active_cipher_storage 1.0.2 → 2.0.0

data/lib/active_cipher_storage/adapters/s3_adapter.rb

@@ -8,13 +8,16 @@ module ActiveCipherStorage
       DEFAULT_MULTIPART_THRESHOLD = 100 * 1024 * 1024
 
       def initialize(bucket:, region: nil, multipart_threshold: DEFAULT_MULTIPART_THRESHOLD,
-                     s3_client: nil, config: nil)
+                     s3_client: nil, config: nil,
+                     chunk_size: Configuration::DEFAULT_CHUNK_SIZE)
         @bucket              = bucket
         @region              = region
         @multipart_threshold = multipart_threshold
         @client_override     = s3_client
         @config              = config || ActiveCipherStorage.configuration
+        @chunk_size          = Integer(chunk_size)
         @config.validate!
+        raise ArgumentError, "chunk_size must be positive" unless @chunk_size.positive?
       end
 
       def put_encrypted(key, io, **options)
@@ -89,7 +92,7 @@ module ActiveCipherStorage
           version:       Format::VERSION,
           algorithm:     Format::ALGO_AES256GCM,
           chunked:       true,
-          chunk_size:    @config.chunk_size,
+          chunk_size:    @chunk_size,
           provider_id:   @config.provider.provider_id,
           encrypted_dek: dek_bundle.fetch(:encrypted_key)
         ))
@@ -97,8 +100,8 @@ module ActiveCipherStorage
         seq  = 0
         done = false
         until done
-          chunk     = input_io.read(@config.chunk_size) || "".b
-          done      = chunk.bytesize < @config.chunk_size
+          chunk     = input_io.read(@chunk_size) || "".b
+          done      = chunk.bytesize < @chunk_size
           seq      += 1
           frame_seq = done ? Format::FINAL_SEQ : seq
           iv        = SecureRandom.random_bytes(Format::IV_SIZE)
@@ -107,7 +110,7 @@ module ActiveCipherStorage
           ct = chunk.empty? ? c.final : (c.update(chunk.b) + c.final)
           Format.write_chunk(buffer, seq: frame_seq, iv: iv, ciphertext: ct, auth_tag: c.auth_tag)
 
-          next unless buffer.pos >= @config.chunk_size || done
+          next unless buffer.pos >= @chunk_size || done
 
           buffer.rewind
           part_number += 1
@@ -125,7 +128,7 @@ module ActiveCipherStorage
       def decrypt_io(io)
         header = Format.read_header(io)
         io.rewind
-        header.chunked ? StreamCipher.new(@config).decrypt_to_io(io)
+        header.chunked ? StreamCipher.new(config: @config, chunk_size: header.chunk_size).decrypt_to_io(io)
                        : StringIO.new(Cipher.new(@config).decrypt(io))
       end
 
@@ -149,7 +152,7 @@ module ActiveCipherStorage
 
       def validate_multipart_chunk_size!
         min_size = Configuration::MINIMUM_S3_MULTIPART_PART_SIZE
-        return if @config.chunk_size >= min_size
+        return if @chunk_size >= min_size
 
         raise ArgumentError,
               "chunk_size must be at least 5 MiB for S3 multipart uploads"
@@ -235,6 +238,7 @@ module ActiveCipherStorage
         def drain_frames(&block)
           until @done
             break if @buffer.bytesize < FRAME_PREFIX_SIZE
+            # Length prefix at byte 16: seq(4) + iv(12).
             ct_len     = @buffer.byteslice(16, 4).unpack1("N")
             frame_size = FRAME_PREFIX_SIZE + ct_len + Format::AUTH_TAG_SIZE
             break if @buffer.bytesize < frame_size

data/lib/active_cipher_storage/blob_metadata.rb

@@ -5,11 +5,10 @@ module ActiveCipherStorage
   #   encrypted      => true
   #   cipher_version => Integer  (Format::VERSION)
   #   provider_id    => String   (e.g. "aws_kms", "env")
-  #   kms_key_id     => String   (CMK ARN, env-var name, or nil)
+  #   kms_key_id     => String   (CMK ARN, provider key identifier, or nil)
   #
-  # These are for operational visibility — rotation queries, auditing,
-  # backward-compat detection. The encrypted file header is always the
-  # authoritative source for decryption.
+  # These are for operational visibility and auditing. The encrypted file header
+  # is always the authoritative source for decryption.
   module BlobMetadata
     def self.write(storage_key, provider)
       return unless active_storage_available?
@@ -25,10 +24,8 @@ module ActiveCipherStorage
           "kms_key_id"     => provider.key_id
         ).compact
       )
-    rescue => e
-      ActiveCipherStorage.configuration.logger.warn(
-        "[ActiveCipherStorage] Could not write blob metadata for #{storage_key}: #{e.message}"
-      )
+    rescue StandardError => e
+      log_metadata_failure(storage_key, "write", e)
     end
 
