added some tests

fixed some readme issues

Author: ddjerqq

README.md

@@ -17,7 +17,7 @@ This allows you to query the encrypted data without decrypting it first. using `
 
 ## Disclaimer
 
-This project is maintained by [one (tenx) developer](https://github.com/ddjerqq) and is not affiliated with Microsoft.
+This project is maintained by [one (10x) developer](https://github.com/ddjerqq) and is not affiliated with Microsoft.
 
 I made this library to solve my own problems with EFCore. I needed to store a bunch of protected personal data encrypted, among these properties were personal IDs, Emails, SocialSecurityNumbers and so on.
 As you know, you cannot query encrypted data with EFCore, and I wanted a simple yet boilerplate-free solution. Thus, I made this library.
@@ -79,8 +79,6 @@ public class Your(DbContextOptions<Your> options, IDataProtectionProvider dataPr
 `Program.cs`
 
 ```csharp
-builder.Services.AddDbContext<YourDbContext>(/* ... */);
-
 var keyDirectory = new DirectoryInfo("keys");
 builder.Services.AddDataProtectionServices()
     .PersistKeysToFileSystem(keyDirectory);
@@ -90,6 +88,19 @@ builder.Services.AddDataProtectionServices()
 > See the [Microsoft documentation](https://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview) for more
 > information on **how to configure the data protection** services, and how to store your encryption keys securely.
 
+### Configure the data protection options on your DbContext
+
+`Program.cs`
+```csharp
+services.AddDbContext<YourDbContext>(opt => opt
+    .AddDataProtectionInterceptors()
+    .UseSqlite()); // or anything else
+```
+
+> [!WARNING]
+> You **MUST** call `AddDataProtectionInterceptors` if you are using any encrypted properties marked as queryable in your entities.
+> If you are not using any queryable encrypted properties, you can skip this step.
+
 ### Marking your properties as encrypted
 
 There are three ways you can mark your properties as encrypted:
@@ -112,8 +123,8 @@ protected override void OnModelCreating(ModelBuilder builder)
 {
     builder.Entity<User>(entity =>
     {
-        entity.Property(e => e.SocialSecurityNumber).IsEncrypted(true);
-        entity.Property(e => e.IdPicture).IsEncrypted();
+        entity.Property(e => e.SocialSecurityNumber).IsEncrypted(isQueryable: true);
+        entity.Property(e => e.IdPicture).IsEncrypted(isQueryable: false);
     });
 }
 ```
@@ -124,8 +135,8 @@ class UserConfiguration : IEntityTypeConfiguration<User>
 {
     public void Configure(EntityTypeBuilder<User> builder)
     {
-        builder.Property(e => e.SocialSecurityNumber).IsEncrypted(true);
-        builder.Property(e => e.IdPicture).IsEncrypted();
+        builder.Property(e => e.SocialSecurityNumber).IsEncrypted(isQueryable: true);
+        builder.Property(e => e.IdPicture).IsEncrypted(isQueryable: false);
     }
 }
 ```
@@ -143,6 +154,7 @@ var foo = await DbContext.Users
 > [!WARNING]
 > The `QueryableExt.WherePdEquals` method is only available for properties that are marked as Queryable using the `[Encrypt(isQueryable: true)]` attribute or the
 > `IsEncrypted(isQueryable: true)` method.
+> And before using `WherePdEquals` you **MUST** call `AddDataProtectionInterceptors` in your `DbContext` configuration.
 
 > [!TIP]
 > The `WherePdEquals` extension method generates an expression like this one under the hood:<br/>

src/EntityFrameworkCore.DataProtection/Extensions/DbContextOptionsBuilderExt.cs

@@ -0,0 +1,17 @@
+using EntityFrameworkCore.DataProtection.Interceptors;
+using Microsoft.EntityFrameworkCore;
+
+namespace EntityFrameworkCore.DataProtection.Extensions;
+
+/// <summary>
+/// Extension methods for <see cref="DbContextOptionsBuilder"/>.
+/// </summary>
+public static class DbContextOptionsBuilderExt
+{
+    /// <summary>
+    /// Adds the <see cref="ShadowHashSynchronizerSaveChangesInterceptor"/> to the <see cref="DbContextOptionsBuilder"/>.
+    /// This is crucial for synchronizing the shadow property hashes with the actual properties.
+    /// </summary>
+    public static DbContextOptionsBuilder AddDataProtectionInterceptors(this DbContextOptionsBuilder options) =>
+        options.AddInterceptors(ShadowHashSynchronizerSaveChangesInterceptor.Instance);
+}

src/EntityFrameworkCore.DataProtection/Extensions/ModelBuilderExt.cs

