Feat: secrets encryption

cmd/migrate.go

@@ -4,10 +4,11 @@ import (
 	"fmt"
 	"log"
 
+	"github.com/formancehq/payments/internal/app/migrations"
+
 	"github.com/spf13/viper"
 
-	// allow blank import to initiate migrations.
-	_ "github.com/formancehq/payments/internal/app/migrations"
+	// Import the postgres driver.
 	_ "github.com/lib/pq"
 
 	"github.com/pressly/goose/v3"
@@ -48,6 +49,15 @@ func runMigrate(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("postgres uri is not set")
 	}
 
+	cfgEncryptionKey := viper.GetString(configEncryptionKeyFlag)
+	if cfgEncryptionKey == "" {
+		cfgEncryptionKey = cmd.Flag(configEncryptionKeyFlag).Value.String()
+	}
+
+	if cfgEncryptionKey != "" {
+		migrations.EncryptionKey = cfgEncryptionKey
+	}
+
 	database, err := goose.OpenDBWithDriver("postgres", postgresURI)
 	if err != nil {
 		return fmt.Errorf("failed to open database: %w", err)

cmd/root.go

@@ -43,9 +43,11 @@ func rootCommand() *cobra.Command {
 	root.PersistentFlags().Bool(debugFlag, false, "Debug mode")
 
 	migrate.Flags().String(postgresURIFlag, "postgres://localhost/payments", "PostgreSQL DB address")
+	migrate.Flags().String(configEncryptionKeyFlag, "", "Config encryption key")
 
 	server.Flags().BoolP("toggle", "t", false, "Help message for toggle")
 	server.Flags().String(postgresURIFlag, "postgres://localhost/payments", "PostgreSQL DB address")
+	server.Flags().String(configEncryptionKeyFlag, "", "Config encryption key")
 	server.Flags().String(envFlag, "local", "Environment")
 	server.Flags().Bool(publisherKafkaEnabledFlag, false, "Publish write events to kafka")
 	server.Flags().StringSlice(publisherKafkaBrokerFlag, []string{}, "Kafka address is kafka enabled")

cmd/server.go

@@ -30,6 +30,7 @@ import (
 //nolint:gosec // false positive
 const (
 	postgresURIFlag                 = "postgres-uri"
+	configEncryptionKeyFlag         = "config-encryption-key"
 	otelTracesFlag                  = "otel-traces"
 	envFlag                         = "env"
 	publisherKafkaEnabledFlag       = "publisher-kafka-enabled"
@@ -157,7 +158,12 @@ func prepareDatabaseOptions() (fx.Option, error) {
 		return nil, errors.New("missing postgres uri")
 	}
 
-	return storage.Module(postgresURI), nil
+	configEncryptionKey := viper.GetString(configEncryptionKeyFlag)
+	if configEncryptionKey == "" {
+		return nil, errors.New("missing config encryption key")
+	}
+
+	return storage.Module(postgresURI, configEncryptionKey), nil
 }
 
 func topicsMapping() map[string]string {

internal/app/connectors/bankingcircle/config.go

@@ -2,6 +2,7 @@ package bankingcircle
 
 import (
 	"encoding/json"
+	"fmt"
 
 	"github.com/formancehq/payments/internal/app/connectors/configtemplate"
 )
@@ -13,6 +14,12 @@ type Config struct {
 	AuthorizationEndpoint string `json:"authorizationEndpoint" yaml:"authorizationEndpoint" bson:"authorizationEndpoint"`
 }
 
+// String obfuscates sensitive fields and returns a string representation of the config.
+// This is used for logging.
+func (c Config) String() string {
+	return fmt.Sprintf("username=%s, password=****, endpoint=%s, authorizationEndpoint=%s", c.Username, c.Endpoint, c.AuthorizationEndpoint)
+}
+
 func (c Config) Validate() error {
 	if c.Username == "" {
 		return ErrMissingUsername

internal/app/connectors/currencycloud/config.go

@@ -2,6 +2,7 @@ package currencycloud
 
 import (
 	"encoding/json"
+	"fmt"
 	"time"
 
 	"github.com/formancehq/payments/internal/app/connectors/configtemplate"
@@ -14,6 +15,12 @@ type Config struct {
 	PollingPeriod Duration `json:"pollingPeriod" bson:"pollingPeriod"`
 }
 
