active_typed_store 2.7.0 → 2.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e69cb858697a79e92cbfcfb8147a2c8c5861e94a693b7097ce8f961bc4973bf6
-  data.tar.gz: 934c15165efc0c5f04d59c2f831b262866abedd49ec1ab0efaf978417a58783e
+  metadata.gz: 50dfb0f6df80a8fc7ad44f7f5ea9ae9eda71b8257e27b85c9a6a253633bb654b
+  data.tar.gz: 2d2c7cc056e39e9b9e23a494ebe7c973f5a99030c370324a97f9ff23ba5fff35
 SHA512:
-  metadata.gz: 9507a3d04171ca491053553829c22662c46f301efd01712ddf47173a07bcfb1867eec373ec7d9e8d9ec907216bc8fbd383ba2fa4e79e1953c6ed313de511eb9a
-  data.tar.gz: 010a2ac3ad8063d1ee9bab17b7437bd348ff2d78856cf970c23a6bb2603822c4c8f1dfa844e3456ec81d4b95c80c1de444b85bbf164f9a725ceaa31f095c13bf
+  metadata.gz: 5f99b76c42b7ee43bbb5c6513ca259788994eac8111824d4988b3a187198e2d9e5d49747b528a46674c73813876a9a99ef73d540aa0cf5c8b3e325bfeec86a82
+  data.tar.gz: 924a6e45783e10176782d5989380022cdd84be33d1ad2809b9ee2acf2047ea7a0d9701ace6e6b3732ea55ace5c90543af3af9ff867dd55304e2d48ad06169555

data/Gemfile.lock

@@ -22,7 +22,7 @@ GIT
 PATH
   remote: .
   specs:
-    active_typed_store (2.7.0)
+    active_typed_store (2.8.0)
       activemodel (>= 7.1)
       activerecord (>= 7.1)
       activesupport (>= 7.1)

data/README.md

@@ -143,31 +143,6 @@ class Parcel
 end
 ```
 
-### Encrypted store
-
-`encrypted: true` keeps keys of the store readable and encrypts every value like Rails `encrypts`:
-
-```ruby
-class SupplierImportSetting < ActiveRecord::Base
-  typed_store :marketplace_credentials, encrypted: true do
-    attr :wb_token,       :string
-    attr :ozon_token,     :string
-    attr :ozon_client_id, :string
-  end
-end
-
-setting.update!(wb_token: "secret", ozon_client_id: "123")
-# in the database: {"wb_token": "{\"p\":\"...\",\"h\":{...}}", "ozon_client_id": "{\"p\":\"...\",\"h\":{...}}"}
-```
-
-- Values are encrypted by `ActiveRecord::Encryption::EncryptedAttributeType` with the same scheme as `encrypts`:
-  [Active Record Encryption](https://guides.rubyonrails.org/active_record_encryption.html) must be configured,
-  `encrypts` options can be passed instead of `true`: `encrypted: { deterministic: true }`,
-  `encrypted: { previous: { key: "old key" } }`, `encrypted: { support_unencrypted_data: true }`.
-- Any value type is supported: the value is JSON-encoded before encryption.
-- Don't add `encrypts` for the store column or its accessors: it conflicts with typed_store or silently does nothing.
-- Like with `encrypts`, decrypted values are in `changes`, `attributes` and the store hash.
-
 ### Hash safety
 This gem assumes you're using a database that supports structured data types, such as `json` in `PostgreSQL` or `MySQL`, and leverages Rails' [store_accessor](https://edgeapi.rubyonrails.org/classes/ActiveRecord/Store.html) under the hood. However, there’s one caveat: JSON columns use a string-keyed hash and don’t support access via symbols. To avoid unexpected errors when accessing the hash, we raise an error if a symbol is used. You can disable this behavior by setting `config.hash_safety = false`.
 
@@ -191,6 +166,49 @@ record.params["price"] # 1
 record.params[:price] # nil - isn't the expected behavior for most applications
 ```
 
+### Encryption
+
+`active_typed_store` does not encrypt, on purpose: Rails `encrypts` works on whole columns only,
+and per-key encryption inside a JSON store is not a Rails pattern (Lockbox: "encrypt the column
+rather than individual accessors"). Keep secrets (API tokens, credentials) out of `typed_store`
+and use the standard Rails API on a separate `text` column:
+
+```ruby
+class AddCredentialsToModels < ActiveRecord::Migration[8.1]
+  def change
+    add_column :models, :credentials, :text, null: false, default: "{}"
+  end
+end
+```
+
+```ruby
+class Model < ActiveRecord::Base
+  typed_store(:params) do
+    attr :task_id, :integer
+  end
+
+  attribute :credentials, :json
+  store_accessor :credentials, :api_token, :client_id
+  encrypts :credentials
+end
+
+m = Model.create!(api_token: "secret")
+m.api_token # => "secret"
+m.ciphertext_for(:credentials) # => "{\"p\":\"...\",\"h\":{...}}" - no plaintext in the database
+```
+
+Why this exact shape (verified on Rails 8.1 and PostgreSQL):
+
+- `text`, not `jsonb`: the column holds ciphertext, a JSON envelope in `jsonb` only misleads SQL readers.
+- `null: false, default: "{}"`: `encrypts` passes the column default through, so an empty store
+  reads back as `{}` without marking the record dirty.
+- `attribute :json` + `store_accessor`, not `store :credentials, coder: JSON`: `store` serializes
+  an empty hash as `NULL`, which a `NOT NULL` column rejects, and on a nullable column
+  Rails <= 8.1 marks the record dirty on every read.
+
+`previous_changes` still holds the plaintext hash: filter `encrypted_attributes` in audit-log
+libraries (`audited` does, `paper_trail` since 15.0).
+
 ### Benchmarks
 compare `active_typed_store` with other gems
 ```ruby

data/lib/active_typed_store/store.rb

@@ -10,25 +10,16 @@ module ActiveTypedStore
 
     CUSTOM_JSON = CustomJson.new
 
-    def typed_store(store_attribute, encrypted: false, &block)
+    def typed_store(store_attribute, &)
       attrs = Attrs.new(store_attribute)
-      attrs.instance_eval(&block)
-
-      json_type =
-        if encrypted
-          # not required on load: it loads ActiveRecord::Encryption
-          require_relative "encrypted_json"
-          EncryptedJson.new(encrypted == true ? {} : encrypted)
-        else
-          CUSTOM_JSON
-        end
+      attrs.instance_eval(&)
 
       define_singleton_method(:inherited) do |subclass|
         super(subclass)
-        subclass.define_attribute(store_attribute.name, json_type)
+        subclass.define_attribute(store_attribute.name, CUSTOM_JSON)
       end
 
-      define_attribute store_attribute.name, json_type
+      define_attribute store_attribute.name, CUSTOM_JSON
       store_accessor store_attribute, attrs.fields
 
       if ActiveTypedStore.config.hash_safety == :disallow_symbol_keys

data/lib/active_typed_store/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActiveTypedStore
-  VERSION = "2.7.0"
+  VERSION = "2.8.0"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: active_typed_store
 version: !ruby/object:Gem::Version
-  version: 2.7.0
+  version: 2.8.0
 platform: ruby
 authors:
 - Ermolaev Andrey
-autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-10-15 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel
@@ -16,43 +15,42 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '7.1'
-description: 
+        version: '0'
 email:
 - andruhafirst@yandex.ru
 executables: []
@@ -72,7 +70,6 @@ files:
 - lib/active_typed_store/attrs.rb
 - lib/active_typed_store/configuration.rb
 - lib/active_typed_store/disallow_symbol_keys.rb
-- lib/active_typed_store/encrypted_json.rb
 - lib/active_typed_store/store.rb
 - lib/active_typed_store/version.rb
 homepage: https://github.com/corp-gp/active_typed_store
@@ -80,7 +77,6 @@ licenses:
 - MIT
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -95,8 +91,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Typed store for active records json columns (postgresql, mysql, sqlite)
 test_files: []

data/lib/active_typed_store/encrypted_json.rb

@@ -1,46 +0,0 @@
-# frozen_string_literal: true
-
-module ActiveTypedStore
-  module Store
-    # typed_store(:params, encrypted: true): keys are stored as is, every value is encrypted like Rails `encrypts`.
-    # Options are `encrypts` options: encrypted: { deterministic: true, previous: ..., support_unencrypted_data: true }
-    class EncryptedJson < CustomJson
-      # value is JSON-encoded before encryption to keep its type; not encrypted value (support_unencrypted_data)
-      # is returned as is, it may be not JSON
-      class ValueJson < ActiveRecord::Type::Json
-        def deserialize(value)
-          return value unless value.is_a?(::String)
-
-          ActiveSupport::JSON.decode(value)
-        rescue JSON::ParserError
-          value
-        end
-      end
-
-      def initialize(scheme_options)
-        super()
-        @scheme_options = scheme_options
-      end
-
-      def serialize(value) = super(value.is_a?(Hash) ? value.transform_values { value_type.serialize(_1) } : value)
-
-      def deserialize(value)
-        hash = super
-        hash.is_a?(Hash) ? hash.transform_values { value_type.deserialize(_1) } : hash
-      end
-
-      # deserialize(serialize(value)) gives the same as plain json, but encrypts and decrypts every value
-      # on every assignment and dirty check
-      def cast(value) = CUSTOM_JSON.cast(value)
-      def changed_in_place?(raw_old_value, new_value) = deserialize(raw_old_value) != cast(new_value)
-
-      # built lazily like `encrypts` does: encryption config may be not loaded yet when the model is defined
-      private def value_type
-        @value_type ||= ActiveRecord::Encryption::EncryptedAttributeType.new(
-          scheme:    ActiveRecord::Base.send(:scheme_for, **@scheme_options),
-          cast_type: ValueJson.new,
-        )
-      end
-    end
-  end
-end