ObjectStackEncryption
Encryption protocol schemas
Source: packages/spec/src/system/encryption.zod.ts
TypeScript Usage
import { EncryptionAlgorithmSchema, EncryptionConfigSchema, FieldEncryptionSchema, KeyManagementProviderSchema, KeyRotationPolicySchema } from '@objectstack/spec/system';
import type { EncryptionAlgorithm, EncryptionConfig, FieldEncryption, KeyManagementProvider, KeyRotationPolicy } from '@objectstack/spec/system';
// Validate data
const result = EncryptionAlgorithmSchema.parse(data);EncryptionAlgorithm
Supported encryption algorithm
Allowed Values
aes-256-gcmaes-256-cbcchacha20-poly1305
EncryptionConfig
Field-level encryption configuration
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| enabled | boolean | optional (default: false) | Enable field-level encryption |
| algorithm | Enum<'aes-256-gcm' | 'aes-256-cbc' | 'chacha20-poly1305'> | optional (default: "aes-256-gcm") | Encryption algorithm |
| keyManagement | { provider: Enum<'local' | 'aws-kms' | 'azure-key-vault' | 'gcp-kms' | 'hashicorp-vault'>; keyId?: string; rotationPolicy?: object } | ✅ | Key management configuration |
| scope | Enum<'field' | 'record' | 'table' | 'database'> | ✅ | Encryption scope level |
| deterministicEncryption | boolean | optional (default: false) | Allows equality queries on encrypted data |
| searchableEncryption | boolean | optional (default: false) | Allows search on encrypted data |
Nested Shape: EncryptionConfig.keyManagement
| Property | Type | Required | Description |
|---|---|---|---|
| provider | Enum<'local' | 'aws-kms' | 'azure-key-vault' | 'gcp-kms' | 'hashicorp-vault'> | ✅ | Key management service provider |
| keyId | string | optional | Key identifier in the provider |
| rotationPolicy | { enabled: boolean; frequencyDays: number; retainOldVersions: number; autoRotate: boolean } | optional | Key rotation policy |
FieldEncryption
Per-field encryption assignment
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| fieldName | string | ✅ | Name of the field to encrypt |
| encryptionConfig | { enabled: boolean; algorithm: Enum<'aes-256-gcm' | 'aes-256-cbc' | 'chacha20-poly1305'>; keyManagement: object; scope: Enum<'field' | 'record' | 'table' | 'database'>; … } | ✅ | Encryption settings for this field |
| indexable | boolean | optional (default: false) | Allow indexing on encrypted field |
Nested Shape: FieldEncryption.encryptionConfig
| Property | Type | Required | Description |
|---|---|---|---|
| enabled | boolean | optional (default: false) | Enable field-level encryption |
| algorithm | Enum<'aes-256-gcm' | 'aes-256-cbc' | 'chacha20-poly1305'> | optional (default: "aes-256-gcm") | Encryption algorithm |
| keyManagement | { provider: Enum<'local' | 'aws-kms' | 'azure-key-vault' | 'gcp-kms' | 'hashicorp-vault'>; keyId?: string; rotationPolicy?: object } | ✅ | Key management configuration |
| scope | Enum<'field' | 'record' | 'table' | 'database'> | ✅ | Encryption scope level |
| deterministicEncryption | boolean | optional (default: false) | Allows equality queries on encrypted data |
| searchableEncryption | boolean | optional (default: false) | Allows search on encrypted data |
KeyManagementProvider
Key management service provider
Allowed Values
localaws-kmsazure-key-vaultgcp-kmshashicorp-vault
KeyRotationPolicy
Policy for automatic encryption key rotation
Properties
| Property | Type | Required | Description |
|---|---|---|---|
| enabled | boolean | optional (default: false) | Enable automatic key rotation |
| frequencyDays | number | optional (default: 90) | Rotation frequency in days |
| retainOldVersions | number | optional (default: 3) | Number of old key versions to retain |
| autoRotate | boolean | optional (default: true) | Automatically rotate without manual approval |