     def self.write_plaintext(storage_key)
@@ -45,28 +42,8 @@ module ActiveCipherStorage
           "kms_key_id" => nil
         ).compact
       )
-    rescue => e
-      ActiveCipherStorage.configuration.logger.warn(
-        "[ActiveCipherStorage] Could not write plaintext blob metadata for #{storage_key}: #{e.message}"
-      )
-    end
-
-    def self.update_after_rotation(storage_key, new_provider)
-      return unless active_storage_available?
-
-      blob = ActiveStorage::Blob.find_by(key: storage_key)
-      return unless blob
-
-      blob.update_columns(
-        metadata: blob.metadata.merge(
-          "provider_id" => new_provider.provider_id,
-          "kms_key_id"  => new_provider.key_id
-        ).compact
-      )
-    rescue => e
-      ActiveCipherStorage.configuration.logger.warn(
-        "[ActiveCipherStorage] Could not update rotation metadata for #{storage_key}: #{e.message}"
-      )
+    rescue StandardError => e
+      log_metadata_failure(storage_key, "write_plaintext", e)
     end
 
     # Returns the metadata hash for a blob, or nil if AR is unavailable.
@@ -75,29 +52,21 @@ module ActiveCipherStorage
       ActiveStorage::Blob.find_by(key: storage_key)&.metadata
     end
 
-    # Finds all blobs whose metadata matches the given provider.
-    # Iterates in batches to avoid loading all blobs into memory.
-    # Yields each matching blob.
-    #
-    # For large tables, add a DB-level index on `metadata->>'kms_key_id'`
-    # and narrow the scope before passing to this method.
-    def self.blobs_for(provider)
-      return enum_for(:blobs_for, provider) unless block_given?
-      return unless active_storage_available?
+    private_class_method def self.log_metadata_failure(storage_key, operation, error)
+      raise error if reraise_metadata_errors?
 
-      ActiveStorage::Blob.find_each do |blob|
-        meta = blob.metadata
-        next unless meta["encrypted"] == true
-        next unless meta["provider_id"] == provider.provider_id
-        next if provider.key_id && meta["kms_key_id"] != provider.key_id
+      ActiveCipherStorage.configuration.logger.warn(
+        "[ActiveCipherStorage] Blob metadata failed (#{operation}) for #{storage_key}: #{error.message}"
+      )
+    end
 
-        yield blob
-      end
+    private_class_method def self.reraise_metadata_errors?
+      defined?(Rails) && Rails.respond_to?(:env) && Rails.env.development?
     end
 
     private_class_method def self.active_storage_available?
       defined?(ActiveStorage::Blob) && ActiveStorage::Blob.table_exists?
-    rescue
+    rescue StandardError
       false
     end
   end

data/lib/active_cipher_storage/configuration.rb

@@ -6,19 +6,21 @@ module ActiveCipherStorage
     # Supported algorithm identifiers.
     ALGORITHMS = %w[aes-256-gcm].freeze
 
-    # Bytes per plaintext chunk in streaming mode (default 5 MiB — matches the
-    # minimum S3 multipart part size, so each chunk maps to exactly one part).
+    # Minimum S3 multipart part size (except the last part). Streaming encryptors
+    # should use chunk_size >= this value when using S3 multipart.
     MINIMUM_S3_MULTIPART_PART_SIZE = 5 * 1024 * 1024
-    DEFAULT_CHUNK_SIZE = 5 * 1024 * 1024
+    # Default plaintext bytes per chunk when a caller does not pass chunk_size.
+    DEFAULT_CHUNK_SIZE = MINIMUM_S3_MULTIPART_PART_SIZE
 
     attr_reader :config
 
     def initialize
       @config = ActiveSupport::OrderedOptions.new
       self.algorithm = "aes-256-gcm"
-      self.chunk_size = DEFAULT_CHUNK_SIZE
       self.encrypt_uploads = true
       self.logger = Logger.new($stdout, level: Logger::WARN)
+      @provider_input = nil
+      @provider = nil
     end
 
     def algorithm
@@ -29,14 +31,6 @@ module ActiveCipherStorage
       config.algorithm = value
     end
 
