A set of fields that wrap standard Django fields with encryption provided Piiano Vault.
Project description
Django Encrypted Model Fields
About
This library allows you to specify specific fields to encrypt in your Django models using Vault's API in a transparent manner, taking advantage of Vault's advanced capabilities. This helps you:
- Achieve compliance with various privacy standards
- Implement TTL or expiration for data
- Get Masked or transformed versions of your data
- Rely on Vault's permission model
This is a fork of https://gitlab.com/lansharkconsulting/django/django-encrypted-model-fields which in turn is a fork of https://github.com/foundertherapy/django-cryptographic-fields. It has been renamed, and updated to support encryption through Piiano Vault's API.
Usage
First install the library:
pip install django-encryption
Add to your settings.py
(Example in here):
VAULT_ADDRESS
VAULT_API_KEY
VAULT_DEFAULT_COLLECTION
Note it is best practice to provideVAULT_ADDRESS
andVAULT_API_KEY
via environment variables in production- Add
django_encryption
toINSTALLED_APPS
In your models.py
(Example in here):
- Import any desired field type, for example:
from django_encryption.fields import EncryptedCharField
-
For each model field you would like to encrypt, replace the field name with any of the fields you imported in step 1 (For example,
EncryptedCharField
).You can customize the field by providing additional parameters such as:
encryption_type
(optional) - Can beEncryptionType.randomized
orEncryptionType.deterministic
expiration_secs
(optional) - An integer or None. If an integer, the number of seconds before the encrypted data is expired, and cannot be decrypted anymore. Works only with randomizedencryption_type
vault_collection
(optional) - The name of the vault collection that this field is related to. Defaults tosettings.VAULT_DEFAULT_COLLECTION
vault_property
(optional) - The name of the property in the vault collection that this field is related to. Defaults to the name of the field in django.data_type_name
(optional) - The name of the data type in vault. Defaults to 'string'. This only has impact when generating a vault migration, and does not change the way your django model would behave.
Note: use
vault_collection
together withvault_property
to specify the collection and property in vault that represent this field. This is important for permission control and audit logs. For more advanced use-cases, this would allow you to transition smoothly to using Vault as a secure storage for PII data.
Query your model as usual:
- Caveat: right now, an API call to vault will be generated for each field in each Model instance you encrypt or decrypt. In the future this will be batched.
You can wrap your queries with: with fields.mask_field(MyModel.my_field):
(or transform
or with_reason
):
- This tells the encryption SDK to mask the values of MyModel.my_field. So for example, for an SSN you would get "*--6789".
- All vault's supported transformations are also supported using the
transform
context manager. See Built-in transformations in Vault's API documentation for a list of Vault's supported transformations.
Sample code
from django.db import models
from django_encryption.fields import EncryptedCharField, EncryptedEmailField, EncryptedDateField, EncryptionType
class Customer(models.Model):
name = EncryptedCharField()
email = EncryptedEmailField()
phone = EncryptedCharField()
address = EncryptedCharField(encryption_type=EncryptionType.randomized, expiration_secs=10)
ssn = EncryptedCharField(encryption_type=EncryptionType.randomized)
dob = EncryptedDateField()
You can see a full working example in our sample.
Installation for local development
- Clone the repo
- Make sure you have python poetry installed on your machine (a global installation)
- cd into the directory of the repo (sdk/orm-django)
Run the following commands:
poetry install
poetry shell
- On a Mac with vscode:
code .
To run tests: python manage.py test
- Tests should also be available from within vscode.
NOTE Make sure you have a local copy of vault running on your machine. To do so, follow the Installations Instructions.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Hashes for django_encryption-0.1.0-py3-none-any.whl
Algorithm | Hash digest | |
---|---|---|
SHA256 | 965b6719bca99c878044e1f4ddf6d4abc2be96c384b85a074584e0bfed58c593 |
|
MD5 | 45e2f19cbfda42fe6346f1263c36b5be |
|
BLAKE2b-256 | 5e8d6d26f994b99dfee18641048bbd82d7387e0caf55bf835d9698ddc5533b39 |