@@ -1,7 +1,7 @@
-using System.Reflection;
-using EntityFrameworkCore.DataProtection.ValueConverters;
+using EntityFrameworkCore.DataProtection.ValueConverters;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata;
 
 namespace EntityFrameworkCore.DataProtection.Extensions;
 
@@ -48,50 +48,45 @@ public static ModelBuilder UseDataProtection(this ModelBuilder builder, IDataPro
     {
         var protector = dataProtectionProvider.CreateProtector("EntityFrameworkCore.DataProtection");
 
-        var properties = builder.Model
-            .GetEntityTypes()
-            .SelectMany(type => type.GetProperties())
-            .Select(prop =>
-            {
-                var status = prop.GetEncryptionStatus();
-                return (prop, status.SupportsEncryption, status.SupportsQuerying);
-            })
-            .Where(status => status.SupportsEncryption)
+        var properties = (
+                from prop in builder.Model.GetEntityTypes().SelectMany(type => type.GetProperties())
+                let status = prop.GetEncryptionStatus()
+                where status.SupportsEncryption
+                select (prop, status.SupportsQuerying))
+            // need to collect to a list because it is modified in AddShadowProperty
             .ToList();
 
-        foreach (var (property, _, supportsQuerying) in properties)
+        foreach (var (property, supportsQuerying) in properties)
         {
-            if (supportsQuerying)
-            {
-                var entityType = property.DeclaringType;
-                var originalPropertyName = property.Name;
-                var shadowPropertyName = $"{originalPropertyName}ShadowHash";
-
-                if (entityType.GetProperties().All(p => p.Name != shadowPropertyName))
-                {
-                    var shadowProperty = entityType.AddProperty(shadowPropertyName, typeof(string));
-                    shadowProperty.IsShadowProperty();
-                    // TODO: do we need the shadow hashes to be unique indexes?
-                    shadowProperty.IsUniqueIndex();
-                    shadowProperty.IsNullable = property.IsNullable;
-                }
-            }
-
             var propertyType = property.PropertyInfo?.PropertyType;
+
             if (propertyType == typeof(string))
-            {
                 property.SetValueConverter(new StringDataProtectionValueConverter(protector));
-            }
             else if (propertyType == typeof(byte[]))
-            {
                 property.SetValueConverter(new ByteArrayDataProtectionValueConverter(protector));
-            }
             else
-            {
                 throw new InvalidOperationException("Only string and byte[] properties are supported for now. Please open an issue on https://github.com/ddjerqq/EntityFrameworkCore.DataProtection/issues to request a new feature");
-            }
+
+            if (supportsQuerying)
+                AddShadowProperty(property);
         }
 
         return builder;
     }
+
+    private static void AddShadowProperty(IMutableProperty property)
+    {
+        var entityType = property.DeclaringType;
+        var originalPropertyName = property.Name;
+        var shadowPropertyName = $"{originalPropertyName}ShadowHash";
+
+        if (entityType.GetProperties().All(p => p.Name != shadowPropertyName))
+        {
+            var shadowProperty = entityType.AddProperty(shadowPropertyName, typeof(string));
+            shadowProperty.IsShadowProperty();
+            // TODO: do we need the shadow hashes to be unique indexes?
+            shadowProperty.IsUniqueIndex();
+            shadowProperty.IsNullable = property.IsNullable;
+        }
+    }
 }

src/EntityFrameworkCore.DataProtection/Extensions/PropertyBuilderExtensions.cs

@@ -26,7 +26,7 @@ public static class PropertyBuilderExtensions
     /// <typeparam name="TProperty">must be either string or byte[]</typeparam>
     /// <exception cref="NotImplementedException">if <see cref="TProperty"/> is neither string nor byte[]</exception>
     /// <returns>The same builder instance so that multiple configuration calls can be chained.</returns>
-    public static PropertyBuilder<TProperty> IsEncrypted<TProperty>(this PropertyBuilder<TProperty> builder, bool isQueryable = false)
