activerecord-cipherstash-pg-adapter 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17eaea76f767bfda72f26bd7c9d89a4e8e0333dfc19be95a5390cbb8b0cbfc44
-  data.tar.gz: 379044af26990eb20e563e9aaa0bf727fcb5e70ac63ec89afa86e648d8882d3c
+  metadata.gz: 3eaa0c02e8ccecc531934417632599e4f91edcd67fed514f315ebef2bc424ee8
+  data.tar.gz: 369c9295c615b3468421bcef9142421ac767c4dd6ef3f4a46139ce0183adc37f
 SHA512:
-  metadata.gz: b25b5b4ef6ad537cb9ec045458553566b743b9739b3c0c863d41d28dc78316e9f557904c55d6145789bcf85b7bb15c9d42f5a81cb8b411471f4516274763e37d
-  data.tar.gz: be6d02946c7e8df400dc68d13bc614fd28a3787dea5b9317e8d4e86773097f2a22f7ced6dd5ca3b6fe58f8bfb8fdd041f64fbc0453bae3e9ad2bc89d87a2ffa2
+  metadata.gz: '09b55773769ab21a814208fd25058a82cad19a6c047ccbc84d4a715447bdcfade7b68e399242049e0285c26d0d22725310a02cb62fc4532621d6f095d90e6a93'
+  data.tar.gz: a74e2ead6f0c3029725fbd2b4d1e0b76c228446b8b284a954ce737e8ae488743105baa0f356ad922d5fdedd23051d3059b2a6618cad30b507fe6a2554cc7b3b9

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 ## [Unreleased]
 
+## [0.3.0] - 2023-04-04
+### Added
+
+- Support for both Rails 6 + 7.
+
+## [0.2.0] - 2023-03-29
+
+### Added
+
+- Rake task to migrate plaintext data to encrypted columns.
+
+### Fixed
+
+- Rails commands not recognised.
+
 ## [0.1.0] - 2023-02-01
 
 - Initial release

data/README.md

@@ -2,6 +2,8 @@
 
 An adapter to allow the use of the CipherStash libpq fork for encryption of data in your PostgreSQL databases.
 
+This adapter supports Rails 6 & 7.
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -16,7 +18,7 @@ In `database.yml`, use the following adapter setting:
 
 ```yaml
 development:
-  adapter: cipherstash_pg
+  adapter: postgres_cipherstash
   # ... username, password, etc. as you would with postgres as normal.
 ```
 
@@ -26,6 +28,14 @@ After checking out the repo, run `bin/setup` to install dependencies. Then, run
 
 To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
 
+In the github repo:
+
+- Click on releases.
+- Click on `Draft a new release`.
+- Select the created tag from the `Choose a tag` dropdown.
+- Click on `Generate release notes`
+- Click on `Publish release`.
+
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/cipherstash/activerecord-cipherstash-pg-adapter

data/activerecord-cipherstash-pg-adapter.gemspec

@@ -30,6 +30,6 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   # Runtime dependencies here; dev+test go in Gemfile.
-  spec.add_dependency "activerecord", "~> 7.0.3"
+  spec.add_dependency "activerecord", ">= 6.0.0", "< 8.0.0"
   spec.add_dependency "cipherstash-pg", "~> 1.4.5"
 end

data/lib/active_record/connection_adapters/6.1/cipherstash_pg/column.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/object/blank"
+
+module ActiveRecord
+  module ConnectionAdapters
+    module CipherStashPG
+      class Column < ConnectionAdapters::Column # :nodoc:
+        delegate :oid, :fmod, to: :sql_type_metadata
+
+        def initialize(*, serial: nil, **)
+          super
+          @serial = serial
+        end
+
+        def serial?
+          @serial
+        end
+
+        def array
+          sql_type_metadata.sql_type.end_with?("[]")
+        end
+        alias :array? :array
+
+        def sql_type
+          super.delete_suffix("[]")
+        end
+
+        def init_with(coder)
+          @serial = coder["serial"]
+          super
+        end
+
+        def encode_with(coder)
+          coder["serial"] = @serial
+          super
+        end
+
+        def ==(other)
+          other.is_a?(Column) &&
+            super &&
+            serial? == other.serial?
+        end
+        alias :eql? :==
+
+        def hash
+          Column.hash ^
+            super.hash ^
+            serial?.hash
+        end
+      end
+    end
+    CipherStashPGColumn = CipherStashPG::Column # :nodoc:
+  end
+end

