{"id":34701151,"url":"https://github.com/cipherstash/demo-sydjs-oct-2025","last_synced_at":"2026-05-22T20:32:30.685Z","repository":{"id":320163695,"uuid":"1081046073","full_name":"cipherstash/demo-sydjs-oct-2025","owner":"cipherstash","description":null,"archived":false,"fork":false,"pushed_at":"2026-01-28T07:08:41.000Z","size":95,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-28T22:56:40.310Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cipherstash.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-10-22T08:28:30.000Z","updated_at":"2026-01-28T07:04:13.000Z","dependencies_parsed_at":"2025-10-22T10:23:35.104Z","dependency_job_id":"3b4c0251-aadf-41fe-8232-4e5faf0bf39a","html_url":"https://github.com/cipherstash/demo-sydjs-oct-2025","commit_stats":null,"previous_names":["cipherstash/demo-sydjs-oct-2025"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/cipherstash/demo-sydjs-oct-2025","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cipherstash%2Fdemo-sydjs-oct-2025","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cipherstash%2Fdemo-sydjs-oct-2025/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cipherstash%2Fdemo-sydjs-oct-2025/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cipherstash%2Fdemo-sydjs-oct-2025/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cipherstash","download_url":"https://codeload.github.com/cipherstash/demo-sydjs-oct-2025/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cipherstash%2Fdemo-sydjs-oct-2025/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33366520,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-21T12:23:38.849Z","status":"online","status_checked_at":"2026-05-22T02:00:06.671Z","response_time":265,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-12-24T22:52:08.204Z","updated_at":"2026-05-22T20:32:30.680Z","avatar_url":"https://github.com/cipherstash.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CipherStash Demo Repository\n\nThis repository contains three types of demos showcasing CipherStash's encryption solutions:\n\n1. **DynamoDB with CipherStash Protect** - Application-level encryption for DynamoDB\n2. **PostgreSQL with CipherStash Proxy** - Transparent encryption via JSONB proxy configuration\n3. **PostgreSQL with CipherStash Protect** - Direct database encryption with Drizzle ORM\n\n---\n\n## Prerequisites\n\nBefore running demos, ensure you have:\n\n- [ ] **Docker** and Docker Compose installed\n- [ ] **flox** installed ([installation guide](https://flox.dev/docs))\n- [ ] CipherStash account credentials (for production proxy features)\n\n\u003e **Note**: Node.js (v24) and pnpm (v10.14.0) are automatically installed and managed by the flox environment - no manual installation needed!\n\n---\n\n## Initial Setup\n\n### 1. Activate Flox Environment\n\n```bash\nflox activate\n```\n\nThis will automatically:\n- Install Node.js v24.7.0\n- Install pnpm v10.14.0\n- Run `pnpm install --frozen-lockfile` to install all dependencies\n- Set up environment variables and helpful aliases\n\n\u003e **Tip**: The `load-env` alias is available to load environment variables from 1Password (requires 1Password CLI authentication).\n\n### 2. Environment Configuration\n\n**Option A: Using 1Password CLI (Recommended for teams)**\n\nIf you have 1Password CLI set up and a `.env.tpl` template file:\n\n```bash\nop signin  # Authenticate with 1Password CLI\nload-env   # Load environment variables from 1Password\n```\n\n**Option B: Manual .env file**\n\nCreate a `.env` file in the project root with your CipherStash credentials:\n\n```env\n# CipherStash Credentials\nCS_...\n```\n\n### 3. Start Infrastructure\n\nStart the required services (DynamoDB Local, PostgreSQL, and CipherStash Proxy):\n\n```bash\ndocker compose up -d\n```\n\nThis starts:\n- **DynamoDB Local** on port `8000`\n- **PostgreSQL** on port `5432` (credentials: `postgres`/`password`)\n- **CipherStash Proxy** on port `6432` (PostgreSQL proxy) and `9930` (Prometheus metrics)\n\nVerify services are running:\n```bash\ndocker compose ps\n```\n\n---\n\n## Demo 1: DynamoDB with CipherStash Protect\n\n**Use Case**: Show customers how to encrypt DynamoDB data at the application level with searchable encryption.\n\n### Available Scripts\n\n#### Setup DynamoDB Table\n```bash\npnpm run dynamo:setup-table\n```\nCreates the `users` table in DynamoDB Local with the required schema.\n\n#### Insert and Encrypt User Data\n```bash\npnpm run dynamo:example\n```\n**What it demonstrates:**\n- Encrypts user data (name, email) using CipherStash Protect\n- Shows both raw encrypted data and DynamoDB-formatted encrypted data\n- Stores encrypted data in DynamoDB\n- Retrieves and decrypts the data to verify functionality\n\n**Expected Output:**\n- Encrypted user data structure\n- Confirmation of successful storage\n- Decrypted user data showing original values\n\n#### Search Encrypted Data\n```bash\npnpm run dynamo:search-user user@example.com\n```\n**What it demonstrates:**\n- Creates searchable HMAC tokens from plaintext email\n- Queries DynamoDB using encrypted search terms\n- Decrypts and displays matching results\n\n**Key Talking Points:**\n- Encryption happens client-side before data reaches DynamoDB\n- Search works on encrypted data using cryptographic HMACs\n- Zero plaintext exposure in database\n- Compatible with existing AWS SDK operations\n\n---\n\n## Demo 2: PostgreSQL with CipherStash Proxy (JSONB)\n\n**Use Case**: Show transparent encryption for PostgreSQL JSONB columns without changing application code.