+// String obfuscates sensitive fields and returns a string representation of the config.
+// This is used for logging.
+func (c Config) String() string {
+	return fmt.Sprintf("loginID=%s, endpoint=%s, pollingPeriod=%s, apiKey=****", c.LoginID, c.Endpoint, c.PollingPeriod.String())
+}
+
 func (c Config) Validate() error {
 	if c.APIKey == "" {
 		return ErrMissingAPIKey

internal/app/connectors/dummypay/config.go

@@ -23,7 +23,7 @@ type Config struct {
 
 // String returns a string representation of the configuration.
 func (c Config) String() string {
-	return fmt.Sprintf("directory: %s, filePollingPeriod: %s, fileGenerationPeriod: %s",
+	return fmt.Sprintf("directory=%s, filePollingPeriod=%s, fileGenerationPeriod=%s",
 		c.Directory, c.FilePollingPeriod.String(), c.FileGenerationPeriod.String())
 }
 

internal/app/connectors/dummypay/config_test.go

@@ -19,7 +19,7 @@ func TestConfigString(t *testing.T) {
 		FileGenerationPeriod: connectors.Duration{Duration: time.Minute},
 	}
 
-	assert.Equal(t, "directory: test, filePollingPeriod: 1s, fileGenerationPeriod: 1m0s", config.String())
+	assert.Equal(t, "directory=test, filePollingPeriod=1s, fileGenerationPeriod=1m0s", config.String())
 }
 
 // TestConfigValidate tests the validation of the config.

internal/app/connectors/modulr/config.go

@@ -2,6 +2,7 @@ package modulr
 
 import (
 	"encoding/json"
+	"fmt"
 
 	"github.com/formancehq/payments/internal/app/connectors/configtemplate"
 )
@@ -12,6 +13,12 @@ type Config struct {
 	Endpoint  string `json:"endpoint" bson:"endpoint"`
 }
 
+// String obfuscates sensitive fields and returns a string representation of the config.
+// This is used for logging.
+func (c Config) String() string {
+	return fmt.Sprintf("endpoint=%s, apiSecret=***, apiKey=****", c.Endpoint)
+}
+
 func (c Config) Validate() error {
 	if c.APIKey == "" {
 		return ErrMissingAPIKey

internal/app/connectors/stripe/config.go

@@ -16,8 +16,10 @@ type Config struct {
 	TimelineConfig `bson:",inline"`
 }
 
+// String obfuscates sensitive fields and returns a string representation of the config.
+// This is used for logging.
 func (c Config) String() string {
-	return fmt.Sprintf("pollingPeriod=%d, pageSize=%d, apiKey=%s", c.PollingPeriod, c.PageSize, c.APIKey)
+	return fmt.Sprintf("pollingPeriod=%d, pageSize=%d, apiKey=****", c.PollingPeriod, c.PageSize)
 }
 
 func (c Config) Validate() error {

internal/app/connectors/wise/config.go

@@ -10,6 +10,12 @@ type Config struct {
 	APIKey string `json:"apiKey" yaml:"apiKey" bson:"apiKey"`
 }
 
+// String obfuscates sensitive fields and returns a string representation of the config.
+// This is used for logging.
+func (c Config) String() string {
+	return "apiKey=***"
+}
+
 func (c Config) Validate() error {
 	if c.APIKey == "" {
 		return ErrMissingAPIKey

internal/app/integration/manager.go

@@ -213,8 +213,8 @@ func (l *ConnectorManager[ConnectorConfig]) IsEnabled(ctx context.Context) (bool
 	return l.store.IsEnabled(ctx, l.loader.Name())
 }
 
-func (l *ConnectorManager[ConnectorConfig]) FindAll(ctx context.Context) ([]models.Connector, error) {
-	return l.store.FindAll(ctx)
+func (l *ConnectorManager[ConnectorConfig]) FindAll(ctx context.Context) ([]*models.Connector, error) {
+	return l.store.ListConnectors(ctx)
 }
 
 func (l *ConnectorManager[ConnectorConfig]) IsInstalled(ctx context.Context) (bool, error) {

internal/app/integration/store.go

@@ -8,7 +8,7 @@ import (
 )
 
 type Repository interface {
-	FindAll(ctx context.Context) ([]models.Connector, error)
+	ListConnectors(ctx context.Context) ([]*models.Connector, error)
 	IsInstalled(ctx context.Context, name models.ConnectorProvider) (bool, error)
 	Install(ctx context.Context, name models.ConnectorProvider, config json.RawMessage) error
 	Uninstall(ctx context.Context, name models.ConnectorProvider) error

internal/app/integration/storememory.go

@@ -21,8 +21,8 @@ func (i *InMemoryConnectorStore) Uninstall(ctx context.Context, name models.Conn
 	return nil
 }
 