data/lib/active_record/connection_adapters/6.1/cipherstash_pg/database_statements.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module ConnectionAdapters
+    module CipherStashPG
+      module DatabaseStatements
+        def explain(arel, binds = [])
+          sql = "EXPLAIN #{to_sql(arel, binds)}"
+          CipherStashPG::ExplainPrettyPrinter.new.pp(exec_query(sql, "EXPLAIN", binds))
+        end
+
+        # Queries the database and returns the results in an Array-like object
+        def query(sql, name = nil) # :nodoc:
+          materialize_transactions
+          mark_transaction_written_if_write(sql)
+
+          log(sql, name) do
+            ActiveSupport::Dependencies.interlock.permit_concurrent_loads do
+              @connection.async_exec(sql).map_types!(@type_map_for_results).values
+            end
+          end
+        end
+
+        READ_QUERY = ActiveRecord::ConnectionAdapters::AbstractAdapter.build_read_query_regexp(
+          :close, :declare, :fetch, :move, :set, :show
+        ) # :nodoc:
+        private_constant :READ_QUERY
+
+        def write_query?(sql) # :nodoc:
+          !READ_QUERY.match?(sql)
+        rescue ArgumentError # Invalid encoding
+          !READ_QUERY.match?(sql.b)
+        end
+
+        # Executes an SQL statement, returning a PG::Result object on success
+        # or raising a PG::Error exception otherwise.
+        # Note: the PG::Result object is manually memory managed; if you don't
+        # need it specifically, you may want consider the <tt>exec_query</tt> wrapper.
+        def execute(sql, name = nil)
+          if preventing_writes? && write_query?(sql)
+            raise ActiveRecord::ReadOnlyError, "Write query attempted while in readonly mode: #{sql}"
+          end
+
+          materialize_transactions
+          mark_transaction_written_if_write(sql)
+
+          log(sql, name) do
+            ActiveSupport::Dependencies.interlock.permit_concurrent_loads do
+              @connection.async_exec(sql)
+            end
+          end
+        end
+
+        def exec_query(sql, name = "SQL", binds = [], prepare: false)
+          execute_and_clear(sql, name, binds, prepare: prepare) do |result|
+            types = {}
+            fields = result.fields
+            fields.each_with_index do |fname, i|
+              ftype = result.ftype i
+              fmod  = result.fmod i
+              case type = get_oid_type(ftype, fmod, fname)
+              when Type::Integer, Type::Float, OID::Decimal, Type::String, Type::DateTime, Type::Boolean
+                # skip if a column has already been type casted by pg decoders
+              else types[fname] = type
+              end
+            end
+            build_result(columns: fields, rows: result.values, column_types: types)
+          end
+        end
+
+        def exec_delete(sql, name = nil, binds = [])
+          execute_and_clear(sql, name, binds) { |result| result.cmd_tuples }
+        end
+        alias :exec_update :exec_delete
+
+        def sql_for_insert(sql, pk, binds) # :nodoc:
+          if pk.nil?
+            # Extract the table from the insert sql. Yuck.
+            table_ref = extract_table_ref_from_insert_sql(sql)
+            pk = primary_key(table_ref) if table_ref
+          end
+
+          if pk = suppress_composite_primary_key(pk)
+            sql = "#{sql} RETURNING #{quote_column_name(pk)}"
+          end
+
+          super
+        end
+        private :sql_for_insert
+
+        def exec_insert(sql, name = nil, binds = [], pk = nil, sequence_name = nil) # :nodoc:
+          if use_insert_returning? || pk == false
+            super
+          else
+            result = exec_query(sql, name, binds)
+            unless sequence_name
+              table_ref = extract_table_ref_from_insert_sql(sql)
+              if table_ref
+                pk = primary_key(table_ref) if pk.nil?
+                pk = suppress_composite_primary_key(pk)
+                sequence_name = default_sequence_name(table_ref, pk)
+              end
+              return result unless sequence_name
+            end
+            last_insert_id_result(sequence_name)
+          end
+        end
+
+        # Begins a transaction.
+        def begin_db_transaction # :nodoc:
+          execute("BEGIN", "TRANSACTION")
+        end
+
+        def begin_isolated_db_transaction(isolation) # :nodoc:
+          begin_db_transaction
+          execute "SET TRANSACTION ISOLATION LEVEL #{transaction_isolation_levels.fetch(isolation)}"
+        end
+
+        # Commits a transaction.
+        def commit_db_transaction # :nodoc:
+          execute("COMMIT", "TRANSACTION")
+        end
+
+        # Aborts a transaction.
+        def exec_rollback_db_transaction # :nodoc:
+          execute("ROLLBACK", "TRANSACTION")
+        end
+
+        private
+          def execute_batch(statements, name = nil)
+            execute(combine_multi_statements(statements))
+          end
+
+          def build_truncate_statements(table_names)
+            ["TRUNCATE TABLE #{table_names.map(&method(:quote_table_name)).join(", ")}"]
+          end
+
+          # Returns the current ID of a table's sequence.
+          def last_insert_id_result(sequence_name)
+            exec_query("SELECT currval(#{quote(sequence_name)})", "SQL")
+          end
+
+          def suppress_composite_primary_key(pk)
+            pk unless pk.is_a?(Array)
+          end
+      end
+    end
+  end
+end

