Property Encryption

var config = Config.builder()
        .withPropertyEncryptionProfiles(profiles) (1)
        .build();

/**
 * A service responsible for encapsulating and decapsulating keys.
 * <p>
 * Implementations may perform blocking operations. The driver adapts synchronous operations to its asynchronous
 * execution model using the {@link #executor()}.
 * <p>
 * Implementations MUST supply 256-bit AES keys only.
 *
 * @see KeyEncapsulationOptions
 * @see KeyEncapsulationResult
 * @see KeyEncapsulationServices
 * @since 6.3.0
 */
@Preview(name = "Property Encryption")
public non-sealed interface KeyEncapsulationService extends BaseKeyEncapsulationService {
    /**
     * Creates a new key, encapsulates it and returns the result.
     *
     * @param options the encapsulation options
     * @return the encapsulation result
     */
    KeyEncapsulationResult encapsulate(KeyEncapsulationOptions options);

    /**
     * Decapsulates encapsulated bytes.
     *
     * @param encapsulation the encapsulated bytes, must not be {@code null}
     * @param metadata      the key metadata, must not be {@code null}
     * @return the decapsulated key
     */
    SecretKey decapsulate(byte[] encapsulation, Map<String, String> metadata);
}

/**
 * A repository for {@link EncapsulatedKeyRecord} data.
 * <p>
 * Implementations may perform blocking operations. The driver adapts synchronous operations to its asynchronous
 * execution model using the {@link #executor()}.
 * <p>
 * Implementations MUST enforce alias uniqueness and generate globally unique and immutable key identifiers.
 *
 * @since 6.3.0
 */
@Preview(name = "Property Encryption")
public non-sealed interface EncapsulatedKeyRecordRepository extends BaseEncapsulatedKeyRecordRepository {
    /**
     * Finds and returns an {@link EncapsulatedKeyRecord} by its id.
     *
     * @param id the key id, must not be {@literal null}
     * @return an {@link Optional} containing the key, or {@link Optional#empty()} if no key with the given id exists
     */
    Optional<EncapsulatedKeyRecord> findById(String id);

    /**
     * Finds and returns an {@link EncapsulatedKeyRecord} by its alias.
     *
     * @param alias the key alias, must not be {@literal null}
     * @return an {@link Optional} containing the key, or {@link Optional#empty()} if no key with the given alias exists
     */
    Optional<EncapsulatedKeyRecord> findByAlias(String alias);

    /**
     * Creates the encapsulation as a key and assigns it a globally unique id.
     * <p>
     * The generated id MUST be globally unique and immutable. Implementations SHOULD use a mechanism designed to
     * generate globally unique identifiers, such as UUIDs.
     *
     * @param alias         the key alias, may be {@literal null}
     * @param encapsulation the key encapsulation, must not be {@literal null}
     * @param metadata      the key metadata, must not be {@literal null}
     * @return the created key
     */
    EncapsulatedKeyRecord create(String alias, byte[] encapsulation, Map<String, String> metadata);

    /**
     * Sets the alias of an encapsulated key by id. The alias must not be used by another key. To assign an alias
     * currently used by another key, it must first be deleted from that key.
     *
     * @param id    the key id, must not be {@literal null}
     * @param alias the key alias, may be {@literal null} to remove the alias
     */
    void setAliasById(String id, String alias);

    /**
     * Deletes a key by id.
     *
     * @param id the key id, must not be {@literal null}
     */
    void deleteById(String id);
}

/**
 * A sample {@link EncapsulatedKeyRecordRepository} implementation using Cypher 5.
 */
class Neo4jEncapsulatedKeyRecordRepository implements EncapsulatedKeyRecordRepository {
    private static final List<String> CONSTRAINTS = List.of(
            """
                    CYPHER 5
                    CREATE CONSTRAINT key_id IF NOT EXISTS
                    FOR (k:Key)
                    REQUIRE k.id IS UNIQUE
                    """,
            """
                    CYPHER 5
                    CREATE CONSTRAINT key_alias IF NOT EXISTS
                    FOR (k:Key)
                    REQUIRE k.alias IS UNIQUE
                    """
    );
    private static final String CREATE_QUERY = """
            CYPHER 5
            CREATE (key:Key {
                id: randomUUID(),
                alias: $alias,
                encapsulation: $encapsulation
            })-[:HAS_METADATA]->(metadata:KeyMetadata $metadata)
            RETURN key, metadata
            """;
    private static final String FIND_BY_ID_QUERY = """
            CYPHER 5
            MATCH (key:Key {id: $id})-[:HAS_METADATA]->(metadata:KeyMetadata)
            RETURN key, metadata
            LIMIT 1
            """;
    private static final String FIND_BY_ALIAS_QUERY = """
            CYPHER 5
            MATCH (key:Key {alias: $alias})-[:HAS_METADATA]->(metadata:KeyMetadata)
            RETURN key, metadata
            LIMIT 1
            """;
    private static final String SET_ALIAS_BY_ID_QUERY = """
            CYPHER 5
            MATCH (key:Key {id: $id})
            SET key.alias = $alias
            """;
    private static final String DELETE_BY_ID_QUERY = """
            CYPHER 5
            MATCH (key:Key {id: $id})-[:HAS_METADATA]->(metadata:KeyMetadata)
            DETACH DELETE key, metadata
            """;

    private final Driver driver;
    private final QueryConfig writeQueryConfig;
    private final QueryConfig readQueryConfig;

    Neo4jEncapsulatedKeyRecordRepository(Driver driver, String database) {
        this.driver = driver;
        this.writeQueryConfig = QueryConfig.builder()
                .withDatabase(database)
                .build();
        this.readQueryConfig = QueryConfig.builder()
                .withDatabase(database)
                .withRouting(RoutingControl.READ)
                .build();
    }

    public void createConstraints() {
        CONSTRAINTS.forEach(constraint -> driver.executableQuery(constraint)
                .withConfig(writeQueryConfig)
                .execute());
    }

    @Override
    public Optional<EncapsulatedKeyRecord> findById(String id) {
        var result = driver.executableQuery(FIND_BY_ID_QUERY)
                .withParameters(Map.of("id", id))
                .withConfig(readQueryConfig)
                .execute();
        return result.records().stream()
                .findFirst()
                .map(this::toEncapsulatedKeyRecord);
    }

    @Override
    public Optional<EncapsulatedKeyRecord> findByAlias(String alias) {
        var result = driver.executableQuery(FIND_BY_ALIAS_QUERY)
                .withParameters(Map.of("alias", alias))
                .withConfig(readQueryConfig)
                .execute();
        return result.records().stream()
                .findFirst()
                .map(this::toEncapsulatedKeyRecord);
    }

    @Override
    public EncapsulatedKeyRecord create(String alias, byte[] encapsulation, Map<String, String> metadata) {
        var result = driver.executableQuery(CREATE_QUERY)
                .withParameters(Map.of("alias", Values.value((Object) alias), "encapsulation", encapsulation, "metadata", metadata))
                .withConfig(writeQueryConfig)
                .execute();
        return toEncapsulatedKeyRecord(result.records().get(0));
    }

    @Override
    public void setAliasById(String id, String alias) {
        driver.executableQuery(SET_ALIAS_BY_ID_QUERY)
                .withParameters(Map.of("id", id, "alias", alias))
                .withConfig(writeQueryConfig)
                .execute();
    }

    @Override
    public void deleteById(String id) {
        driver.executableQuery(DELETE_BY_ID_QUERY)
                .withParameters(Map.of("id", id))
                .withConfig(writeQueryConfig)
                .execute();
    }

    private EncapsulatedKeyRecord toEncapsulatedKeyRecord(Record record) {
        var key = record.get("key").asNode();
        var metadata = record.get("metadata").asNode();

        var id = key.get("id").asString();
        var alias = key.get("alias").asString(null);
        var encapsulation = key.get("encapsulation").asByteArray();
        var meta = metadata.asMap(Value::asString);

        return EncapsulatedKeyRecord.of(id, alias, encapsulation, meta);
    }
}

PropertyEncryption propertyEncryption = driver.propertyEncryption();