Encryption of sensitive data

.env

@@ -65,5 +65,7 @@ PG_STATS_MIN_AGE_MS=1000
 #   to parameterize the LIMIT.
 PG_STATS_TOP_N=10
 
+#enable or disable encryption
+ENCRYPTION_ENABLED=false
 # session
-SESSION_SECRET=secretString
+SESSION_SECRET=secretString

.gitignore

@@ -8,12 +8,15 @@ files/*.zip
 
 # database dumps
 db_dumps/
+backups/
 
 # backend
 backend/sessions
 backend/node_modules
 backend/logs
 backend/coverage
+backend/encryption.key
+backend/encryption.state
 
 # ignore build files
 dist/

Makefile

@@ -28,7 +28,8 @@ help:
 	@echo "make build           		  		Create a dockerized production build including frontend, backend, nlp, services"
 	@echo "make build-clean                     Clean the environment of production build"
 	@echo "make docker          				Start docker images"
-	@echo "make backup_db CONTAINER=<name/id>	Backup the database in the given container"
+	@echo "make backup CONTAINER=<name/id>      Create full backup (DB dump + .env + encryptionkey + files)"
+	@echo "make backup_db CONTAINER=<name/id>	Backup the database (prompts whether to decrypt before dumping)"
 	@echo "make recover_db CONTAINER=<name/id>  DUMP=<name in db_dumps folder>	Recover database into container"
 	@echo "make anonymize_dump CONTAINER=<name/id>  DUMP=<name in db_dumps folder>  [SEED=<int>]  [NUM=<int>]	Create anonymized dump (consent-filtered + pseudonymized)"
 	@echo "make export_dump_files CONTAINER=<name/id>  DUMP=<name in db_dumps folder>	Archive document files referenced by an existing anonymized dump"
@@ -37,6 +38,7 @@ help:
 	@echo "make kill             				Kill all node instances (only unix)"
 	@echo "make modules          				Install npm packages in all utils/modules subdirectories"
 	@echo "make audit            				npm audit for frontend, backend, utils/modules/editor-delta-conversion"
+	@echo "make change_encryption_key NEW_KEY=<64-char hex>	Re-encrypt all user fields with a new encryption key"
 
 .PHONY: doc
 doc: doc_sphinx
@@ -136,10 +138,28 @@ build-clean:
 	@docker network rm ${PROJECT_NAME}_default || echo "IGNORING ERROR"
 
 .PHONY: backup_db
-backup_db:
-	@echo "Backing up database"
-	mkdir -p db_dumps
-	@docker exec -t $${CONTAINER} pg_dumpall -c -U postgres > db_dumps/dump_`date +%d-%m-%Y"_"%H_%M_%S`.sql
+backup_db: backend/node_modules/.uptodate
+ifndef CONTAINER
+	$(error CONTAINER is not set. Usage: make backup_db CONTAINER=<name/id>)
+endif
+	@echo "Backing up database"; \
+	mkdir -p db_dumps; \
+	printf "Decrypt DB before backup? [y/N] "; \
+	read DECRYPT_ANSWER; \
+	OUTFILE="db_dumps/dump_$$(date +%d-%m-%Y_%H_%M_%S).sql"; \
+	if [ "$$DECRYPT_ANSWER" = "y" ] || [ "$$DECRYPT_ANSWER" = "Y" ]; then \
+		SIDECAR="$(POSTGRES_CAREDB)_backup_$$(date +%s)"; \
+		echo "[backup] Cloning live DB into $$SIDECAR..."; \
+		docker exec $(CONTAINER) psql -q -U postgres -c "CREATE DATABASE $$SIDECAR TEMPLATE $(POSTGRES_CAREDB)"; \
+		echo "[backup] Decrypting clone (live DB stays encrypted)..."; \
+		(cd backend && POSTGRES_CAREDB=$$SIDECAR npm run --silent decrypt-db); \
+		echo "[backup] Dumping plaintext clone..."; \
+		docker exec -t $(CONTAINER) pg_dump -c -C -U postgres $$SIDECAR > $$OUTFILE; \
+		docker exec $(CONTAINER) psql -q -U postgres -c "DROP DATABASE $$SIDECAR"; \
+		echo "[backup] Done - plaintext dump: $$OUTFILE"; \
+	else \
+		docker exec -t $(CONTAINER) pg_dumpall -c -U postgres > $$OUTFILE; \
+	fi
 
