feat(sqlite): encrypt stored runner request and response

[chirag-bruno]

Runner exchanges store full request and response bodies, including authorization headers and tokens, as plaintext in bruno.db. Both columns now go through bruno_encrypt on write and bruno_decrypt on read.

Stacked on #9209, merge that first. Until then this PR's diff includes its commit.

Ticket: BRU-4510

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: d027da71-c3a1-40cd-bad9-c5d27ae05958

📥 Commits

Reviewing files that changed from the base of the PR and between a161abf and 7b76bb8.

📒 Files selected for processing (9)

• packages/bruno-electron/src/ipc/sqlite.js
• packages/bruno-electron/src/ipc/sqlite.spec.js
• packages/bruno-sqlite/scripts/verify-migrations.ts
• packages/bruno-sqlite/src/node/codec.ts
• packages/bruno-sqlite/src/node/db.ts
• packages/bruno-sqlite/src/node/index.ts
• packages/bruno-sqlite/statements/runner_responses.sql
• packages/bruno-sqlite/tests/node/codec.spec.ts
• packages/bruno-sqlite/tests/node/migrations.spec.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

Walkthrough

The change adds SQLite codec support for encrypted values. It registers encryption and decryption functions before migrations, updates runner response SQL, wires the Electron codec, preserves null updates, and adds integration tests.

Changes

SQLite codec integration

Layer / File(s)	Summary
Codec contract and database registration packages/bruno-sqlite/src/node/codec.ts, packages/bruno-sqlite/src/node/db.ts, packages/bruno-sqlite/src/node/index.ts, packages/bruno-sqlite/scripts/verify-migrations.ts	Defines the Codec contract, registers codec functions before migrations, supports passthrough behavior, warns when encryption is not configured, and exposes the codec API.
Encrypted storage and Electron wiring packages/bruno-sqlite/statements/runner_responses.sql, packages/bruno-electron/src/ipc/sqlite.js	Encrypts non-null runner request and response values, preserves stored values for null inputs, decrypts retrieved values, and passes the Electron codec into database creation.
Codec behavior validation packages/bruno-sqlite/tests/node/codec.spec.ts, packages/bruno-electron/src/ipc/sqlite.spec.js, packages/bruno-sqlite/tests/node/migrations.spec.ts	Tests encrypted round trips, ciphertext storage, fallback behavior, registration timing, plaintext passthrough, rollback, and Electron codec behavior.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 7b76b

Runner request and response bodies are now encrypted in SQLite and decrypted on retrieval, with Electron supplying the encryption codec. The current change includes coverage for the new persistence behavior and has no identified merge-blocking risk.

Sequence Diagram(s)

sequenceDiagram
  participant ElectronIPC
  participant DB
  participant SQLite
  ElectronIPC->>DB: Create database with codec
  DB->>SQLite: Register bruno_encrypt and bruno_decrypt
  SQLite->>SQLite: Encrypt runner response values
  SQLite-->>DB: Decrypt values during retrieval

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 8…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: encrypting stored runner request and response data in SQLite.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Encrypted strings now cross the gate
Nulls keep old values in their state
SQLite registers functions bright
Tests check the day and night
Electron wires the codec right}

_{Comment @coderabbitai help to get the list of available commands.}