feat: sqlite disk encryption

examples/react-electron/vite.config.ts

@@ -24,13 +24,13 @@ export default defineConfig({
         path.resolve(__dirname, "../../packages/web/dist"),
         path.resolve(
           __dirname,
-          "../../node_modules/@sqlite.org/sqlite-wasm/sqlite-wasm/jswasm",
+          "../../node_modules/@evolu/sqlite-wasm/sqlite-wasm/jswasm",
         ),
       ],
     },
   },
   optimizeDeps: {
-    exclude: ["@sqlite.org/sqlite-wasm", "kysely", "@evolu/react-web"],
+    exclude: ["@evolu/sqlite-wasm", "kysely", "@evolu/react-web"],
   },
   assetsInclude: ["**/*.wasm"],
 });

examples/react-expo/app.json

@@ -35,7 +35,11 @@
           "backgroundColor": "#ffffff"
         }
       ],
-      "expo-sqlite"
+      [
+        "expo-sqlite", {
+          "useSqlCipher": true
+        }
+      ]
     ],
     "experiments": {
       "typedRoutes": true,

examples/react-expo/metro.config.js

@@ -4,4 +4,16 @@ const { getDefaultConfig } = require("expo/metro-config");
 /** @type {import("expo/metro-config").MetroConfig} */
 const config = getDefaultConfig(__dirname);
 
+// Add wasm asset support
+config.resolver.assetExts.push('wasm');
+
+// Add COEP and COOP headers to support SharedArrayBuffer
+config.server.enhanceMiddleware = (middleware) => {
+  return (req, res, next) => {
+    res.setHeader('Cross-Origin-Embedder-Policy', 'credentialless');
+    res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+    middleware(req, res, next);
+  };
+};
+
 module.exports = config;

examples/react-vite-pwa/src/components/EvoluMinimalExample.tsx

@@ -39,9 +39,9 @@ const evolu = Evolu.createEvolu(evoluReactWebDeps)(Schema, {
   name: Evolu.SimpleName.orThrow(
     `${service}-${authResult?.owner?.id ?? "guest"}`,
   ),
-  externalAppOwner: authResult?.owner,
   reloadUrl: "/",
-
+  encryptionKey: authResult?.owner?.encryptionKey,
+  externalAppOwner: authResult?.owner,
   ...(process.env.NODE_ENV === "development" && {
     transports: [{ type: "WebSocket", url: "ws://localhost:4000" }],
   }),

examples/react-vite-pwa/vite.config.ts

@@ -7,7 +7,7 @@ import { VitePWA } from "vite-plugin-pwa";
 export default defineConfig({
   cacheDir: ".vite",
   optimizeDeps: {
-    exclude: ["@sqlite.org/sqlite-wasm", "kysely", "@evolu/react-web"],
+    exclude: ["@evolu/sqlite-wasm", "kysely", "@evolu/react-web"],
   },
   plugins: [
     tailwindcss(),
@@ -41,5 +41,15 @@ export default defineConfig({
         type: "module",
       },
     }),
+    {
+      name: "configure-response-headers",
+      configureServer: (server) => {
+        server.middlewares.use((_req, res, next) => {
+          res.setHeader("Cross-Origin-Embedder-Policy", "require-corp");
+          res.setHeader("Cross-Origin-Opener-Policy", "same-origin");
+          next();
+        });
+      },
+    },
   ],
 });

examples/svelte-vite-pwa/vite.config.ts

@@ -17,6 +17,6 @@ export default defineConfig({
   ],
   optimizeDeps: {
     // A workaround for Vite bug: https://github.com/vitejs/vite/issues/13314#issuecomment-1560745780
-    exclude: ["@sqlite.org/sqlite-wasm", "kysely", "@evolu/react-web"],
+    exclude: ["@evolu/sqlite-wasm", "kysely", "@evolu/react-web"],
   },
 });

packages/common/src/Evolu/Db.ts

@@ -7,6 +7,7 @@ import {
 import { ConsoleConfig, ConsoleDep } from "../Console.js";
 import {
   createSymmetricCrypto,
+  EncryptionKey,
   RandomBytesDep,
   SymmetricCryptoDecryptError,
 } from "../Crypto.js";
@@ -174,6 +175,7 @@ export interface DbConfig extends ConsoleConfig, TimestampConfig {
    * The default value is: `false`.
    */
   readonly inMemory?: boolean;
+  readonly encryptionKey?: EncryptionKey;
 }
 
 export const defaultDbConfig: DbConfig = {
@@ -339,6 +341,7 @@ const createDbWorkerDeps =
       initMessage.config.name,
       {
         memory: initMessage.config.inMemory ?? false,
+        encryptionKey: initMessage.config.encryptionKey ?? undefined,
       },
     );
     if (!sqliteResult.ok) {

packages/common/src/Sqlite.ts

@@ -1,5 +1,6 @@
 import { Brand } from "./Brand.js";
 import { ConsoleDep } from "./Console.js";
+import { EncryptionKey } from "./Crypto.js";
 import { createTransferableError, TransferableError } from "./Error.js";
 import { err, ok, Result, tryAsync, trySync } from "./Result.js";
 import { Null, Number, SimpleName, String, Uint8Array, union } from "./Type.js";
@@ -25,6 +26,7 @@ export interface CreateSqliteDriverDep {
 
 export interface SqliteDriverOptions {
   memory?: boolean;
+  encryptionKey?: EncryptionKey | undefined;
 }
 
 /**

packages/react-native/src/providers/ExpoSqliteDriver.ts

@@ -3,6 +3,7 @@ import {
   CreateSqliteDriver,
   SqliteDriver,
   SqliteRow,
+  bytesToHex,
 } from "@evolu/common";
 
 import { openDatabaseSync, SQLiteStatement } from "expo-sqlite";
@@ -11,6 +12,13 @@ export const createExpoSqliteDriver: CreateSqliteDriver = (name, options) => {
   const db = openDatabaseSync(
     options?.memory ? ":memory:" : `evolu1-${name}.db`,
   );
+  if (options?.encryptionKey) {
+    db.execSync(`
+      PRAGMA cipher = 'sqlcipher';
+      PRAGMA legacy = 4;
+      PRAGMA key = "x'${bytesToHex(options.encryptionKey)}'";
+    `);
+  }
   let isDisposed = false;
 
   const cache = createPreparedStatementsCache<SQLiteStatement>(

packages/react-native/src/providers/OpSqliteDriver.ts

@@ -5,6 +5,7 @@ import {
   CreateSqliteDriver,
   SqliteDriver,
   SqliteRow,
+  bytesToHex,
 } from "@evolu/common";
 
 import { open, PreparedStatement } from "@op-engineering/op-sqlite";
@@ -14,7 +15,12 @@ export const createOpSqliteDriver: CreateSqliteDriver = (name, options) => {
   const db = open(
     options?.memory
       ? { name: `inMemoryDb`, location: ":memory:" }
-      : { name: `evolu1-${name}.db` },
+      : {
+          name: `evolu1-${name}.db`,
+          ...(options?.encryptionKey && {
+            encryptionKey: `x'${bytesToHex(options.encryptionKey)}'`,
+          }),
+        }
   );
   let isDisposed = false;
 

packages/web/package.json

@@ -36,8 +36,8 @@
     "format": "prettier --write \"src/*.{ts,tsx,md}\""
   },
   "dependencies": {
-    "@sqlite.org/sqlite-wasm": "3.50.4-build1",
-    "idb-keyval": "^6.2.2"
+    "idb-keyval": "^6.2.2",
+    "@evolu/sqlite-wasm": "2.2.4"
   },
   "devDependencies": {
     "@evolu/common": "workspace:*",

packages/web/src/WasmSqliteDriver.ts

@@ -4,8 +4,12 @@ import {
   CreateSqliteDriver,
   SqliteDriver,
   SqliteRow,
+  bytesToHex,
 } from "@evolu/common";
-import sqlite3InitModule, { PreparedStatement } from "@sqlite.org/sqlite-wasm";
+import sqlite3InitModule, {
+  PreparedStatement,
+  Database,
+} from "@evolu/sqlite-wasm";
 
 // TODO: Do we still need that?
 // https://github.com/sqlite/sqlite-wasm/issues/62
@@ -22,12 +26,29 @@ export const createWasmSqliteDriver: CreateSqliteDriver = async (
   options,
 ) => {
   const sqlite3 = await sqlite3Promise;
+  // This is used to make OPFS default vfs for multipleciphers
+  // @ts-expect-error Missing types (update @evolu/sqlite-wasm types)
+  // eslint-disable-next-line @typescript-eslint/no-unsafe-call
+  sqlite3.capi.sqlite3mc_vfs_create("opfs", 1);
+
+  let db: Database;
+  if (options?.memory) {
+    db = new sqlite3.oo1.DB(":memory:");
+  } else if (options?.encryptionKey) {
+    const pool = await sqlite3.installOpfsSAHPoolVfs({ directory: `.${name}` });
+    db = new pool.OpfsSAHPoolDb(
+      "file:evolu1.db?vfs=multipleciphers-opfs-sahpool",
+    );
+    db.exec(`
+      PRAGMA cipher = 'sqlcipher';
+      PRAGMA legacy = 4;
+      PRAGMA key = "x'${bytesToHex(options.encryptionKey)}'";
+    `);
+  } else {
+    const pool = await sqlite3.installOpfsSAHPoolVfs({ name });
+    db = new pool.OpfsSAHPoolDb("file:evolu1.db");
+  }
 
-  const db = options?.memory
-    ? new sqlite3.oo1.DB(":memory:")
-    : new (await sqlite3.installOpfsSAHPoolVfs({ name })).OpfsSAHPoolDb(
-        "/evolu1.db",
-      );
   let isDisposed = false;
 
   const cache = createPreparedStatementsCache<PreparedStatement>(