Chiffrer vos données existantes

import { Mafate } from '@mafate/sdk'
import pg from 'pg'

const mafate = new Mafate({ apiKey: process.env.MAFATE_API_KEY })
const pool = new pg.Pool({ connectionString: process.env.DATABASE_URL })

const BATCH_SIZE = 500
const KEY_ID = 'key-users-pii'

async function backfillUsers() {
  // Compter le total
  const { rows: [{ count }] } = await pool.query(
    'SELECT COUNT(*) as count FROM users WHERE email_encrypted IS NULL'
  )
  const total = parseInt(count)
  console.log(`🔐 ${total} utilisateurs à chiffrer`)

  let processed = 0
  let errors = 0
  const startTime = Date.now()

  while (true) {
    // Récupérer un batch
    const { rows } = await pool.query(`
      SELECT id, email, first_name, last_name, phone, address
      FROM users
      WHERE email_encrypted IS NULL
      ORDER BY id
      LIMIT $1
    `, [BATCH_SIZE])

    if (rows.length === 0) break

    // Chiffrer chaque ligne
    for (const user of rows) {
      try {
        const [encEmail, encFirst, encLast, encPhone, encAddress] = await Promise.all([
          mafate.encryptLocal(user.email || '', KEY_ID),
          mafate.encryptLocal(user.first_name || '', KEY_ID),
          mafate.encryptLocal(user.last_name || '', KEY_ID),
          mafate.encryptLocal(user.phone || '', KEY_ID),
          mafate.encryptLocal(user.address || '', KEY_ID),
        ])

        const emailHash = await mafate.hash((user.email || '').toLowerCase(), KEY_ID)

        await pool.query(`
          UPDATE users SET
            email_encrypted = $1,
            first_name_encrypted = $2,
            last_name_encrypted = $3,
            phone_encrypted = $4,
            address_encrypted = $5,
            email_hash = $6
          WHERE id = $7
        `, [
          JSON.stringify(encEmail),
          JSON.stringify(encFirst),
          JSON.stringify(encLast),
          JSON.stringify(encPhone),
          JSON.stringify(encAddress),
          emailHash,
          user.id,
        ])

        processed++
      } catch (err) {
        errors++
        console.error(`❌ Erreur utilisateur #${user.id}:`, err.message)
        // Continue, on ne bloque pas le batch pour une erreur
      }
    }

    // Progression
    const elapsed = (Date.now() - startTime) / 1000
    const rate = processed / elapsed
    const remaining = (total - processed) / rate
    console.log(
      `📊 ${processed}/${total} (${((processed/total)*100).toFixed(1)}%) ` +
      `| ${rate.toFixed(0)} users/sec | ~${Math.ceil(remaining/60)} min restantes | ${errors} erreurs`
    )
  }

  console.log(`\n✅ Migration terminée : ${processed} chiffrés, ${errors} erreurs`)
}

backfillUsers()

import { Mafate } from '@mafate/sdk'

const mafate = new Mafate({ apiKey: process.env.MAFATE_API_KEY })

async function computeHash(value: string): Promise<string> {
  return await mafate.hash(value.toLowerCase(), 'key-users-pii')
}

// PHASE 1 : Dual-write, écrire les deux versions
// Conserver email en clair ET ajouter email_encrypted
async function saveUser(userId: string, email: string, phone: string) {
  const [encEmail, encPhone] = await Promise.all([
    mafate.encryptLocal(email, 'key-users-pii'),
    mafate.encryptLocal(phone, 'key-users-pii'),
  ])

  await db.query(`
    UPDATE users SET
      email           = $1,                    -- conserver en clair (temporaire)
      phone           = $2,                    -- conserver en clair (temporaire)
      email_encrypted = $3,                    -- ajouter la version chiffrée
      phone_encrypted = $4,                    -- ajouter la version chiffrée
      email_hash      = $5                     -- hash pour la recherche
    WHERE id = $6
  `, [
    email,
    phone,
    JSON.stringify(encEmail),
    JSON.stringify(encPhone),
    await computeHash(email),
    userId,
  ])
}

// PHASE 2 : Lire depuis encrypted, fallback sur plain
async function getUser(emailHash: string) {
  const row = await db.query(
    'SELECT * FROM users WHERE email_hash = $1',
    [emailHash]
  )
  const r = row.rows[0]
  if (!r) return null

  // Lecture depuis la colonne chiffrée avec fallback
  let email: string
  if (r.email_encrypted) {
    email = mafate.decryptLocalToString(JSON.parse(r.email_encrypted))
  } else {
    email = r.email // fallback sur l'ancien champ non chiffré
  }

  return { ...r, email }
}

import { Mafate } from '@mafate/sdk'

const mafate = new Mafate({ apiKey: process.env.MAFATE_API_KEY })
const BATCH_SIZE = 500

async function computeHash(value: string): Promise<string> {
  return await mafate.hash(value.toLowerCase(), 'key-users-pii')
}

async function backfillUsers(): Promise<void> {
  let totalProcessed = 0
  let hasMore = true

  while (hasMore) {
    // Sélectionner un batch d'utilisateurs sans chiffrement
    const { rows } = await db.query(
      'SELECT id, email, phone FROM users WHERE email_encrypted IS NULL LIMIT $1',
      [BATCH_SIZE]
    )

    if (rows.length === 0) {
      hasMore = false
      break
    }

    // Chiffrer en parallèle par batch de 50
    const chunks = chunkArray(rows, 50)
    for (const chunk of chunks) {
      await Promise.all(chunk.map(async (user) => {
        const [encEmail, encPhone] = await Promise.all([
          mafate.encryptLocal(user.email, 'key-users-pii'),
          mafate.encryptLocal(user.phone, 'key-users-pii'),
        ])

        await db.query(
          'UPDATE users SET email_encrypted = $1, phone_encrypted = $2, email_hash = $3 WHERE id = $4',
          [JSON.stringify(encEmail), JSON.stringify(encPhone), await computeHash(user.email), user.id]
        )
      }))
    }

    totalProcessed += rows.length
    console.log(`Backfill en cours : ${totalProcessed} utilisateurs chiffrés`)

    // Pause de 100ms entre les batchs pour ne pas surcharger l'API
    await new Promise(r => setTimeout(r, 100))
  }

  console.log(`Backfill terminé : ${totalProcessed} utilisateurs migrés`)
}

function chunkArray<T>(arr: T[], size: number): T[][] {
  return Array.from({ length: Math.ceil(arr.length / size) }, (_, i) =>
    arr.slice(i * size, i * size + size)
  )
}

// Lancer le backfill
backfillUsers().catch(console.error)