feat(sqlite): support encrypting column values through SQL functions

[chirag-bruno]

Statements can wrap values in bruno_encrypt / bruno_decrypt, registered as SQLite functions from a codec passed to createDatabase. Injecting the codec keeps the package free of an electron dependency; bruno-electron supplies Bruno's existing encryption utilities.

Registration runs before the migrations so a later backfill migration can use the same functions. Opening without a codec warns and stores values unchanged.

No statement uses the functions yet, so there is no behaviour change on its own.

Ticket: BRU-4509

Summary by CodeRabbit

• New Features

  • Added support for encrypting sensitive SQLite data at rest.
  • Added safe decryption handling for unreadable or legacy values, preventing application failures.
  • Added compatibility for databases and migrations that do not use encryption.

• Bug Fixes

  • Preserved existing values during partial updates when some encrypted fields are omitted.
  • Prevented incomplete writes when encryption fails.

• Tests

  • Added coverage for encryption, decryption, migration compatibility, fallback behavior, and failure handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: fd38e2c3-6726-4508-93ad-daa5eb9000be

📥 Commits

Reviewing files that changed from the base of the PR and between a161abf and 292fe95.

📒 Files selected for processing (8)

• packages/bruno-electron/src/ipc/sqlite.js
• packages/bruno-electron/src/ipc/sqlite.spec.js
• packages/bruno-sqlite/scripts/verify-migrations.ts
• packages/bruno-sqlite/src/node/codec.ts
• packages/bruno-sqlite/src/node/db.ts
• packages/bruno-sqlite/src/node/index.ts
• packages/bruno-sqlite/tests/node/codec.spec.ts
• packages/bruno-sqlite/tests/node/migrations.spec.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The change adds a SQLite codec abstraction with nullable transforms, registers codec functions during database creation, connects Electron safe-storage encryption, updates migration verification, and adds tests for encrypted storage and failure behavior.

Changes

SQLite codec integration

Layer / File(s)	Summary
Codec contract and database registration packages/bruno-sqlite/src/node/codec.ts, packages/bruno-sqlite/src/node/db.ts, packages/bruno-sqlite/src/node/index.ts	Adds codec types, SQLite function names, nullable transforms, passthrough behavior, codec registration, optional database configuration, registration failure cleanup, and public exports.
Database codec behavior tests packages/bruno-sqlite/tests/node/codec.spec.ts, packages/bruno-sqlite/tests/node/migrations.spec.ts	Tests encrypted writes, decrypted reads, partial writes, fallback behavior, registration order, plaintext fallback, write failures, and warning handling.
Electron encryption integration packages/bruno-electron/src/ipc/sqlite.js, packages/bruno-electron/src/ipc/sqlite.spec.js	Connects SQLite codec operations to Electron safe storage and tests round trips, ciphertext, legacy rows, and undecryptable values.
Migration verification support packages/bruno-sqlite/scripts/verify-migrations.ts	Uses the passthrough codec for the migration verification database.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 292fe

This adds SQLite encryption/decryption functions and connects Electron safe storage without changing existing statements. The implementation preserves null handling and has coverage for encryption, fallback, and failure cases, so it is ready to merge.

Sequence Diagram(s)

sequenceDiagram
  participant ElectronSQLite
  participant DB
  participant SQLite
  participant SafeStorage
  ElectronSQLite->>DB: create database with codec
  DB->>SQLite: register bruno_encrypt and bruno_decrypt
  SQLite->>SafeStorage: encrypt or decrypt value
  SafeStorage-->>SQLite: return transformed value

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 8…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding SQLite SQL functions for encrypting and decrypting column values.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Codec threads through SQLite bright
Secrets sleep beyond plain sight
Nulls remain where nulls belong
Tests guard each stored song
Safe storage keeps the flow strong}

_{Comment @coderabbitai help to get the list of available commands.}