-    def chunk_size
-      config.chunk_size
-    end
-
-    def chunk_size=(value)
-      config.chunk_size = value
-    end
-
     def encrypt_uploads
       config.encrypt_uploads
     end
@@ -53,19 +47,33 @@ module ActiveCipherStorage
       config.logger = value
     end
 
+    # Keyword arguments for built-in providers (`:env`, `:aws_kms`, `"aws:kms"`, etc.),
+    # passed through to EnvProvider / AwsKmsProvider.
+    def provider_options
+      config.provider_options ||= ActiveSupport::OrderedOptions.new
+    end
+
     def provider
-      config.provider
+      @provider ||= resolve_provider_input
     end
 
-    # Accept a provider instance or a symbol shorthand (:env, :aws_kms).
+    # Sets the KMS provider. Use a shorthand symbol or string, or pass a custom
+    # Providers::Base instance:
+    #
+    #   config.provider = :env
+    #   config.provider = :aws_kms
+    #   config.provider = "aws:kms"
+    #   config.provider_options[:key_id] = "arn:..." # optional; see provider docs
+    #   config.provider = MyKmsProvider.new
     def provider=(value)
-      config.provider = case value
-                        when Symbol then resolve_provider(value)
-                        when Providers::Base then value
+      @provider = nil
+      @provider_input = case value
+                        when Providers::Base, Symbol, String, NilClass then value
                         else
                           raise ArgumentError,
-                                "provider must be a Providers::Base instance or " \
-                                "one of :env, :aws_kms — got #{value.inspect}"
+                                "provider must be a Providers::Base instance, " \
+                                "a supported symbol/string (:env, :aws_kms, \"aws:kms\"), " \
+                                "or nil — got #{value.inspect}"
                         end
     end
 
@@ -78,8 +86,6 @@ module ActiveCipherStorage
               "Supported: #{ALGORITHMS.join(', ')}"
       end
 
-      raise ArgumentError, "chunk_size must be positive" unless chunk_size.positive?
-
       return if [true, false].include?(encrypt_uploads)
 
       raise ArgumentError, "encrypt_uploads must be true or false"
@@ -87,12 +93,39 @@ module ActiveCipherStorage
 
     private
 
-    def resolve_provider(sym)
-      case sym
-      when :env     then Providers::EnvProvider.new
-      when :aws_kms then Providers::AwsKmsProvider.new
+    def resolve_provider_input
+      case @provider_input
+      when Providers::Base
+        @provider_input
+      when nil
+        nil
+      when Symbol, String
+        build_provider(parse_provider_name(@provider_input))
+      else
+        raise ArgumentError, "Unsupported provider #{@provider_input.inspect}"
+      end
+    end
+
+    def parse_provider_name(name)
+      case name.to_s.strip.downcase
+      when "env" then :env
+      when "aws:kms", "aws_kms", "aws-kms", "kms" then :aws_kms
+      else
+        raise ArgumentError,
+              "Unknown provider #{name.inspect}; use :env, :aws_kms, \"aws:kms\", " \
+              "or a Providers::Base subclass instance"
+      end
+    end
+
+    def build_provider(kind)
+      opts = provider_options.to_h.symbolize_keys.compact
+      case kind
+      when :env
+        Providers::EnvProvider.new(**opts)
+      when :aws_kms
+        Providers::AwsKmsProvider.new(**opts)
       else
-        raise ArgumentError, "Unknown provider shorthand: #{sym.inspect}"
+        raise ArgumentError, "Unknown provider kind #{kind.inspect}"
       end
     end
   end

data/lib/active_cipher_storage/engine.rb

@@ -6,24 +6,8 @@ module ActiveCipherStorage
 
     initializer "active_cipher_storage.setup" do
       ActiveSupport.on_load(:active_storage) do
-        # Register our service so Rails' configurator can resolve it by name.
-        # When config/storage.yml has `service: ActiveCipherStorage`, Rails
-        # looks for ActiveStorage::Service::ActiveCipherStorageService or falls
-        # back to a registered mapping.  We register both names for safety.
-        require "active_cipher_storage/adapters/active_storage_service"
-
-        # Rails 7.1+ uses Configurator#build which calls
-        # SomeServiceClass.build(configurator:, **opts) when defined.
-        # Older Rails falls back to .new(**opts).  Both are supported.
-        ActiveStorage::Service.send(:const_set,
-          :ActiveCipherStorageService,
-          ActiveCipherStorage::Adapters::ActiveStorageService
-        ) unless ActiveStorage::Service.const_defined?(:ActiveCipherStorageService, false)
+        require "active_storage/service/active_cipher_storage_service"
       end
     end
-
-    initializer "active_cipher_storage.log_subscriber" do
-      ActiveSupport::LogSubscriber.logger ||= Logger.new($stdout)
-    end
   end
 end

data/lib/active_cipher_storage/errors.rb

@@ -16,8 +16,8 @@ module ActiveCipherStorage
     # Raised when the KMS provider cannot wrap/unwrap a data key.
     class KeyManagementError < ProviderError; end
 
-    # Raised when a caller tries to use a feature the active provider doesn't
-    # implement (e.g. key rotation on EnvProvider).
+    # Raised when a caller tries to use a feature the active provider does not
+    # implement (e.g. direct upload URL when encryption is required).
     class UnsupportedOperation < Error; end
   end
 

data/lib/active_cipher_storage/multipart_upload.rb

@@ -25,11 +25,13 @@ module ActiveCipherStorage
 
     SESSION_TTL = 24 * 3600
 
-    def initialize(s3_client:, bucket:, config: nil, store: nil)
-      @s3     = s3_client
-      @bucket = bucket
-      @config = config || ActiveCipherStorage.configuration
-      @store  = store || MemorySessionStore.new
+    def initialize(s3_client:, bucket:, config: nil, store: nil,
+                   chunk_size: Configuration::DEFAULT_CHUNK_SIZE)
+      @s3         = s3_client
+      @bucket     = bucket
+      @config     = config || ActiveCipherStorage.configuration
+      @store      = store || MemorySessionStore.new
+      @chunk_size = Integer(chunk_size)
       @config.validate!
       validate_multipart_chunk_size!
     end
@@ -46,7 +48,7 @@ module ActiveCipherStorage
         version:       Format::VERSION,
         algorithm:     Format::ALGO_AES256GCM,
         chunked:       true,
-        chunk_size:    @config.chunk_size,
+        chunk_size:    @chunk_size,
         provider_id:   @config.provider.provider_id,
         encrypted_dek: dek_bundle[:encrypted_key]
       ))
@@ -75,9 +77,9 @@ module ActiveCipherStorage
       session[:pending] = (session[:pending] +
         build_frame(plaintext, session[:encrypted_dek], session[:seq])).b
 
-      while session[:pending].bytesize >= @config.chunk_size
-        flush_part(session, session[:pending].byteslice(0, @config.chunk_size))
-        session[:pending] = (session[:pending].byteslice(@config.chunk_size..) || "".b).b
+      while session[:pending].bytesize >= @chunk_size
+        flush_part(session, session[:pending].byteslice(0, @chunk_size))
+        session[:pending] = (session[:pending].byteslice(@chunk_size..) || "".b).b
       end
 
       save_session(session_id, session)
@@ -169,7 +171,7 @@ module ActiveCipherStorage
 
     def validate_multipart_chunk_size!
       min_size = Configuration::MINIMUM_S3_MULTIPART_PART_SIZE
-      return if @config.chunk_size >= min_size
+      return if @chunk_size >= min_size
 
       raise ArgumentError,
             "chunk_size must be at least 5 MiB for S3 multipart uploads"

data/lib/active_cipher_storage/providers/aws_kms_provider.rb

@@ -5,14 +5,15 @@ module ActiveCipherStorage
 
       PROVIDER_ID = "aws_kms"
 
-      def initialize(key_id: nil, region: nil, encryption_context: {}, client: nil)
-        @key_id             = key_id || ENV.fetch("AWS_KMS_KEY_ID") {
-          raise Errors::ProviderError,
-                "AwsKmsProvider requires :key_id or AWS_KMS_KEY_ID env var"
-        }
-        @region             = region
-        @encryption_context = encryption_context || {}
-        @client_override    = client
+      def initialize(key_id:, region: nil, endpoint: nil, access_key_id: nil,
+                     secret_access_key: nil, encryption_context: {}, client: nil)
+        @key_id              = key_id
+        @region              = region
+        @endpoint            = endpoint
+        @access_key_id       = access_key_id
+        @secret_access_key   = secret_access_key
+        @encryption_context  = encryption_context || {}
+        @client_override     = client
       end
 
       def provider_id = PROVIDER_ID
@@ -48,42 +49,25 @@ module ActiveCipherStorage
         resp&.plaintext&.then { |k| zero_bytes!(k) }
       end
 