+    public static PropertyBuilder<TProperty> IsEncrypted<TProperty>(this PropertyBuilder<TProperty> builder, bool isQueryable)
     {
         if (typeof(TProperty) != typeof(string) && typeof(TProperty) != typeof(byte[]))
             throw new InvalidOperationException("Only string and byte[] properties are supported for now. Please open an issue on https://github.com/ddjerqq/EntityFrameworkCore.DataProtection/issues to request a new feature");
@@ -36,7 +36,7 @@ public static PropertyBuilder<TProperty> IsEncrypted<TProperty>(this PropertyBui
         return builder;
     }
 
-    internal static (bool SupportsEncryption, bool SupportsQuerying) GetEncryptionStatus(this IMutableProperty property)
+    internal static (bool SupportsEncryption, bool SupportsQuerying) GetEncryptionStatus(this IReadOnlyProperty property)
     {
         var encryptAttribute = property.PropertyInfo?.GetCustomAttribute<EncryptAttribute>();
 

src/EntityFrameworkCore.DataProtection/Extensions/QueryableExt.cs

@@ -1,8 +1,7 @@
 using System.Linq.Expressions;
-using System.Reflection;
-using System.Security.Cryptography;
-using System.Text;
+using EntityFrameworkCore.DataProtection.Interceptors;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
 
 namespace EntityFrameworkCore.DataProtection.Extensions;
 
@@ -14,6 +13,16 @@ public static class QueryableExt
     /// <summary>
     /// Queries the entity by personal data. Please make sure your property is marked as encrypted (using <see cref="EncryptAttribute"/>) AND queryable (<see cref="EncryptAttribute.IsQueryable"/>)
     /// </summary>
+    /// <remarks>
+    /// You MUST call <see cref="DbContextOptionsBuilderExt.AddDataProtectionInterceptors"/> on the DbContext options to enable this feature.
+    /// <code>
+    /// services.AddDbContext&lt;YourDbContext&gt;(opt => opt
+    ///   .AddDataProtectionInterceptors()
+    ///   .UseWhateverYouHave());
+    /// </code>
+    /// <para></para>
+    /// The property you are querying for MUST be marked with <see cref="EncryptAttribute"/> and <see cref="EncryptAttribute.IsQueryable"/> set to true.
+    /// </remarks>
     /// <example>
     /// Example usage:
     /// <code>
@@ -57,17 +66,9 @@ public static IQueryable<T> WherePdEquals<T>(this IQueryable<T> query, string pr
             parameter,
             Expression.Constant(shadowPropertyName));
 
-        var comp = Expression.Equal(property, Expression.Constant(Sha256Hash(value)));
+        var comp = Expression.Equal(property, Expression.Constant(value.Sha256Hash()));
         var lambda = Expression.Lambda<Func<T, bool>>(comp, parameter);
 
         return query.Where(lambda);
     }
-
-    private static string Sha256Hash(string value)
-    {
-        var bytes = Encoding.UTF8.GetBytes(value);
-        var hash = SHA256.HashData(bytes);
-        var hexDigest = Convert.ToHexString(hash);
-        return hexDigest.ToLower();
-    }
 }

src/EntityFrameworkCore.DataProtection/Extensions/ServiceCollectionExt.cs

@@ -1,4 +1,5 @@
-using Microsoft.AspNetCore.DataProtection;
+using EntityFrameworkCore.DataProtection.Interceptors;
+using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption;
 using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel;
 using Microsoft.Extensions.DependencyInjection;
@@ -19,10 +20,13 @@ public static class ServiceCollectionExt
     /// You need to configure Persistence with the returned <see cref="IDataProtectionBuilder"/> instance.
     /// see <see href="https://learn.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview#persistkeystofilesystem">persisting keys to file system</see>
     /// </remarks>
+    /// <param name="services">The service collection</param>
     /// <param name="applicationName">The application name to use with data protection</param>
     /// <returns>An instance of <see cref="IDataProtectionBuilder"/> used to configure the data protection services</returns>
     public static IDataProtectionBuilder AddDataProtectionServices(this IServiceCollection services, string applicationName)
     {
+        services.AddSingleton<ShadowHashSynchronizerSaveChangesInterceptor>();
+
         return services.AddDataProtection()
             .UseCryptographicAlgorithms(
                 new AuthenticatedEncryptorConfiguration

