Step 1: Encrypt Credit Card Data

This step selects the synthetic card number for encryption while retaining authored display fields such as the last four digits and brand. Review those retained values independently before adapting the pattern.

The Goal

You will transform the payment object by:

1. Encrypting the card_number into a new card_number_encrypted field.
2. Extracting the card_last_four and card_brand for analytics.
3. Deleting the original, plaintext card_number.

Input Snippet:

{
  "payment": {
    "card_number": "4532-1234-5678-9010",
    "expiration": "12/27"
  }
}

Desired Output Snippet:

{
  "payment": {
    "expiration": "12/27",
    "card_number_encrypted": "AES256GCM:v1:...",
    "card_last_four": "9010",
    "card_brand": "visa"
  }
}

Implementation

1. Start with the Foundation: Copy encryption-foundation.yaml to a new file, encrypt-card.yaml.

   cp examples/data-security/encryption-foundation.yaml encrypt-card.yaml

2. Add the Encryption Logic: Open encrypt-card.yaml and add the following mapping processor to the pipeline section. This single processor performs the entire transformation.

   Add this to the 'processors' array in encrypt-card.yaml

   - mapping: |
       # Clean the card number of any spaces or dashes
       let clean_card = this.payment.card_number.re_replace_all("[^0-9]", "")
   
       # Encrypt the full, clean card number
       root.payment.card_number_encrypted = clean_card.encrypt_aes("gcm", env("CARD_ENCRYPTION_KEY"))
   
       # Extract the last 4 digits for analytics and customer service
       root.payment.card_last_four = clean_card.slice(-4)
   
       # Detect the card brand from the first digit (BIN range)
       root.payment.card_brand = if clean_card.has_prefix("4") {
         "visa"
       } else if clean_card.re_match("^5[1-5].*") {
         "mastercard"
       } else if clean_card.re_match("^3[47].*") {
         "american_express"
       } else {
         "unknown"
       }
   
       # CRITICAL: Remove the original plaintext card number field
       root.payment = this.payment.without("card_number")

   Note: Remember to set the CARD_ENCRYPTION_KEY environment variable as described in the setup.mdx guide.

3. Deploy and Test:

   # Send the sample payment data from the setup step
   curl -X POST http://localhost:8080/events/payment \
     -H "Content-Type: application/json" \
     -d @/tmp/encryption-test/sample-payment.json

4. Verify: Check your logs. You will see that the card_number field is gone, replaced by card_number_encrypted, card_last_four, and card_brand.

The reference now shows the payment-field selection pattern. It has not been executed or assessed against a deployed threat model.