# Encryption And Decryption

## Purpose

The service exposes encryption and decryption helpers through Python wrappers and schema component/function execution.

Main files:

- `encrypt_decrypt.py`
- `static/php/enc.php`
- `static/php/dec.php`

## Implementation

`EncryptDecrypt.encrypt(message)` shells out to:

```bash
php /api-wrapper/static/php/enc.php <message>
```

`EncryptDecrypt.decrypt(message)` shells out to:

```bash
php /api-wrapper/static/php/dec.php <message>
```

The PHP scripts use AES-128-CBC with HMAC SHA-256 and base64 encoding.

## Schema Usage

Encryption and decryption can be called from:

- `helper_functions.execute_function()`
- `Components.execute_component()`

Example component-style reference:

```text
encrypt->$request.phone
decrypt->$request.encrypted_phone
```

## Runtime Dependency

PHP CLI must be installed and available in the runtime environment.

The Dockerfile installs PHP:

```text
apt-get install ... php ...
```

## Path Note

`encrypt_decrypt.py` uses:

```python
php_path = '/api-wrapper/static/php/'
```

This path matches the Docker container layout. Local direct runs may need matching path assumptions or code adjustment.

## Failure Modes

| Symptom | Likely Cause |
| --- | --- |
| Empty encrypted/decrypted value | PHP command failed or message missing |
| Local run cannot find PHP script | Hardcoded `/api-wrapper/static/php/` path does not exist locally |
| Decryption returns original bundle | HMAC validation failed or input was not encrypted by matching helper |

## Documentation Requirement

When an endpoint encrypts or decrypts fields, document:

- field names
- direction of transformation
- whether encrypted or plain value is persisted
- whether clients send encrypted or plain input