From a2408aebffe04c125a0b60b01635a2f81c0e3ce3 Mon Sep 17 00:00:00 2001
From: lebaudantoine <lebaud.antoine131@gmail.com>
Date: Sat, 4 Jan 2025 23:58:49 +0100
Subject: [PATCH] wip encrypt and encode passphrase while storing it in cache

---
 src/backend/core/utils.py                  | 19 ++++++++++++++-----
 src/backend/meet/settings.py               |  2 ++
 src/helm/env.d/dev/values.meet.yaml.gotmpl |  1 +
 3 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/src/backend/core/utils.py b/src/backend/core/utils.py
index 11d233af..2ff28135 100644
--- a/src/backend/core/utils.py
+++ b/src/backend/core/utils.py
@@ -18,6 +18,9 @@ import secrets
 import string
 
 from django.core.cache import cache
+from cryptography.fernet import Fernet
+
+import base64
 
 
 def generate_random_passphrase(length=26):
@@ -28,15 +31,21 @@ def generate_random_passphrase(length=26):
 def get_cached_passphrase(room_id):
     """Get or generate a cached passphrase for a room slug"""
 
+    cypher = Fernet(settings.PASSPHRASE_ENCRYPTION_KEY.encode())
+
     # todo - discuss this hardcoded key prefix
-    passphrase = cache.get(f"room_passphrase:{room_id}")
+    encrypted_passphrase = cache.get(f"room_passphrase:{room_id}")
 
-    if passphrase is None:
+    if encrypted_passphrase is None:
         passphrase = generate_random_passphrase()
-        # Store in cache with a timeout (e.g., 24 hours = 86400 seconds)
-        cache.set(f"room_passphrase:{room_id}", passphrase, timeout=86400)
+        encrypted_passphrase = cypher.encrypt(passphrase.encode()).decode()
 
-    return passphrase
+        # Store in cache with a timeout (e.g., 24 hours = 86400 seconds)
+        cache.set(f"room_passphrase:{room_id}", encrypted_passphrase, timeout=86400)
+
+        return passphrase
+
+    return cypher.decrypt(encrypted_passphrase.encode()).decode()
 
 
 def generate_color(identity: str) -> str:
diff --git a/src/backend/meet/settings.py b/src/backend/meet/settings.py
index 9b30d2de..e0b599b3 100755
--- a/src/backend/meet/settings.py
+++ b/src/backend/meet/settings.py
@@ -483,6 +483,8 @@ class Base(Configuration):
     )
     BREVO_API_CONTACT_ATTRIBUTES = values.DictValue({"VISIO_USER": True})
 
+    PASSPHRASE_ENCRYPTION_KEY = values.Value(environ_name="PASSPHRASE_ENCRYPTION_KEY", environ_prefix=None)
+
     # pylint: disable=invalid-name
     @property
     def ENVIRONMENT(self):
diff --git a/src/helm/env.d/dev/values.meet.yaml.gotmpl b/src/helm/env.d/dev/values.meet.yaml.gotmpl
index a73a41f3..d8957965 100644
--- a/src/helm/env.d/dev/values.meet.yaml.gotmpl
+++ b/src/helm/env.d/dev/values.meet.yaml.gotmpl
@@ -61,6 +61,7 @@ backend:
     RECORDING_STORAGE_EVENT_TOKEN: password
     SUMMARY_SERVICE_ENDPOINT: http://meet-summary:80/api/v1/tasks/
     SUMMARY_SERVICE_API_TOKEN: password
+    PASSPHRASE_ENCRYPTION_KEY: lT3cX5dzFhCe-9xNjXUiTCX00r2ZgHgGUJKO66x-QIo=
 
 
   migrate: