Encryption¶

Client.db_params (the database strategy's parameters, including the database password) is stored encrypted with Fernet. Code reads and writes plain values; the fields encrypt on the way in and decrypt on the way out.

Encryption covers the database columns only. The registry caches Client objects with these values decrypted; see Known constraints.

The key¶

Generate a key:

python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

The Fernet instance is built once per process (get_fernet() is cached). After changing the key at runtime, for example with override_settings in a test, call crypto.get_fernet.cache_clear().

EncryptedTextField¶

A TextField whose database value is a Fernet token. Empty strings and None are stored as they are. Not searchable or indexable: the same value encrypts differently each time.

When a stored value is not a valid token for the current key, reading it returns the raw stored value instead of failing. Plain-text values written before encryption was introduced therefore keep working (they are encrypted on the next save), but with a wrong key the field returns the encrypted token itself, and the connection or the IdP rejects it as a bad credential.

EncryptedJSONField¶

A TextField holding a JSON value (usually a dict), stored as a Fernet token. Code reads and writes Python objects; the admin edits it as JSON text. No JSON lookups, ordering or indexing: the database only sees ciphertext.

Use them in your own models:

from django_db_tenants.fields import EncryptedJSONField, EncryptedTextField


class Integration(models.Model):
    api_token = EncryptedTextField(blank=True)
    settings = EncryptedJSONField(default=dict, blank=True)

description = 'Encrypted text'

get_prep_value(value)

from_db_value(value, expression, connection)

description = 'Encrypted JSON'

get_prep_value(value)

from_db_value(value, expression, connection)

to_python(value)

value_to_string(obj)

formfield(**kwargs)

get_fernet() -> Fernet

encrypt(value: str) -> str

decrypt(token: str) -> str