\n\n### Available Scripts\n\n#### Setup Proxy Configuration\n```bash\npnpm run postgres:proxy:setup-proxy-config\n```\n**What it does:**\n- Uploads encryption configuration to CipherStash Proxy\n- Configures which JSONB fields to encrypt (email, dateOfBirth, salary)\n- Sets up searchable encryption indexes\n\n**Important**: Run this before inserting any data when demonstrating proxy capabilities.\n\n#### Insert Encrypted User Data\n```bash\npnpm run postgres:proxy:insert-user\n```\n**What it demonstrates:**\n- Application sends plaintext data to proxy\n- Proxy transparently encrypts before writing to PostgreSQL\n- JSONB column contains encrypted data in database\n\n#### Query Encrypted Data\n```bash\npnpm run postgres:proxy:query\n```\n**What it demonstrates:**\n- Application queries through proxy (port 6432)\n- Proxy transparently decrypts data\n- Application receives plaintext results\n- Zero code changes required in application\n\n**Key Talking Points:**\n- Drop-in replacement - just change connection port (5432 → 6432)\n- No application code changes needed\n- Encryption/decryption handled by proxy\n- Compatible with any PostgreSQL client library\n- Works with JSONB data structures\n\n---\n\n## Demo 3: PostgreSQL with CipherStash Protect (Direct)\n\n**Use Case**: Show direct encryption in PostgreSQL applications using Drizzle ORM for more control.\n\n### Available Scripts\n\n#### Setup Proxy Encryption Configuration\n```bash\npnpm run postgres:protect:add-encryption-schema\n```\n**What it does:**\n- Configures CipherStash Proxy for the Protect schema\n- Required if using Protect with Proxy together\n\n#### Insert Encrypted User Data\n```bash\npnpm run postgres:protect:insert\n```\n**What it demonstrates:**\n- Encrypts data client-side using CipherStash Protect SDK\n- Stores encrypted values in dedicated columns (`encrypted_email`, `encrypted_dob`, `encrypted_salary`)\n- Works with Drizzle ORM for type-safe queries\n\n#### List All Users\n```bash\npnpm run postgres:protect:list-users\n```\n**What it demonstrates:**\n- Retrieves encrypted data from PostgreSQL\n- Bulk decrypts multiple records efficiently\n- Returns plaintext data to application\n\n#### Search by Email\n```bash\npnpm run postgres:protect:search user@example.com\n```\n**What it demonstrates:**\n- Generates encrypted search terms from plaintext email\n- Queries PostgreSQL using encrypted equality search\n- Works with Drizzle ORM's query builder\n- Returns matching encrypted records\n\n**Key Talking Points:**\n- More control over encryption than proxy approach\n- Type-safe with Drizzle ORM\n- Supports complex queries with encrypted search terms\n- Encryption happens in application code\n- Dedicated encrypted columns in schema\n\n---\n\n## Troubleshooting\n\n### Docker Containers Not Starting\n```bash\n# Check container logs\ndocker compose logs dynamo\ndocker compose logs postgres\ndocker compose logs proxy\n\n# Restart all services\ndocker compose down\ndocker compose up -d\n```\n\n### DynamoDB Connection Errors\n- Ensure DynamoDB Local is running on port 8000\n- Check `docker compose ps` shows `cipherstash-demo-dynamodb` as running\n\n### PostgreSQL Connection Errors\n- Verify PostgreSQL is healthy: `docker compose ps`\n- Test direct connection: `psql -h localhost -p 5432 -U postgres -d postgres`\n- Test proxy connection: `psql -h localhost -p 6432 -U postgres -d postgres`\n- Password is `password`\n\n### CipherStash Proxy Issues\n- Verify `.env` file contains valid credentials\n- Check proxy logs: `docker compose logs proxy`\n- Ensure all the `CS_` environment variables are set correctly\n\n### Missing Dependencies\n```bash\n# Exit and re-activate flox environment\nexit  # Exit current flox shell\nflox activate  # Re-activate to reinstall dependencies\n\n# Or manually clean and reinstall\nrm -rf node_modules pnpm-lock.yaml\npnpm install\n```\n\n---\n\n## Cleaning Up\n\n### Reset All Data\n```bash\n# Stop and remove all containers, volumes\ndocker compose down -v\n\n# Remove node_modules\nrm -rf node_modules\n\n# Fresh start\npnpm install\ndocker compose up -d\n```\n\n### Rebuild Docker Containers\n```bash\ndocker compose down\ndocker compose pull  # Get latest CipherStash Proxy\ndocker compose up -d\n```\n\n---\n\n## Additional Resources\n\n- [CipherStash Documentation](https://docs.cipherstash.com)\n- [CipherStash Protect SDK](https://cipherstash.com/docs/protect/sdk/js)\n- [CipherStash Proxy Documentation](https://cipherstash.com/docs/devops/proxy)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcipherstash%2Fdemo-sydjs-oct-2025","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcipherstash%2Fdemo-sydjs-oct-2025","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcipherstash%2Fdemo-sydjs-oct-2025/lists"}