Inngest Middleware

# Inngest Middleware Reference

Inngest provides `dependencyInjectionMiddleware` as a built-in export from the `inngest` package. Encryption and Sentry middleware are available as **separate packages** that must be installed independently.

> **Important:** `encryptionMiddleware` is from `@inngest/middleware-encryption` and `sentryMiddleware` is from `@inngest/middleware-sentry` — they are **not** exported from the core `inngest` package.

## Encryption Middleware (`@inngest/middleware-encryption`)

Install the package:

```bash
npm install @inngest/middleware-encryption
```

```typescript
import { Inngest } from "inngest";
import { encryptionMiddleware } from "@inngest/middleware-encryption";

const inngest = new Inngest({
  id: "my-app",
  middleware: [
    encryptionMiddleware({
      key: process.env.ENCRYPTION_KEY, // Encryption key from environment
    })
  ]
});
```

**What gets encrypted by default:**
- All step data
- All function output
- Event data in the `data.encrypted` field (customizable via `eventEncryptionField`)

**Additional options:**
- `eventEncryptionField`: Customize which event data field to encrypt (default: `data.encrypted`)
- `decryptOnly`: Disable encryption while maintaining decryption for migration scenarios
- `fallbackDecryptionKeys`: Array of previous keys for key rotation support

```typescript
// Key rotation example
encryptionMiddleware({
  key: process.env.NEW_ENCRYPTION_KEY,
  fallbackDecryptionKeys: [process.env.OLD_ENCRYPTION_KEY],
})
```

### Custom Encryption Implementation

For more control, create custom encryption middleware:

```typescript
import { InngestMiddleware } from "inngest";
import { createCipher, createDecipher, randomBytes } from "crypto";

const createCustomEncryptionMiddleware = (encryptionKey: string) => {
  const algorithm = "aes-256-gcm";

  const encrypt = (text: string): string => {
    const iv = randomBytes(16);
    const cipher = createCipher(algorithm, encryptionKey);
    cipher.setAAD(Buffer.from("inngest-data"));

    let encrypted = cipher.update(text, "utf8", "hex");
    encrypted += cipher.final("hex");

    const authTag = cipher.getAuthTag();
    return iv.toString("hex") + ":" + authTag.toString("hex") + ":" + encrypted;
  };

  const decrypt = (encrypted: string): string => {
    const [ivHex, authTagHex, encryptedText] = encrypted.split(":");
    const iv = Buffer.from(ivHex, "hex");
    const authTag = Buffer.from(authTagHex, "hex");

    const decipher = createDecipher(algorithm, encryptionKey);
    decipher.setAAD(Buffer.from("inngest-data"));
    decipher.setAuthTag(authTag);

    let decrypted = decipher.update(encryptedText, "hex", "utf8");
    decrypted += decipher.final("utf8");
    return decrypted;
  };

  return new InngestMiddleware({
    name: "Custom Encryption",
    init() {
      return {
        onFunctionRun({ ctx }) {
          return {
            transformInput() {
              // Decrypt sensitive event data
              if (ctx.event.data.encrypted_fields) {
                const decryptedFields = {};
                for (const [key, encryptedValue] of Object.entries(
                  ctx.event.data.encrypted_fields
                )) {
                  decryptedFields[key] = decrypt(encryptedValue as string);
                }

                return {
                  ctx: {
                    event: {
                      ...ctx.event,
                      data: {
                        ...ctx.event.data,
                        ...decryptedFields,
                        encrypted_fields: undefined // Remove encrypted versions
                      }
                    }
                  }
                };
              }
              return {};
            },

            transformOutput({ result }) {
              // Encrypt sensitive output fields
              if (result.data?.sensitiveData) {
                const encrypted = encrypt(
                  JSON.stringify(result.data.sensitiveData)