Feature to Encrypt user email in database

.env.sample

@@ -104,4 +104,20 @@ MINIO_DATA_DIR=
 
 # this environment variable is for setting the environment variable for Image Upload size
 
-IMAGE_SIZE_LIMIT_KB=3000
+IMAGE_SIZE_LIMIT_KB=3000
+
+# This environment variable provides the encryption key for securing user email addresses.
+# Format: Base64-encoded 32-byte key
+# Generation: Use a cryptographically secure method to generate this key
+# WARNING: Keep this value secret and never commit it to version control
+ENCRYPTION_KEY=
+
+# This environment variable provides additional entropy for email hashing
+# Format: Random string of at least 32 characters
+# Generation: Use a cryptographically secure random string generator
+# Example generation: openssl rand -hex 32
+# Example format: HASH_PEPPER=YOUR_HEX_STRING
+# WARNING: Keep this value secret and never commit it to version control
+# NOTE: Changing this value will invalidate all existing email hashes.
+#       Ensure database migration strategy is in place before changing.
+HASH_PEPPER=

.github/workflows/pull-request.yml

@@ -218,6 +218,9 @@ jobs:
       LAST_RESORT_SUPERADMIN_EMAIL: "abc@gmail.com"
       COLORIZE_LOGS: "true"
       LOG_LEVEL: "info"
+      ENCRYPTION_KEY: ${{secrets.ENCRYPTION_KEY}}
+      HASH_PEPPER: ${{secrets.HASH_PEPPER}}
+
       # ACCESS_TOKEN_SECRET: ${{ secrets.ACCESS_TOKEN_SECRET }}
       # REFRESH_TOKEN_SECRET: ${{ secrets.REFRESH_TOKEN_SECRET }}
 

sample_data/defaultUser.json

@@ -10,7 +10,8 @@
     "pluginCreationAllowed": true,
     "firstName": "Default",
     "lastName": "Admin",
-    "email": "defaultadmin@example.com",
+    "email": "SAMPLE_IV:SAMPLE_SALT:SAMPLE_ENCRYPTED_EMAIL",
+    "hashedEmail": "SAMPLE_HASHED_EMAIL_VALUE",
     "password": "$2a$12$bSYpay6TRMpTOaAmYPFXku4avwmqfFBtmgg39TabxmtFEiz4plFtW",
     "image": null,
     "createdAt": "2023-04-13T04:53:17.742Z",