Skip to main content

EncryptedField

@webda/core

Class: EncryptedField<T>

Defined in: packages/core/src/models/encrypted.model.ts:33

A model field encrypted at rest with the CryptoService

Only the ciphertext is stored (__ciphertext, server-only: __ keys never reach a public output). The value is JSON-serialised, encrypted with the current symmetric key (AES, with a random IV) and wrapped in a JWT signed with that key, so tampering is detected; values encrypted before a key rotation still decrypt while the CryptoService keeps the old key.

class MyModel extends UuidModel {
  secret: EncryptedField<{ apiKey: string }>;
}
await model.secret.set({ apiKey: "..." });
await model.save();
const { apiKey } = await model.secret.get();

Webda Behavior​

Webda/Encrypted

Type Parameters​

T​

T = any

Constructors​

Constructor​

new EncryptedField<T>(): EncryptedField<T>

Returns​

EncryptedField<T>

Properties​

__ciphertext?​

optional __ciphertext?: string

Defined in: packages/core/src/models/encrypted.model.ts:35

Encrypted value (a JWT wrapping the AES ciphertext), never output

Methods​

clear()​

clear(): void

Defined in: packages/core/src/models/encrypted.model.ts:71

Remove the stored value (does not save the model)

Returns​

void

get()​

get(): Promise<T>

Defined in: packages/core/src/models/encrypted.model.ts:61

Decrypt the stored value

Returns​

Promise<T>

the value, undefined when none is stored

Throws​

Error when the ciphertext is invalid (tampered, or encrypted with an unknown key)

isSet()​

isSet(): boolean

Defined in: packages/core/src/models/encrypted.model.ts:40

Returns​

boolean

true when a value is stored

set()​

set(value): Promise<void>

Defined in: packages/core/src/models/encrypted.model.ts:48

Encrypt and store a value (does not save the model); undefined clears it

Parameters​

value​

T

value to store, JSON-serialisable

Returns​

Promise<void>