Encryption

Cargo.toml

@@ -53,6 +53,8 @@ lalrpop = { version = "0.20", features = ["lexer"] }
 rust_decimal_macros = "1.34.2"
 rust_decimal = "1.35.0"
 rusty-money = { version = "0.4", features = ["iso", "crypto"] }
+chacha20poly1305 = "0.10.1"
+hex = "0.4.3"
 
 [profile.release]
 lto = true

cala-server/Cargo.toml

@@ -38,3 +38,5 @@ serde_with = { workspace = true }
 uuid = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
+chacha20poly1305 = { workspace = true }
+hex = "0.4.3"

cala-server/migrations/20231211151809_cala_server_setup.sql

@@ -28,7 +28,8 @@ CREATE TABLE job_executions (
 CREATE TABLE integrations (
   id UUID PRIMARY KEY,
   name VARCHAR NOT NULL,
-  data JSONB,
+  cipher BYTEA NOT NULL,
+  nonce BYTEA NOT NULL,
   modified_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
   created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );

cala-server/src/app/config.rs

@@ -2,8 +2,12 @@ use serde::{Deserialize, Serialize};
 
 use crate::job::JobExecutorConfig;
 
+use super::EncryptionConfig;
+
 #[derive(Clone, Default, Debug, Deserialize, Serialize)]
 pub struct AppConfig {
     #[serde(default)]
     pub job_execution: JobExecutorConfig,
+    #[serde(default)]
+    pub encryption: EncryptionConfig,
 }

cala-server/src/app/mod.rs

@@ -14,6 +14,7 @@ pub struct CalaApp {
     pool: PgPool,
     ledger: CalaLedger,
     jobs: Jobs,
+    config: AppConfig,
 }
 
 impl CalaApp {
@@ -23,13 +24,23 @@ impl CalaApp {
         ledger: CalaLedger,
         registry: JobRegistry,
     ) -> Result<Self, ApplicationError> {
-        let mut jobs = Jobs::new(&pool, config.job_execution, registry);
+        let mut jobs = Jobs::new(
+            &pool,
+            config.job_execution.clone(),
+            registry,
+            config.encryption.clone(),
+        );
         jobs.start_poll().await?;
-        Ok(Self { pool, ledger, jobs })
+        Ok(Self {
+            pool,
+            ledger,
+            jobs,
+            config,
+        })
     }
 
     pub fn integrations(&self) -> Integrations {
-        Integrations::new(&self.pool)
+        Integrations::new(&self.pool, &self.config.encryption)
     }
 
     pub fn ledger(&self) -> &CalaLedger {

cala-server/src/cli/config.rs

@@ -5,7 +5,7 @@ use serde::{Deserialize, Serialize};
 use std::path::Path;
 
 use super::db::*;
-use crate::{app::AppConfig, server::ServerConfig};
+use crate::{app::AppConfig, integration::EncryptionKey, server::ServerConfig};
 
 #[derive(Clone, Default, Serialize, Deserialize)]
 pub struct Config {
@@ -21,6 +21,7 @@ pub struct Config {
 
 pub struct EnvOverride {
     pub db_con: String,
+    pub encryption_key: String,
 }
 
 impl Config {
@@ -37,11 +38,28 @@ impl Config {
             Config::default()
         };
 
-        config.apply_env_override(env_override);
+        config.apply_env_override(env_override)?;
         Ok(config)
     }
 
-    fn apply_env_override(&mut self, EnvOverride { db_con }: EnvOverride) {
+    fn apply_env_override(
+        &mut self,
+        EnvOverride {
+            db_con,
+            encryption_key,
+        }: EnvOverride,
+    ) -> anyhow::Result<()> {
         self.db.pg_con = db_con;
+
+        let key_bytes = hex::decode(encryption_key)?;
+        if key_bytes.len() != 32 {
+            return Err(anyhow::anyhow!(
+                "Signer encryption key must be 32 bytes, got {}",
+                key_bytes.len()
+            ));
+        }
+
+        self.app.encryption.key = EncryptionKey::clone_from_slice(key_bytes.as_ref());
+        Ok(())
     }
 }

cala-server/src/cli/mod.rs

@@ -22,14 +22,22 @@ struct Cli {
     cala_home: String,
     #[clap(env = "PG_CON")]
     pg_con: String,
+    #[clap(env = "ENCRYPTION_KEY")]
+    encryption_key: String,
 }
 
 pub async fn run<Q: QueryExtensionMarker, M: MutationExtensionMarker>(
     job_registration: impl FnOnce(&mut JobRegistry),
 ) -> anyhow::Result<()> {
     let cli = Cli::parse();
 
-    let config = Config::load_config(cli.config, EnvOverride { db_con: cli.pg_con })?;
+    let config = Config::load_config(
+        cli.config,
+        EnvOverride {
+            db_con: cli.pg_con,
+            encryption_key: cli.encryption_key,
+        },
+    )?;
 
     run_cmd::<Q, M>(&cli.cala_home, config, job_registration).await?;