47ng / prisma-field-encryption

Transparent field-level encryption at rest for Prisma
https://github.com/franky47/prisma-field-encryption-sandbox
MIT License
223 stars 27 forks source link

'where' conversion is wrong for OR/AND/NOT operators #62

Closed martijn-dev closed 1 year ago

martijn-dev commented 1 year ago

The situation is the following:

The prisma schema:

model Visitor {
  id             String            @id @default(uuid())
  name           String? /// @encrypted
  nameHash       String? /// @encryption:hash(name)
  identifier     String /// @encrypted
  identifierHash String? /// @encryption:hash(identifier)

  @@map("visitors")
}

I would like to search for multiple visitors with a specific name or identifier. So I will do the following:

  this.prisma.visitor.findMany({
        where: {
          OR: [
            {
              identifier: 'test@mail.com'
            },
            {
              name: 'test'
            }
          ]
        }
      })

This results in the following SQL query;

SELECT "public"."visitors"."id", "public"."visitors"."name", "public"."visitors"."nameHash", "public"."visitors"."identifier", "public"."visitors"."identifierHash" FROM "public"."visitors" WHERE (("public"."visitors"."identifier" = "v1.aesgcm256.1234567.xxxxxxxxxxxxxxxxxx" AND "public"."visitors"."identifierHash" = "xxxxxxxxxxxx-hash-xxxxxx") OR ("public"."visitors"."name" = "v1.aesgcm256.1234567.xxxxxxxxxxxxxxxxxx" AND "public"."visitors"."nameHash" = "xxxxxxxxxxxx-hash-xxxxxx")) OFFSET 0

Which won't work since it is searching for the encrypted value together with the hash value. I would expect the query to be like:

SELECT "public"."visitors"."id", "public"."visitors"."name", "public"."visitors"."nameHash", "public"."visitors"."identifier", "public"."visitors"."identifierHash" FROM "public"."visitors" WHERE ("public"."visitors"."identifierHash" = "xxxxxxxxxxxx-hash-xxxxxx" OR "public"."visitors"."nameHash" = "xxxxxxxxxxxx-hash-xxxxxx") OFFSET 0

So only searching on the hash values.

The same seems to occur when I use AND and NOT operators in my where query.

Please let me know if you need more information!

franky47 commented 1 year ago

Ah, this looks like a regression in the last version, I'll fix it right away, thanks for the report!

github-actions[bot] commented 1 year ago

:tada: This issue has been resolved in version 1.4.3 :tada:

The release is available on:

Your semantic-release bot :package::rocket:

martijn-dev commented 1 year ago

Wow that was fast, you're a hero! 🎉 Thanks!