feat: add support for sensitive Declarative settings values encryption

Signed-off-by: Andrey Borysenko <andrey18106x@gmail.com>

Author: andrey18106

lib/Db/UI/SettingsForm.php

@@ -47,6 +47,16 @@ public function __construct(array $params = []) {
 		}
 	}
 
+	public function getSchemaField(string $fieldId): ?array {
+		$scheme = $this->getScheme();
+		foreach ($scheme['fields'] as $field) {
+			if ($field['id'] === $fieldId) {
+				return $field;
+			}
+		}
+		return null;
+	}
+
 	public function jsonSerialize(): array {
 		return [
 			'id' => $this->getId(),

lib/Listener/DeclarativeSettings/GetValueListener.php

@@ -14,17 +14,21 @@
 use OCA\AppAPI\Service\UI\SettingsService;
 use OCP\EventDispatcher\Event;
 use OCP\EventDispatcher\IEventListener;
+use OCP\Security\ICrypto;
 use OCP\Settings\DeclarativeSettingsTypes;
 use OCP\Settings\Events\DeclarativeSettingsGetValueEvent;
+use Psr\Log\LoggerInterface;
 
 /**
  * @template-implements IEventListener<Event>
  */
 class GetValueListener implements IEventListener {
 	public function __construct(
-		private readonly SettingsService        $service,
+		private readonly SettingsService $service,
 		private readonly ExAppPreferenceService $preferenceService,
-		private readonly ExAppConfigService     $configService,
+		private readonly ExAppConfigService $configService,
+		private readonly ICrypto $crypto,
+		private readonly LoggerInterface $logger,
 	) {
 	}
 
@@ -38,9 +42,19 @@ public function handle(Event $event): void {
 			return;
 		}
 		$formSchema = $settingsForm->getScheme();
+		$field = $settingsForm->getSchemaField($event->getFieldId());
+		$isSensitive = isset($field['sensitive']) && $field['sensitive'] === true;
 		if ($formSchema['section_type'] === DeclarativeSettingsTypes::SECTION_TYPE_ADMIN) {
 			$existingValue = $this->configService->getAppConfig($event->getApp(), $event->getFieldId());
 			if (!empty($existingValue)) {
+				if ($isSensitive) {
+					try {
+						$encryptedValue = $this->crypto->decrypt($existingValue->getConfigvalue());
+						$existingValue->setConfigvalue($encryptedValue);
+					} catch (\Exception $e) {
+						$existingValue->setConfigvalue('');
+					}
+				}
 				$event->setValue($existingValue->getConfigvalue());
 				return;
 			}
@@ -51,6 +65,15 @@ public function handle(Event $event): void {
 				[$event->getFieldId()],
 			);
 			if (!empty($existingValue)) {
+				if ($isSensitive) {
+					try {
+						$encryptedValue = $this->crypto->decrypt($existingValue[0]['configvalue']);
+						$existingValue[0]['configvalue'] = $encryptedValue;
+					} catch (\Exception $e) {
+						$this->logger->warning('Failed to decrypt declarative setting.', ['exception' => $e]);
+						$existingValue[0]['configvalue'] = '';
+					}
+				}
 				$event->setValue($existingValue[0]['configvalue']);
 				return;
 			}

lib/Listener/DeclarativeSettings/SetValueListener.php

@@ -14,17 +14,21 @@
 use OCA\AppAPI\Service\UI\SettingsService;
 use OCP\EventDispatcher\Event;
 use OCP\EventDispatcher\IEventListener;
+use OCP\Security\ICrypto;
 use OCP\Settings\DeclarativeSettingsTypes;
 use OCP\Settings\Events\DeclarativeSettingsSetValueEvent;
+use Psr\Log\LoggerInterface;
 
 /**
  * @template-implements IEventListener<Event>
  */
 class SetValueListener implements IEventListener {
 	public function __construct(
-		private readonly SettingsService        $service,
+		private readonly SettingsService $service,
 		private readonly ExAppPreferenceService $preferenceService,
-		private readonly ExAppConfigService     $configService,
+		private readonly ExAppConfigService $configService,
+		private readonly ICrypto $crypto,
+		private readonly LoggerInterface $logger,
 	) {
 	}
 
@@ -38,11 +42,26 @@ public function handle(Event $event): void {
 			return;
 		}
 		$formSchema = $settingsForm->getScheme();
+		$field = $settingsForm->getSchemaField($event->getFieldId());
+		$isSensitive = isset($field['sensitive']) && $field['sensitive'] === true;
+		$value = $event->getValue();
+		if ($isSensitive) {
+			try {
+				$encryptedValue = $this->crypto->encrypt($value);
+				$value = $encryptedValue;
+			} catch (\Exception $e) {
+				$this->logger->warning(
+					sprintf('Failed to encrypt sensitive value for app %s, field %s', $event->getApp(), $event->getFieldId()),
+					['exception' => $e, 'app' => $event->getApp()]
+				);
+				return;
+			}
+		}
 		if ($formSchema['section_type'] === DeclarativeSettingsTypes::SECTION_TYPE_ADMIN) {
-			$this->configService->setAppConfigValue($event->getApp(), $event->getFieldId(), $event->getValue());
+			$this->configService->setAppConfigValue($event->getApp(), $event->getFieldId(), $value);
 		} else {
 			$this->preferenceService->setUserConfigValue(
-				$event->getUser()->getUID(), $event->getApp(), $event->getFieldId(), $event->getValue()
+				$event->getUser()->getUID(), $event->getApp(), $event->getFieldId(), $value
 			);
 		}
 	}