+                throw RuntimeException("Error during decryption", e)
+            }
+        }
+    }
+}
diff --git a/src/main/kotlin/de/grimsi/gameyfin/users/entities/PasswordResetToken.kt b/src/main/kotlin/de/grimsi/gameyfin/users/entities/PasswordResetToken.kt
index 8dcccde..1180a37 100644
--- a/src/main/kotlin/de/grimsi/gameyfin/users/entities/PasswordResetToken.kt
+++ b/src/main/kotlin/de/grimsi/gameyfin/users/entities/PasswordResetToken.kt
@@ -1,15 +1,14 @@
 package de.grimsi.gameyfin.users.entities
 
-import jakarta.persistence.Entity
-import jakarta.persistence.FetchType
-import jakarta.persistence.Id
-import jakarta.persistence.OneToOne
+import de.grimsi.gameyfin.core.security.EncryptionConverter
+import jakarta.persistence.*
 import org.hibernate.annotations.CreationTimestamp
 import java.time.Instant
 
 @Entity
 class PasswordResetToken(
     @Id
+    @Convert(converter = EncryptionConverter::class)
     val token: String,
 
     @OneToOne(targetEntity = User::class, fetch = FetchType.EAGER)
diff --git a/src/main/kotlin/de/grimsi/gameyfin/users/entities/User.kt b/src/main/kotlin/de/grimsi/gameyfin/users/entities/User.kt
index f3a766d..c8ce7f8 100644
--- a/src/main/kotlin/de/grimsi/gameyfin/users/entities/User.kt
+++ b/src/main/kotlin/de/grimsi/gameyfin/users/entities/User.kt
@@ -1,5 +1,6 @@
 package de.grimsi.gameyfin.users.entities
 
+import de.grimsi.gameyfin.core.security.EncryptionConverter
 import jakarta.annotation.Nullable
 import jakarta.persistence.*
 import jakarta.validation.constraints.NotNull
@@ -23,6 +24,7 @@ class User(
 
     @Nullable
     @Column(unique = true)
+    @Convert(converter = EncryptionConverter::class)
     var email: String,
 
     var email_confirmed: Boolean = false,