Application Level Encryption

@RestController
@RequestMapping("/api/payments")
public class PaymentController {
    private final PaymentRepository payments;
    
    public PaymentController(PaymentRepository payments) {
        this.payments = payments;
    }
    
    @PostMapping("/addCardInfo")
    public ResponseEntity<?> addCardInfo(@RequestBody AddCardRequest request) {
        try {
            // Card data is stored without encryption
            Payment payment = new Payment();
            payment.setUserId(request.userId());
            payment.setCardNumber(request.cardNumber());
            payments.save(payment);
            
            return ResponseEntity.ok(Map.of("success", true));
        } catch (Exception e) {
            System.err.println("Database error: " + e.getMessage());
            return ResponseEntity.internalServerError()
                    .body(Map.of("error", "Internal server error"));
        }
    }
    
    public record AddCardRequest(Integer userId, String cardNumber) {
    }
}

@GetMapping("/getCardInfo")
public ResponseEntity<?> getCardInfo() {
    try {
        List<Payment> allPayments = payments.findAll();
        
        List<Map<String, Object>> results = allPayments.stream()
                .map(payment -> Map.<String, Object>of(
                        "user_id", payment.getUserId(),
                        "card_number", payment.getCardNumber()
                ))
                .collect(Collectors.toList());
        
        return ResponseEntity.ok(results);
    } catch (Exception e) {
        System.err.println("Database error: " + e.getMessage());
        return ResponseEntity.internalServerError()
                .body(Map.of("error", "Internal server error"));
    }
}

curl http://localhost:3000/api/payments/getCardInfo

# Example Response:
# [
#   {
#     "user_id": 1,
#     "card_number": "4532-7153-3790-4561"
#   },
#   {
#     "user_id": 2,
#     "card_number": "4532-7153-3790-4562"
#   }
# ]

@RestController
@RequestMapping("/api/payments")
public class PaymentController {
    private final PaymentRepository payments;
    private final HashingUtil hashingUtil;
    
    public PaymentController(PaymentRepository payments, HashingUtil hashingUtil) {
        this.payments = payments;
        this.hashingUtil = hashingUtil;
    }
    
    @PostMapping("/addCardInfo")
    public ResponseEntity<?> addCardInfo(@RequestBody AddCardRequest request) {
        try {
            // Store only the hash of the card number for verification
            String cardHash = hashingUtil.hashCardNumber(request.cardNumber());
            
            // Store the last 4 digits for display purposes
            String lastFourDigits = request.cardNumber().substring(
                request.cardNumber().length() - 4
            );
            
            Payment payment = new Payment();
            payment.setUserId(request.userId());
            payment.setCardHash(cardHash);
            payment.setLastFourDigits(lastFourDigits);
            payments.save(payment);
            
            return ResponseEntity.ok(Map.of("success", true));
        } catch (Exception e) {
            System.err.println("Database error: " + e.getMessage());
            return ResponseEntity.internalServerError()
                    .body(Map.of("error", "Internal server error"));
        }
    }
    
    public record AddCardRequest(Integer userId, String cardNumber) {
    }
}

package com.codesignal.pastebin.util;

import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.stereotype.Component;

@Component
public class HashingUtil {
    private final BCryptPasswordEncoder encoder;

    public HashingUtil() {
        // Use BCrypt with a cost factor of 12
        int saltRounds = 12;
        this.encoder = new BCryptPasswordEncoder(saltRounds);
    }

    public String hashCardNumber(String cardNumber) {
        try {
            return encoder.encode(cardNumber);
        } catch (Exception e) {
            System.err.println("Hashing error: " + e.getMessage());
            throw new RuntimeException("Failed to hash card number", e);
        }
    }
}

@GetMapping("/getCardInfo")
public ResponseEntity<?> getCardInfo() {
    try {
        List<Payment> allPayments = payments.findAll();
        
        List<Map<String, Object>> maskedResults = allPayments.stream()
                .map(payment -> Map.<String, Object>of(
                        "user_id", payment.getUserId(),
                        "card_number", "****-****-****-" + payment.getLastFourDigits()
                ))
                .collect(Collectors.toList());
        
        return ResponseEntity.ok(maskedResults);
    } catch (Exception e) {
        System.err.println("Database error: " + e.getMessage());
        return ResponseEntity.internalServerError()
                .body(Map.of("error", "Internal server error"));
    }
}

public boolean verifyCardNumber(String cardNumber, String storedHash) {
    try {
        return encoder.matches(cardNumber, storedHash);
    } catch (Exception e) {
        System.err.println("Hash comparison error: " + e.getMessage());
        return false;
    }
}

@PostMapping("/verifyCard")
public ResponseEntity<?> verifyCard(@RequestBody VerifyCardRequest request) {
    try {
        Optional<Payment> paymentOpt = payments.findByUserId(request.userId());
        
        if (paymentOpt.isEmpty()) {
            return ResponseEntity.status(404)
                    .body(Map.of("error", "Card not found"));
        }
        
        Payment payment = paymentOpt.get();
        boolean isValid = hashingUtil.verifyCardNumber(
            request.cardNumber(), 
            payment.getCardHash()
        );
        
        return ResponseEntity.ok(Map.of("isValid", isValid));
    } catch (Exception e) {
        System.err.println("Verification error: " + e.getMessage());
        return ResponseEntity.internalServerError()
                .body(Map.of("error", "Internal server error"));
    }
}

public record VerifyCardRequest(Integer userId, String cardNumber) {
}

package com.codesignal.pastebin.model;

import jakarta.persistence.*;
import java.time.LocalDateTime;

@Entity
@Table(name = "payments")
public class Payment {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Integer id;

    @Column(name = "user_id", nullable = false)
    private Integer userId;

    @Column(name = "card_hash", nullable = false)
    private String cardHash;

    @Column(name = "last_four_digits", nullable = false, length = 4)
    private String lastFourDigits;

    @Column(name = "created_at")
    private LocalDateTime createdAt = LocalDateTime.now();

    public Integer getId() { return id; }
    public void setId(Integer id) { this.id = id; }

    public Integer getUserId() { return userId; }
    public void setUserId(Integer userId) { this.userId = userId; }

    public String getCardHash() { return cardHash; }
    public void setCardHash(String cardHash) { this.cardHash = cardHash; }

    public String getLastFourDigits() { return lastFourDigits; }
    public void setLastFourDigits(String lastFourDigits) { this.lastFourDigits = lastFourDigits; }

    public LocalDateTime getCreatedAt() { return createdAt; }
    public void setCreatedAt(LocalDateTime createdAt) { this.createdAt = createdAt; }
}

package com.codesignal.pastebin.repo;

import com.codesignal.pastebin.model.Payment;
import org.springframework.data.jpa.repository.JpaRepository;

import java.util.Optional;

public interface PaymentRepository extends JpaRepository<Payment, Integer> {
    Optional<Payment> findByUserId(Integer userId);
}