Make DefaultEncryptionService use libsodium

[amh4r]

Summary

Change DefaultEncryptionService in @inngest/middleware-encryption to use libsodium. This is a breaking change.

Standardizing our SDKs' encryption middlewares on libsodium allows for easy interoperability. For example, our TypeScript SDK could send an encrypted event to our Python SDK.

Todo

• Make two middleware for proper support 🫠
• Async encrypt/decrypt

Checklist

• Added a docs PR that references this PR N/A Documented in-package
• Added unit/integration tests
• Added changesets if applicable

[changeset-bot]

🦋 Changeset detected

Latest commit: 44b1ab6

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@inngest/middleware-encryption	Major

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[jpwilliams]

inngest-js/packages/middleware-encryption/MIGRATION.md

Lines 1 to 66 in 80e45b5

	# Migration
	This covers how to migrate between the major versions of this middleware
	## v0 -> v1
	We've changed some tooling and standards in v1 to align with other languages,
	ensuring we can provide easier cross-language E2E encryption.
	If you only use the middleware on a single service/app and only passed a `key`
	as required, you can upgrade with no changes. Otherwise, read on.
	### Field-level event encryption removed
	In v0, you could customize which fields in an event would be encrypted. By
	default this was the `encrypted` field, but you could choose any top-level
	fields.
	To help avoid users forgetting to encrypt fields containing sensitive data (or
	misplacing that data), an entire event's payload is now encrypted.
	If you customized field-level encryption in v0, move the option to the new
	`v0Legacy` object:
	```ts
	const mw = encryptionMiddleware({
	// ...
	legacyV0Service: {
	eventEncryptionField: ["my", "custom", "fields"],
	},
	});
	```
	### Changing multiple apps
	If multiple apps used the v0 encryption middleware, you can slowly migrate to
	the new Sodium standard by forcing encryption to use the v0 strategy but still
	be able to decrypt with the new one.
	> [!NOTE]
	> Note that if you use a custom encryption service, you won't have to perform
	> any upgrades here; this is only as we are changing the default strategy.
	To force encryption using the v0 strategy, set the `forceEncryptWithV0` option:
	```ts
	const mw = encryptionMiddleware({
	// ...
	legacyV0Service: {
	forceEncryptWithV0: true,
	},
	});
	```
	Then, your rollout is:
	1. Update all apps to use v1 with `forceEncryptWithV0: true`
	2. Once all apps are updated and deployed, remove the `forceEncryptWithV0` flag
	or set it to `false`
	### Encryption service identifiers
	Each encryption service now requires an `identifier`, used to ensure the correct
	strategy is being used to decrypt data when it is received.
	If you're not using a custom encryption service, no change is needed here.

[jpwilliams]

Warning

Holding merge until Python is also ready.

[inngest-release-bot]

A user has added the prerelease/inngest label, so this PR will be published to npm with the tag pr-555. It will be updated with the latest changes as you push commits to this PR.

You can install this prerelease version with:

npm install inngest@pr-555

The last release was built and published from 17e7107.

[inngest-release-bot]

A user has added the prerelease/middleware-encryption label, so this PR will be published to npm with the tag pr-555. It will be updated with the latest changes as you push commits to this PR.

You can install this prerelease version with:

npm install @inngest/middleware-encryption@pr-555

The last release was built and published from 44b1ab6.