Migration support

How do I migrate an existing unencrypted field to encrypted with mango4j-crypto?

Use @EnableMigrationSupport alongside @Encrypt to temporarily exempt a field from the usual rule that encrypted fields must be transient. This lets the old persisted plaintext field remain available while a backfill completes. It takes a completedBy date and a justification; the framework logs a warning before that date and an error after it. The annotation records a temporary exception; the application still needs a controlled backfill, dual-read/write behaviour where needed, monitoring, and removal of the exception once migration is complete.

mango4j-crypto doesn't track backfill completeness for you, so the application has to detect it: for a field with no encrypted data at all yet, that's a query for WHERE <encrypted column> IS NULL - it stays null until encrypt() has run on that record once. That check doesn't apply to a record that already has other @Encrypt fields (its ciphertext column is already non-null); adding one more encrypted field to an already-managed entity rides along with an ordinary rekey-style sweep instead, since decrypt()/encrypt() already touch every @Encrypt field together - the extra step there is making sure the new field's legacy value is set on the entity first, since decrypt() can't produce a value that was never in the original ciphertext. See Migrating Unencrypted Fields for both worked through in code.