-      # Encrypts an existing plaintext DEK using KMS Encrypt.
-      # Prefer rotate_data_key (ReEncrypt) when both old and new providers are AWS KMS,
-      # because ReEncrypt keeps the plaintext DEK entirely within KMS.
-      def wrap_data_key(plaintext_dek)
-        resp = kms_client.encrypt(
-          key_id:             @key_id,
-          plaintext:          plaintext_dek,
-          encryption_context: @encryption_context
-        )
-        resp.ciphertext_blob.dup
-      rescue Aws::KMS::Errors::ServiceError => e
-        raise Errors::KeyManagementError, "KMS Encrypt failed: #{e.message}"
-      end
-
-      # Uses KMS ReEncrypt — the plaintext DEK never leaves KMS.
-      def rotate_data_key(encrypted_key, destination_key_id: nil)
-        resp = kms_client.re_encrypt(
-          ciphertext_blob:                encrypted_key,
-          source_encryption_context:      @encryption_context,
-          destination_key_id:             destination_key_id || @key_id,
-          destination_encryption_context: @encryption_context
-        )
-        resp.ciphertext_blob.dup
-      rescue Aws::KMS::Errors::ServiceError => e
-        raise Errors::KeyManagementError, "KMS ReEncrypt failed: #{e.message}"
-      end
-
       private
 
       def kms_client
         @kms_client ||= begin
           require "aws-sdk-kms"
-          @client_override || Aws::KMS::Client.new(**{ region: @region }.compact)
+          if @client_override
+            @client_override
+          else
+            opts = {
+              region:            @region,
+              endpoint:          @endpoint,
+              access_key_id:     @access_key_id,
+              secret_access_key: @secret_access_key
+            }.compact
+            Aws::KMS::Client.new(**opts)
+          end
+        rescue LoadError
+          raise Errors::ProviderError, "aws-sdk-kms is required: add it to your Gemfile"
         end
-      rescue LoadError
-        raise Errors::ProviderError, "aws-sdk-kms is required: add it to your Gemfile"
       end
     end
   end

data/lib/active_cipher_storage/providers/base.rb

@@ -11,28 +11,17 @@ module ActiveCipherStorage
         raise NotImplementedError, "#{self.class}#decrypt_data_key is not implemented"
       end
 
-      # Wraps an existing plaintext DEK under this provider's master key.
-      # Used during key rotation to re-protect a DEK without re-encrypting the file.
-      def wrap_data_key(plaintext_dek)
-        raise NotImplementedError, "#{self.class}#wrap_data_key is not implemented"
-      end
-
       # Short ASCII string embedded in every encrypted file header.
       def provider_id
         raise NotImplementedError, "#{self.class}#provider_id is not implemented"
       end
 
       # Stable identifier for the specific key material in use (e.g. CMK ARN,
-      # env var name). Stored in blob metadata for rotation queries.
-      # Returns nil for providers where key identity is not meaningful.
+      # env var name). Stored in blob metadata for visibility. Return nil if
+      # your provider has no stable key identifier.
       def key_id
         nil
       end
-
-      def rotate_data_key(encrypted_key)
-        raise Errors::UnsupportedOperation,
-              "#{self.class} does not support key rotation"
-      end
     end
   end
 end

data/lib/active_cipher_storage/providers/env_provider.rb

@@ -13,16 +13,14 @@ module ActiveCipherStorage
       WRAP_IV_SIZE    = 12
       WRAP_TAG_SIZE   = 16
 
