Merge pull request #27 from code-with-antonio/28-encrypting-credentials

AntonioErdeljac · web-flow · commit 4dd4ea716ce7 · 2025-11-02T15:58:34.000+01:00
28: encrypting credentials
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -60,6 +60,7 @@
     "client-only": "^0.0.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
+    "cryptr": "^6.4.0",
     "date-fns": "^4.1.0",
     "embla-carousel-react": "^8.6.0",
     "handlebars": "^4.7.8",
diff --git a/src/features/credentials/server/routers.ts b/src/features/credentials/server/routers.ts
@@ -3,6 +3,7 @@ import { createTRPCRouter, premiumProcedure, protectedProcedure } from "@/trpc/i
 import z from "zod";
 import { PAGINATION } from "@/config/constants";
 import { CredentialType } from "@/generated/prisma";
+import { encrypt } from "@/lib/encryption";
 
 export const credentialsRouter = createTRPCRouter({
   create: premiumProcedure
@@ -21,7 +22,7 @@ export const credentialsRouter = createTRPCRouter({
           name,
           userId: ctx.auth.user.id,
           type,
-          value, // TODO: Consider encrypting in production
+          value: encrypt(value),
         },
       });
   }),
@@ -52,7 +53,7 @@ export const credentialsRouter = createTRPCRouter({
         data: {
           name,
           type,
-          value, // TODO: Consider encrypting in production
+          value: encrypt(value),
         }
       });
     }),
diff --git a/src/features/executions/components/anthropic/executor.ts b/src/features/executions/components/anthropic/executor.ts
@@ -5,6 +5,7 @@ import { createAnthropic } from "@ai-sdk/anthropic";
 import type { NodeExecutor } from "@/features/executions/types";
 import { anthropicChannel } from "@/inngest/channels/anthropic";
 import prisma from "@/lib/db";
+import { decrypt } from "@/lib/encryption";
 
 Handlebars.registerHelper("json", (context) => {
   const jsonString = JSON.stringify(context, null, 2);
@@ -90,7 +91,7 @@ export const anthropicExecutor: NodeExecutor<AnthropicData> = async ({
   }
 
   const anthropic = createAnthropic({
-    apiKey: credential.value,
+    apiKey: decrypt(credential.value),
   });
 
   try {
diff --git a/src/features/executions/components/gemini/executor.ts b/src/features/executions/components/gemini/executor.ts
@@ -5,6 +5,7 @@ import { createGoogleGenerativeAI } from "@ai-sdk/google";
 import type { NodeExecutor } from "@/features/executions/types";
 import { geminiChannel } from "@/inngest/channels/gemini";
 import prisma from "@/lib/db";
+import { decrypt } from "@/lib/encryption";
 
 Handlebars.registerHelper("json", (context) => {
   const jsonString = JSON.stringify(context, null, 2);
@@ -90,7 +91,7 @@ export const geminiExecutor: NodeExecutor<GeminiData> = async ({
   }
 
   const google = createGoogleGenerativeAI({
-    apiKey: credential.value,
+    apiKey: decrypt(credential.value),
   });
 
   try {
diff --git a/src/features/executions/components/http-request/dialog.tsx b/src/features/executions/components/http-request/dialog.tsx
@@ -45,7 +45,6 @@ const formSchema = z.object({
   body: z
     .string()
     .optional()
-    // .refine() TODO JSON5
 });
 
 export type HttpRequestFormValues = z.infer<typeof formSchema>;
diff --git a/src/features/executions/components/openai/executor.ts b/src/features/executions/components/openai/executor.ts
@@ -5,6 +5,7 @@ import { createOpenAI } from "@ai-sdk/openai";
 import type { NodeExecutor } from "@/features/executions/types";
 import { openAiChannel } from "@/inngest/channels/openai";
 import prisma from "@/lib/db";
+import { decrypt } from "@/lib/encryption";
 
 Handlebars.registerHelper("json", (context) => {
   const jsonString = JSON.stringify(context, null, 2);
@@ -90,7 +91,7 @@ export const openAiExecutor: NodeExecutor<OpenAiData> = async ({
   }
 
   const openai = createOpenAI({
-    apiKey: credential.value,
+    apiKey: decrypt(credential.value),
   });
 
   try {
diff --git a/src/lib/encryption.ts b/src/lib/encryption.ts
@@ -0,0 +1,6 @@
+import Cryptr from "cryptr";
+
+const cryptr = new Cryptr(process.env.ENCRYPTION_KEY!);
+
+export const encrypt = (text: string) => cryptr.encrypt(text);
+export const decrypt = (text: string) => cryptr.decrypt(text);