-func (i *InMemoryConnectorStore) FindAll(_ context.Context) ([]models.Connector, error) {
-	return []models.Connector{}, nil
+func (i *InMemoryConnectorStore) ListConnectors(_ context.Context) ([]*models.Connector, error) {
+	return []*models.Connector{}, nil
 }
 
 func (i *InMemoryConnectorStore) IsInstalled(ctx context.Context, name models.ConnectorProvider) (bool, error) {

internal/app/migrations/006_conifg_encryption.go

@@ -0,0 +1,95 @@
+package migrations
+
+import (
+	"database/sql"
+	"fmt"
+
+	"github.com/pkg/errors"
+
+	"github.com/pressly/goose/v3"
+)
+
+// EncryptionKey is set from the migration utility to specify default encryption key to migrate to.
+// This can remain empty. Then the config will be removed.
+//
+//nolint:gochecknoglobals // This is a global variable by design.
+var EncryptionKey string
+
+func init() {
+	up := func(tx *sql.Tx) error {
+		var exists bool
+
+		err := tx.QueryRow("SELECT EXISTS(SELECT 1 FROM connectors.connector)").Scan(&exists)
+		if err != nil {
+			return fmt.Errorf("failed to check if connectors table exists: %w", err)
+		}
+
+		if exists && EncryptionKey == "" {
+			return errors.New("encryption key is not set")
+		}
+
+		_, err = tx.Exec(`
+				CREATE EXTENSION IF NOT EXISTS pgcrypto;
+				ALTER TABLE connectors.connector RENAME COLUMN config TO config_unencrypted;
+				ALTER TABLE connectors.connector ADD COLUMN config bytea NULL;
+		`)
+		if err != nil {
+			return fmt.Errorf("failed to create config column: %w", err)
+		}
+
+		_, err = tx.Exec(`
+			UPDATE connectors.connector SET config = pgp_sym_encrypt(config_unencrypted::TEXT, $1, 'compress-algo=1, cipher-algo=aes256');
+		`, EncryptionKey)
+		if err != nil {
+			return fmt.Errorf("failed to encrypt config: %w", err)
+		}
+
+		_, err = tx.Exec(`
+			ALTER TABLE connectors.connector DROP COLUMN config_unencrypted;
+		`)
+		if err != nil {
+			return fmt.Errorf("failed to drop config_unencrypted column: %w", err)
+		}
+
+		return nil
+	}
+
+	down := func(tx *sql.Tx) error {
+		var exists bool
+
+		err := tx.QueryRow("SELECT EXISTS(SELECT 1 FROM connectors.connector)").Scan(&exists)
+		if err != nil {
+			return fmt.Errorf("failed to check if connectors table exists: %w", err)
+		}
+
+		if exists && EncryptionKey == "" {
+			return errors.New("encryption key is not set")
+		}
+
+		_, err = tx.Exec(`
+				ALTER TABLE connectors.connector RENAME COLUMN config TO config_encrypted;
+				ALTER TABLE connectors.connector ADD COLUMN config JSON NULL;
+		`)
+		if err != nil {
+			return fmt.Errorf("failed to create config column: %w", err)
+		}
+
+		_, err = tx.Exec(`
+				UPDATE connectors.connector SET config = pgp_sym_decrypt(config_encrypted, $1, 'compress-algo=1, cipher-algo=aes256')::JSON;
+		`, EncryptionKey)
+		if err != nil {
+			return fmt.Errorf("failed to decrypt config: %w", err)
+		}
+
+		_, err = tx.Exec(`
+				ALTER TABLE connectors.connector DROP COLUMN config_encrypted;
+		`)
+		if err != nil {
+			return fmt.Errorf("failed to drop config_encrypted column: %w", err)
+		}
+
+		return nil
+	}
+
+	goose.AddMigration(up, down)
+}

internal/app/models/connector.go

@@ -19,13 +19,25 @@ type Connector struct {
 	Provider  ConnectorProvider
 	Enabled   bool
 
-	// TODO: Enable DB-level encryption
-	Config json.RawMessage
+	// EncryptedConfig is a PGP-encrypted JSON string.
+	EncryptedConfig string `bun:"config"`
+
+	// Config is a decrypted config. It is not stored in the database.
+	Config json.RawMessage `bun:"decrypted_config,scanonly"`
 
 	Tasks    []*Task    `bun:"rel:has-many,join:id=connector_id"`
 	Payments []*Payment `bun:"rel:has-many,join:id=connector_id"`
 }
 
+func (c Connector) String() string {
+	c.EncryptedConfig = "****"
+	c.Config = nil
+
+	var t any = c
+
+	return fmt.Sprintf("%+v", t)
+}
+
 type ConnectorProvider string
 
 const (