Skip to content

Implemented encrypted database columns#263

Open
aicioara wants to merge 3 commits intomasterfrom
aic-encrypted-db-columns
Open

Implemented encrypted database columns#263
aicioara wants to merge 3 commits intomasterfrom
aic-encrypted-db-columns

Conversation

@aicioara
Copy link
Collaborator

@aicioara aicioara commented Mar 15, 2020

Closes #247

It appears however that EncryptedType from sqlalchemy-utils is broken for our environment (python3.7 & psycopg).

I spend some time fixing the bug and opening a PR with sqlalchemy-utils.
kvesteri/sqlalchemy-utils#426

Until this change gets merged, we need to specify the dependency in requirements.txt as

git+git://github.com/aicioara-forks/sqlalchemy-utils@0.36.1-fix-encrypted-type#egg=SQLAlchemy-Utils

If this is not desirable, I recommend that:

  • We wait for the patch to get merged
  • We wait for a new release of sqlalchemy-utils that includes our patch
  • Update sqlalchemy-utils

However, the fork above should work fine. I am committed to keeping the fork around, but not committed to keeping it up to date with sqlalchemy-utils, in case sqlalchemy-utils decides to reject our patch.

@aicioara aicioara changed the title Aic encrypted db columns Implemented encrypted database columns Mar 15, 2020
@aicioara
Copy link
Collaborator Author

We will wait a while in hope that kvesteri/sqlalchemy-utils#426 will be accepted and merged. That way, this repository would not need to depend on a fork.

@aicioara aicioara mentioned this pull request Mar 22, 2020
@dtenenba
Copy link
Contributor

Just wondering about something. Since there is no migration in this PR, I assume that the underlying type of the encrypted columns does not change, the contents of those columns is just encrypted.
This led me to wonder what happens to existing data in those columns. I think the app will treat those data (which are in cleartext) as encrypted and try and decrypt them, which will give the wrong results (if it does not give an error).

We may need to write a script that will encrypt the data in those columns before deploying this PR. I'll come up with a minimal test case to determine if that needs to be done.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add support for encrypted database columns

2 participants