mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 21:32:18 +00:00
Marc-André Bombeck
5eb7956bad
The GPS track of an outdoor workout was stored readable, and its first and last points are usually the person's front door. The phone number and address in the address book of doctors and practices were readable too, while the note beside them was already encrypted. Migration 0361 adds workout_routes.geometry_encrypted (the geometry loses its NOT NULL) and practitioners.phone_encrypted / location_encrypted, plus partial indexes on the backfill's discovery predicates. A track is sealed as one binary AES-256-GCM value bound to its purpose; the contact fields use the same Bytes codec as the note. The practitioner's name, practice and specialty stay readable, because the picker searches and sorts on them. Every writer stores ciphertext only: workout batch ingest, practitioner create and edit, and both restore formats. Readers prefer the ciphertext and fall back to the old column for rows not yet migrated: the workout detail (map, splits, GPX), the activity insight's climb figure, the practitioner DTO behind the address book, visits and vaccinations. The wire shape does not change. An edit's audit row now names a changed phone number or address without recording either value. free-text-encryption-backfill covers the three columns in the same pass, finding a route through its workout. All three are registered for key rotation (registry, CLI script, and the in-app rotation). A disaster-recovery backup carries the contact fields as ciphertext only; a portable export carries them readable. Workout routes are still not part of a backup, as before. The old columns are marked for removal in a later release.
88 lines
2.7 KiB
TypeScript
88 lines
2.7 KiB
TypeScript
/**
|
|
* Practitioner row → wire DTO.
|
|
*
|
|
* Server-authoritative: the client renders these values, it never rebuilds
|
|
* them. The free-text note lives in `noteEncrypted` (Bytes) and is decrypted
|
|
* fail-soft on read, so a key-rotation gap on one row reads as a missing note
|
|
* rather than 500-ing the address book.
|
|
*
|
|
* v1.39.4 — the phone number and the address follow the note into Bytes
|
|
* ciphertext (`phoneEncrypted`, `locationEncrypted`). They read the same way,
|
|
* with one addition: a row the boot-time backfill has not reached yet still
|
|
* holds them in the readable columns, which are read only when there is no
|
|
* ciphertext. A ciphertext that does not open reads as absent, never as the
|
|
* readable column.
|
|
*/
|
|
import { decryptFromBytes } from "@/lib/ai/coach/bytes-codec";
|
|
import { getEvent } from "@/lib/logging/context";
|
|
import type { Practitioner } from "@/generated/prisma/client";
|
|
|
|
export interface PractitionerDTO {
|
|
id: string;
|
|
name: string;
|
|
specialty: string | null;
|
|
practice: string | null;
|
|
location: string | null;
|
|
phone: string | null;
|
|
note: string | null;
|
|
createdAt: string;
|
|
updatedAt: string;
|
|
}
|
|
|
|
/** Decrypt a Bytes note fail-soft (null on missing / undecryptable). */
|
|
export function decryptPractitionerNote(
|
|
noteEncrypted: Uint8Array | null,
|
|
): string | null {
|
|
if (!noteEncrypted || noteEncrypted.byteLength === 0) return null;
|
|
try {
|
|
return decryptFromBytes(noteEncrypted);
|
|
} catch (err) {
|
|
getEvent()?.addWarning(
|
|
`practitioner note decrypt failed: ${
|
|
err instanceof Error ? err.message : String(err)
|
|
}`,
|
|
);
|
|
return null;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* A contact field (phone, address): the ciphertext when the row has one, the
|
|
* legacy readable column otherwise. Fail-soft on the ciphertext, like the note.
|
|
*/
|
|
export function readPractitionerContact(
|
|
ciphertext: Uint8Array | null,
|
|
legacy: string | null,
|
|
field: "phone" | "location",
|
|
): string | null {
|
|
if (!ciphertext || ciphertext.byteLength === 0) return legacy;
|
|
try {
|
|
return decryptFromBytes(ciphertext);
|
|
} catch (err) {
|
|
getEvent()?.addWarning(
|
|
`practitioner ${field} decrypt failed: ${
|
|
err instanceof Error ? err.message : String(err)
|
|
}`,
|
|
);
|
|
return null;
|
|
}
|
|
}
|
|
|
|
export function toPractitionerDTO(row: Practitioner): PractitionerDTO {
|
|
return {
|
|
id: row.id,
|
|
name: row.name,
|
|
specialty: row.specialty,
|
|
practice: row.practice,
|
|
location: readPractitionerContact(
|
|
row.locationEncrypted,
|
|
row.location,
|
|
"location",
|
|
),
|
|
phone: readPractitionerContact(row.phoneEncrypted, row.phone, "phone"),
|
|
note: decryptPractitionerNote(row.noteEncrypted),
|
|
createdAt: row.createdAt.toISOString(),
|
|
updatedAt: row.updatedAt.toISOString(),
|
|
};
|
|
}
|