 .PHONY: recover_db
 recover_db:
@@ -152,6 +172,22 @@ else
 	@cat "db_dumps/$${DUMP}" | docker exec -i $${CONTAINER} psql -U postgres
 endif
 
+.PHONY: backup
+backup: backup_db
+ifndef CONTAINER
+	$(error CONTAINER is not set. Usage: make backup CONTAINER=<name/id>)
+endif
+	@echo "Creating full backup archive"
+	@mkdir -p backups
+	@LATEST_DUMP=$$(ls -t db_dumps/*.sql | head -n 1); \
+	TIMESTAMP=$$(date +%d-%m-%Y_%H_%M_%S); \
+	tar -czf "backups/backup_$$TIMESTAMP.tar.gz" \
+		"$$LATEST_DUMP" \
+		.env \
+		backend/encryption.key \
+		files; \
+	echo "Backup created: backups/backup_$$TIMESTAMP.tar.gz"
+
 # Internal target: zip document files from a live DB. Requires DB and FILEZIP to be set.
 .PHONY: _export_document_files
 _export_document_files:
@@ -214,6 +250,11 @@ export_dump_files:
 	$(MAKE) _export_document_files CONTAINER=$${CONTAINER} DB=$$SIDECAR FILEZIP=$$FILEZIP; \
 	docker exec $${CONTAINER} psql -q -U postgres -c "DROP DATABASE $$SIDECAR" > /dev/null
 
+.PHONY: change_encryption_key
+change_encryption_key: backend/node_modules/.uptodate
+	@echo "Changing encryption key..."
+	@cd backend && npm run --silent change-encryption-key
+
 .PHONY: admin-password
 admin-password: backend/node_modules/.uptodate
 	cd backend && ADMIN_EMAIL="$(ADMIN_EMAIL)" npm run set-admin-password

