Encryption of sensitive data

[junaidferoz]

Overview

This PR introduces generic application-layer field-level encryption for sensitive user data using AES-256-GCM.

---

Changes

Core encryption

• Added encryption.js utility with AES-256-GCM encrypt/decrypt helpers and key management
• Added generic encryption hooks to GlobalChangeTrackingPlugin — models declare encryptedFields and encryption/decryption happens automatically on all writes and reads
• Added key rotation support — re-encrypts all fields in all models in a single transactional pass
• Added automatic encryption state sync — server detects ENCRYPTION_ENABLED changes on startup and encrypts or decrypts all affected fields automatically

Encrypted user fields

The following user model fields are now encrypted at rest:

Category	Fields
Profile	firstName, lastName, email, initialPassword, salt
Auth	twoFactorOtp, totpSecret, samlNameId
External identity	orcidId, ldapUsername, extId

---

New user-facing behaviour

• Sensitive user profile and authentication values are now encrypted at rest in the database
• Encryption can be toggled via ENCRYPTION_ENABLED in .env — the server applies the change automatically on next startup

---

New developer API

backend/utils/encryption.js

• encrypt(plaintext, key?) — AES-256-GCM encryption with Base64 serialisation; accepts an optional explicit key
• decrypt(value) — always uses the stored key

Model-level

• encryptedFields option on model definitions for declarative field-level encryption — any model that declares it is automatically covered by all bulk operations

Bulk operations

• encryptAllModels(db) / decryptAllModels(db) — bulk encrypt/decrypt all fields across all models that declare encryptedFields

Key rotation

• reEncryptAllModels(db, newKey) / reEncryptValue(value, newKey) — old key read from encryption.key, new key passed explicitly
• backend/scripts/changeEncryptionKey.js + make change_encryption_key NEW_KEY=<hex> — CLI for key rotation without server downtime

Startup sync

• syncEncryptionState(db) — compares ENCRYPTION_ENABLED against encryption.state on startup and triggers encrypt/decrypt automatically if the flag changed

Migration

• 20260612100001-encrypt-user-fields simplified to use encryptAllModels / decryptAllModels — new models with encryptedFields are automatically covered without migration changes

---

Known limitations

• ENCRYPTION_ENABLED is detected at server startup only — changing the flag requires a restart
• encryption.state tracks the last known flag value; on first startup after the migration the state file is created without re-encrypting (migration handles initial encryption)

---

Future steps

• Extend encryptedFields to other tables as needed — no migration or script changes required

[dennis-zyska]

@bingobongomann the code looks good, could you test it locally, if it works, we can merge

[bingobongomann]

@bingobongomann the code looks good, could you test it locally, if it works, we can merge

Looks good. The User Table of a newly set up server is encrypted. New encryption key was generated during the migration.
Frontend works as normal.

[bingobongomann]

Implementation looks good, encryption and decryption work well and are correctly updating the DB when the env is changed.
Left one comment about make change_encryption_key to add optional generation of a new key if none is provided

[bingobongomann]

Looks Good now! Encryption can be updated via command line.

The only thing missing is the decrypted database backup command and then we can merge this

[bingobongomann]

sidecar backup looks good, adding constraints and hooks for BlindIndexes looks good too.
Just need Documentation and some clarification about existing unique fields.

[karimouf]

this is ready @bingobongomann

[dennis-zyska]

The up() and down() here have a lot of duplicate code. Can we reuse the code from backend/utils/helper/encryption.js instead? It already has encryptAllModels/decryptAllModels (via _applyToAllModels)

[dennis-zyska]

I think we also need to encrypt extId, but it is currently an Integer. Maybe we should change it to String, but we need to make sure that it will still work everywhere, maybe need a parse to int when requesting Moodle (needs testing).

[dennis-zyska]

addEncryptionHooks is not registering beforeBulkUpdate, which is called by Model.update(...), e.g. from User.resetUserPwd() (backend/db/models/user.js:511). It would write the salt in plaintext to the database.