Getting ciphertext back from the database

This issue somehow got turned into a thread about ciphertext not being decrypted and returned as-is from the database.

Such issues usually indicate:
1. That the setup is correct (encryption works, which means fields are correctly interpreted, and the encryption key is supplied correctly)
2. That there is something wrong with the decryption process.

Decryption will throw an error when in strict mode (using `/// @encrypted?mode=strict`), but will log a warning to the console in other modes. This could be the sign that you are missing the right key to decrypt data.

If there are no errors, it usually means that the ciphertext has been corrupted somehow, and failed to be detected by the middleware (so is passed through as any other data). Make sure your field maximum length is high enough to contain the largest expected ciphertext, which is larger than the clear-text. [Calculator available here](https://cloak.47ng.com/ciphertext-length-calculator).

---

Original issue content:

Adding a global strict decryption mode that throws errors when decryption fails (missing key) should help avoid building layers of encryption in migrations.

Use-case:
1. The decryption key is missing, encrypted data is returned in ciphertext (A)
3. The data migration re-encrypts ciphertext A with encryption key, producing ciphertext B
4. Decryption of re-encrypted records yield ciphertext A

この issue では、plaintext ではなく ciphertext がデータベースから返される復号失敗のシナリオについて説明しており、その結果 ciphertext が再暗号化される可能性があります。middleware の復号ロジック、特に他のモードと比較した strict mode の扱いを調べてください。復号エラーがどこで捕捉され、ciphertext がそのまま渡されていないかを確認してください。フィールド長の検証と ciphertext length calculator を確認してください。暗号化/復号のフローと Prisma middleware を理解することが不可欠です。

索引モデルが issue の本文から書いたものです。