backend/db/migrations/20260612100001-encrypt-user-fields.js

@@ -0,0 +1,167 @@
+'use strict';
+
+/**
+ * Encrypt existing plaintext values in user fields: firstName, lastName, email, initialPassword.
+ * Also populates emailHash from the newly encrypted email value.
+ *
+ * Requires DB_ENCRYPTION_KEY to be set in the environment.
+ * Skips rows where the field already appears encrypted (safe to re-run).
+ */
+
+const { encrypt, getKey, initializeEncryptionKey, decrypt } = require('../../utils/encryption');
+
+module.exports = {
+    async up(queryInterface) {
+        const isEncryptionEnabled = process.env.ENCRYPTION_ENABLED === 'true';
+        if (!isEncryptionEnabled) {
+            return;
+        }
+        initializeEncryptionKey();
+        const encryptionKey = getKey();
+        if (!encryptionKey) {
+            throw new Error(
+                'DB_ENCRYPTION_KEY must be set before running the user encryption data migration'
+            );
+        }
+
+        const transaction = await queryInterface.sequelize.transaction();
+        try {
+            const users = await queryInterface.sequelize.query(
+                `SELECT id, "firstName", "lastName", email, "initialPassword", "twoFactorOtp", "totpSecret", "orcidId", "ldapUsername", "samlNameId", "salt" FROM "user"`,
+                { type: queryInterface.sequelize.QueryTypes.SELECT, transaction }
+            );
+
+            for (const user of users) {
+                const updates = {};
+
+                if (user.firstName) {
+                    updates.firstName = encrypt(user.firstName);
+                }
+                if (user.lastName) {
+                    updates.lastName = encrypt(user.lastName);
+                }
+                if (user.email) {
+                    const encryptedEmail = encrypt(user.email);
+                    updates.email = encryptedEmail;
+                }
+                if (user.initialPassword) {
+                    updates.initialPassword = encrypt(user.initialPassword);
+                }
+                if (user.twoFactorOtp) {
+                    updates.twoFactorOtp = encrypt(user.twoFactorOtp);
+                }
+                if (user.totpSecret) {
+                    updates.totpSecret = encrypt(user.totpSecret);
+                }
+                if (user.orcidId) {
+                    updates.orcidId = encrypt(user.orcidId);
+                }
+                if (user.ldapUsername) {
+                    updates.ldapUsername = encrypt(user.ldapUsername);
+                }
+                if (user.samlNameId) {
+                    updates.samlNameId = encrypt(user.samlNameId);
+                }
+                if (user.salt) {
+                    updates.salt = encrypt(user.salt);
+                }
+
+                if (Object.keys(updates).length > 0) {
+                    const setClauses = Object.keys(updates)
+                        .map(col => `"${col}" = :${col}`)
+                        .join(', ');
+
+                    await queryInterface.sequelize.query(
+                        `UPDATE "user" SET ${setClauses} WHERE id = :id`,
+                        {
+                            replacements: { ...updates, id: user.id },
+                            transaction,
+                        }
+                    );
+                }
+            }
+
+            await transaction.commit();
+        } catch (err) {
+            await transaction.rollback();
+            throw err;
+        }
+    },
+
+    async down(queryInterface) {
+        const isEncryptionEnabled = process.env.ENCRYPTION_ENABLED === 'true';
+        if (!isEncryptionEnabled) {
+            return;
+        }
+        initializeEncryptionKey();
+        const encryptionKey = getKey();
+        if (!encryptionKey) {
+            throw new Error(
+                'DB_ENCRYPTION_KEY must be set before running the user encryption data migration'
+            );
+        }
+
+        const transaction = await queryInterface.sequelize.transaction();
+        try {
+            const users = await queryInterface.sequelize.query(
+                `SELECT id, "firstName", "lastName", email, "initialPassword", "twoFactorOtp", "totpSecret", "orcidId", "ldapUsername", "samlNameId", "salt" FROM "user"`,
+                { type: queryInterface.sequelize.QueryTypes.SELECT, transaction }
+            );
+
+            for (const user of users) {
+                const updates = {};
+
+                if (user.firstName) {
+                    updates.firstName = decrypt(user.firstName);
+                }
+                if (user.lastName) {
+                    updates.lastName = decrypt(user.lastName);
+                }
+                if (user.email) {
+                    const decryptedEmail = decrypt(user.email);
+                    updates.email = decryptedEmail;
+                }
+                if (user.initialPassword) {
+                    updates.initialPassword = decrypt(user.initialPassword);
+                }
+                if (user.twoFactorOtp) {
+                    updates.twoFactorOtp = decrypt(user.twoFactorOtp);
+                }
+                if (user.totpSecret) {
+                    updates.totpSecret = decrypt(user.totpSecret);
+                }
+                if (user.orcidId) {
+                    updates.orcidId = decrypt(user.orcidId);
+                }
+                if (user.ldapUsername) {
+                    updates.ldapUsername = decrypt(user.ldapUsername);
+                }
+                if (user.samlNameId) {
+                    updates.samlNameId = decrypt(user.samlNameId);
+                }
+                if (user.salt) {
+                    updates.salt = decrypt(user.salt);
+                }
+
+                if (Object.keys(updates).length > 0) {
+                    const setClauses = Object.keys(updates)
+                        .map(col => `"${col}" = :${col}`)
+                        .join(', ');
+
+                    await queryInterface.sequelize.query(
+                        `UPDATE "user" SET ${setClauses} WHERE id = :id`,
+                        {
+                            replacements: { ...updates, id: user.id },
+                            transaction,
+                        }
+                    );
+                }
+            }
+
+            await transaction.commit();
+        } catch (err) {
+            await transaction.rollback();
+            throw err;
+        }
+    },
+};

backend/db/models/user.js

@@ -597,6 +597,8 @@ module.exports = (sequelize, DataTypes) => {
             sequelize,
             modelName: "user",
             tableName: "user",
+            //Keys that require encryption unique set to false by default
+            encryptedFields: ['firstName', 'lastName', { name: 'email', unique: true }, 'salt', 'initialPassword', 'twoFactorOtp', 'totpSecret', 'orcidId', 'ldapUsername', 'samlNameId'],
             hooks: {
                 afterCreate: async (user, options) => {
                     const {context, transaction} = options;