The methods are synchronous because custom-field values are encrypted/decrypted inside a TypeORM value transformer, which does not support asynchronous operation.
This is configured via the systemOptions.encryptionStrategy property of your VendureConfig.
InjectableStrategy(plaintext: string) => stringEncrypts the given plaintext, returning a string which can be stored in the database.
(ciphertext: string) => stringDecrypts a value previously produced by encrypt(), returning the original plaintext.
(value: string) => booleanReturns true if the given value was produced by this strategy's encrypt() method. This is
used to detect secret values at the point they are returned from the API, without needing to
know which config arg or custom field they came from.
() => booleanReturns true if the strategy has everything it needs to encrypt and decrypt (e.g. a valid
key). This is used at bootstrap to fail fast if secret fields are configured but the
strategy is not usable.
The default EncryptionStrategy, which uses AES-256-GCM. The encryption key is derived from
the secret passed to the strategy. The secret is not read from the environment by the strategy
itself; instead you provide it explicitly in your config, typically from an environment variable:
Example
The secret must remain stable across restarts and deployments: if it changes, existing encrypted data can no longer be decrypted.
EncryptionStrategyArchitecture reviews, custom plugin work, migrations, ongoing support. Get a hand from the team that builds Vendure.
Talk to the team