Package: django-encryption
Django Encrypted Model FieldsAboutThis library allows you to specify specific fields to encrypt in your Django models using Vault's API in a transparent manner, taking advantage of Vault's advanced capabilities.
This helps you:Achieve compliance with various privacy standardsImplement TTL or expiration for dataGet Masked or transformed versions of your dataRely on Vault's permission modelThis is a fork ofhttps://gitlab.com/lansharkconsulting/django/django-encrypted-model-fieldswhich in turn is a fork ofhttps://github.com/foundertherapy/django-cryptographic-fields. It has
been renamed, and updated to support encryption through Piiano Vault's API.Note:Actively tested with Python 3.11.5. Should work with any Python 3.x.
This package is compatible with Vault version 1.10.3.
For a Vault client compatible with other versions of Vault, checkother versions of this package.UsageFirst install the library:pip install django-encryptionAdd to yoursettings.py(Example inhere):VAULT_ADDRESSVAULT_API_KEYVAULT_DEFAULT_COLLECTIONNoteit is best practice to provideVAULT_ADDRESSandVAULT_API_KEYvia environment variables in productionAdddjango_encryptiontoINSTALLED_APPSIn yourmodels.py(Example inhere):Import any desired field type, for example:fromdjango_encryption.fieldsimportEncryptedCharFieldFor each model field you would like to encrypt, replace the field name with any of the fields you imported in step 1 (For example,EncryptedCharField).You can customize the field by providing additional parameters such as:encryption_type(optional) - Can beEncryptionType.randomizedorEncryptionType.deterministicexpiration_secs(optional) - An integer or None. If an integer, the number of seconds before the encrypted data is expired, and cannot be decrypted anymore. Works only with randomizedencryption_typevault_collection(optional) - The name of the vault collection that this field is related to. Defaults tosettings.VAULT_DEFAULT_COLLECTIONvault_property(optional) - The name of the property in the vault collection that this field is related to. Defaults to the name of the field in django.data_type_name(optional) - The name of the data type in vault. Defaults to 'string'. This only has impact when generating a vault migration, and does not change the way your django model would behave.eager(default:true) - whether or not value will be decrypted (in a batch operation) as soon as it is fetched from the DB. If not, the value will be decrypted the first time it is accessed.Note: usevault_collectiontogether withvault_propertyto specify the collection and property in vault that represent this field. This is important for permission control and audit logs. For more advanced use-cases, this would allow you to transition smoothly to using Vault as a secure storage for PII data.Query your model as usual, keeping the following in mind:Read queries are batched. Reading from the Database will generate a single API call per field. Writing to the Database is not batched and will generate an API call for each field in each instance.By default all fields are eagerly fetched - similarly to calling prefetch_related(field_name) on a foreign key.The SDK also supports masking and other vault transformations by using mask(MyModel.my_field) or transform('transformation-name', MyModel.my_field) as part of the query.This tells the encryption SDK to mask the values of MyModel.my_field. So for example, for an SSN you would get "*--6789".All vault's supported transformations are also supported using thetransformcontext manager. SeeBuilt-in transformationsin Vault's API documentation for a list of Vault's supported transformations.Sample codefrom django.db import models
from django_encryption.fields import EncryptedCharField, EncryptedEmailField, EncryptedDateField, EncryptionType


class Customer(models.Model):
    name = EncryptedCharField(data_type_name='NAME')
    email = EncryptedEmailField(data_type_name='EMAIL')
    phone = EncryptedCharField(
        data_type_name='PHONE_NUMBER', null=True, blank=True)
    ssn = EncryptedCharField(
        encryption_type=EncryptionType.randomized, data_type_name='SSN', null=True, blank=True)
    dob = EncryptedDateField(
        data_type_name='DATE_OF_BIRTH', null=True, blank=True)
    state = models.CharField(max_length=100, null=True, blank=True)You can see a full working example inour sample.Installation for local development (with VSCode)Clone the repo:git clone https://github.com/piiano/vault-pythonEnsure you havepython poetryinstalled on your machine (a global installation). Example:pipx install poetryRun the following commands from thesdk/orm-djangodirectory:poetry install
poetry shell
code .To run tests:python manage.py test. Tests should also be available from within vscode.NOTEMake sure you have a local copy of vault running on your machine. To do so, follow theInstallations Instructions.