-      def initialize(env_var: "ACTIVE_CIPHER_MASTER_KEY", old_env_var: nil)
-        @env_var     = env_var
-        @old_env_var = old_env_var
+      def initialize(encryption_key:)
+        @encryption_key = encryption_key
       end
 
       def provider_id = PROVIDER_ID
-      def key_id      = @env_var
 
       def generate_data_key
-        master = read_master_key(@env_var)
+        master = read_master_key
         dek    = SecureRandom.random_bytes(Cipher::KEY_SIZE)
         { plaintext_key: dek, encrypted_key: wrap_key(dek, master) }
       ensure
@@ -30,34 +28,12 @@ module ActiveCipherStorage
       end
 
       def decrypt_data_key(encrypted_key)
-        master = read_master_key(@env_var)
+        master = read_master_key
         unwrap_key(encrypted_key, master)
       ensure
         zero_bytes!(master)
       end
 
-      def wrap_data_key(plaintext_dek)
-        master = read_master_key(@env_var)
-        wrap_key(plaintext_dek, master)
-      ensure
-        zero_bytes!(master)
-      end
-
-      def rotate_data_key(encrypted_key, old_provider: nil)
-        source = old_provider || begin
-          raise Errors::UnsupportedOperation,
-                "Supply :old_provider to rotate via EnvProvider" unless @old_env_var
-          EnvProvider.new(env_var: @old_env_var)
-        end
-
-        plaintext_dek = source.decrypt_data_key(encrypted_key)
-        new_master    = read_master_key(@env_var)
-        wrap_key(plaintext_dek, new_master)
-      ensure
-        zero_bytes!(plaintext_dek)
-        zero_bytes!(new_master)
-      end
-
       private
 
       # Wrapped DEK: [12 IV][32 ciphertext][16 auth-tag] = 60 bytes
@@ -94,11 +70,12 @@ module ActiveCipherStorage
         c
       end
 
-      def read_master_key(var_name)
-        encoded = ENV.fetch(var_name) do
+      def read_master_key
+        encoded = @encryption_key
+        if encoded.nil? || encoded.empty?
           raise Errors::ProviderError,
-                "Environment variable #{var_name.inspect} is not set. " \
-                "Generate one with: ruby -rsecurerandom -e " \
+                "provider_options[:encryption_key] must be set. " \
+                "Generate one with: ruby -rsecurerandom -rbase64 -e " \
                 "'puts Base64.strict_encode64(SecureRandom.bytes(32))'"
         end
 
@@ -106,12 +83,12 @@ module ActiveCipherStorage
           Base64.strict_decode64(encoded)
         rescue ArgumentError
           raise Errors::ProviderError,
-                "#{var_name} must be Base64-encoded (strict, no line breaks)"
+                "provider_options[:encryption_key] must be Base64-encoded (strict, no line breaks)"
         end
 
         unless key.bytesize == MASTER_KEY_SIZE
           raise Errors::ProviderError,
-                "#{var_name} must decode to exactly #{MASTER_KEY_SIZE} bytes " \
+                "provider_options[:encryption_key] must decode to exactly #{MASTER_KEY_SIZE} bytes " \
                 "(got #{key.bytesize})"
         end
 

data/lib/active_cipher_storage/stream_cipher.rb

@@ -1,15 +1,18 @@
 require "openssl"
 require "securerandom"
+require "stringio"
 
 module ActiveCipherStorage
   class StreamCipher
     include KeyUtils
 
-    def initialize(config = ActiveCipherStorage.configuration)
+    def initialize(config: ActiveCipherStorage.configuration,
+                   chunk_size: Configuration::DEFAULT_CHUNK_SIZE)
       config.validate!
       @config     = config
       @provider   = config.provider
-      @chunk_size = config.chunk_size
+      @chunk_size = Integer(chunk_size)
+      raise ArgumentError, "chunk_size must be positive" unless @chunk_size.positive?
     end
 
     def encrypt(input_io, output_io)

data/lib/active_cipher_storage/version.rb

@@ -1,3 +1,3 @@
 module ActiveCipherStorage
-  VERSION = "1.0.2"
+  VERSION = "2.0.0"
 end

data/lib/active_cipher_storage.rb

@@ -15,9 +15,7 @@ require_relative "active_cipher_storage/providers/aws_kms_provider"
 require_relative "active_cipher_storage/cipher"
 require_relative "active_cipher_storage/stream_cipher"
 require_relative "active_cipher_storage/adapters/s3_adapter"
-require_relative "active_cipher_storage/adapters/active_storage_service"
 require_relative "active_cipher_storage/blob_metadata"
-require_relative "active_cipher_storage/key_rotation"
 require_relative "active_cipher_storage/multipart_upload"
 
 # Rails Engine wires the service into ActiveStorage's service registry.