src/EntityFrameworkCore.DataProtection/Extensions/StringExt.cs

@@ -0,0 +1,18 @@
+using System.Security.Cryptography;
+using System.Text;
+
+namespace EntityFrameworkCore.DataProtection.Extensions;
+
+/// <summary>
+/// Provides extensions for the <see cref="string"/> type.
+/// </summary>
+internal static class StringExt
+{
+    internal static string Sha256Hash(this string value)
+    {
+        var bytes = Encoding.UTF8.GetBytes(value);
+        var hash = SHA256.HashData(bytes);
+        var hexDigest = Convert.ToHexString(hash);
+        return hexDigest.ToLower();
+    }
+}

src/EntityFrameworkCore.DataProtection/Interceptors/ShadowHashSynchronizingSaveChangesInterceptor.cs

@@ -0,0 +1,68 @@
+using EntityFrameworkCore.DataProtection.Extensions;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.ChangeTracking;
+using Microsoft.EntityFrameworkCore.Diagnostics;
+using Microsoft.EntityFrameworkCore.Metadata;
+
+namespace EntityFrameworkCore.DataProtection.Interceptors;
+
+/// <summary>
+/// Interceptor to synchronize shadow hash properties with their original values.
+/// </summary>
+internal sealed class ShadowHashSynchronizerSaveChangesInterceptor : SaveChangesInterceptor
+{
+    /// <summary>
+    /// The singleton instance.
+    /// </summary>
+    public static readonly ShadowHashSynchronizerSaveChangesInterceptor Instance = new();
+
+    /// <inheritdoc />
+    public override InterceptionResult<int> SavingChanges(DbContextEventData eventData, InterceptionResult<int> result)
+    {
+        UpdateEntities(eventData.Context);
+        return base.SavingChanges(eventData, result);
+    }
+
+    /// <inheritdoc />
+    public override async ValueTask<InterceptionResult<int>> SavingChangesAsync(DbContextEventData eventData, InterceptionResult<int> result, CancellationToken ct = default)
+    {
+        UpdateEntities(eventData.Context);
+        return await base.SavingChangesAsync(eventData, result, ct);
+    }
+
+    private static void UpdateEntities(DbContext? context)
+    {
+        if (context is null)
+            return;
+
+        var entries =
+            from entry in context.ChangeTracker.Entries()
+            where entry.State is EntityState.Added or EntityState.Modified
+            let entity = entry.Entity
+            let entityType = context.Model.FindEntityType(entity.GetType())
+            where entityType is not null
+            select (entry, entity, entityType);
+
+        foreach (var (entry, entity, entityType) in entries)
+            SynchronizeShadowHash(entityType, entity, entry);
+    }
+
+    private static void SynchronizeShadowHash(IEntityType entityType, object entity, EntityEntry entry)
+    {
+        var properties =
+            from prop in entityType.GetProperties()
+            let status = prop.GetEncryptionStatus()
+            where status is { SupportsEncryption: true, SupportsQuerying: true }
+            select prop;
+
+        foreach (var property in properties)
+        {
+            var originalValue = property.PropertyInfo?.GetValue(entity)?.ToString() ?? string.Empty;
+            var shadowPropertyName = $"{property.Name}ShadowHash";
+            var shadowProperty = entityType.FindProperty(shadowPropertyName);
+
+            if (!string.IsNullOrWhiteSpace(originalValue) && shadowProperty is not null)
+                entry.Property(shadowPropertyName).CurrentValue = originalValue.Sha256Hash();
+        }
+    }
+}

test/EntityFrameworkCore.DataProtection.Test/Data/TestDbContext.cs

@@ -1,6 +1,7 @@
 using EntityFrameworkCore.DataProtection.Extensions;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Metadata.Builders;
 
 namespace EntityFrameworkCore.DataProtection.Test.Data;
 
@@ -10,7 +11,16 @@ internal sealed class TestDbContext(DbContextOptions<TestDbContext> options, IDa
 
     protected override void OnModelCreating(ModelBuilder builder)
     {
+        builder.ApplyConfigurationsFromAssembly(typeof(TestDbContext).Assembly);
         base.OnModelCreating(builder);
         builder.UseDataProtection(dataProtectionProvider);
     }
+}
+
+internal class UserConfiguration : IEntityTypeConfiguration<User>
+{
+    public void Configure(EntityTypeBuilder<User> builder)
+    {
+        builder.Property(x => x.Email).IsEncrypted(true);
+    }
 }