data/lib/active_record/connection_adapters/6.1/cipherstash_pg/oid/array.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module ConnectionAdapters
+    module CipherStashPG
+      module OID # :nodoc:
+        class Array < Type::Value # :nodoc:
+          include ActiveModel::Type::Helpers::Mutable
+
+          Data = Struct.new(:encoder, :values) # :nodoc:
+
+          attr_reader :subtype, :delimiter
+          delegate :type, :user_input_in_time_zone, :limit, :precision, :scale, to: :subtype
+
+          def initialize(subtype, delimiter = ",")
+            @subtype = subtype
+            @delimiter = delimiter
+
+            @pg_encoder = PG::TextEncoder::Array.new name: "#{type}[]", delimiter: delimiter
+            @pg_decoder = PG::TextDecoder::Array.new name: "#{type}[]", delimiter: delimiter
+          end
+
+          def deserialize(value)
+            case value
+            when ::String
+              type_cast_array(@pg_decoder.decode(value), :deserialize)
+            when Data
+              type_cast_array(value.values, :deserialize)
+            else
+              super
+            end
+          end
+
+          def cast(value)
+            if value.is_a?(::String)
+              value = begin
+                @pg_decoder.decode(value)
+              rescue TypeError
+                # malformed array string is treated as [], will raise in PG 2.0 gem
+                # this keeps a consistent implementation
+                []
+              end
+            end
+            type_cast_array(value, :cast)
+          end
+
+          def serialize(value)
+            if value.is_a?(::Array)
+              casted_values = type_cast_array(value, :serialize)
+              Data.new(@pg_encoder, casted_values)
+            else
+              super
+            end
+          end
+
+          def ==(other)
+            other.is_a?(Array) &&
+              subtype == other.subtype &&
+              delimiter == other.delimiter
+          end
+
+          def type_cast_for_schema(value)
+            return super unless value.is_a?(::Array)
+            "[" + value.map { |v| subtype.type_cast_for_schema(v) }.join(", ") + "]"
+          end
+
+          def map(value, &block)
+            value.map(&block)
+          end
+
+          def changed_in_place?(raw_old_value, new_value)
+            deserialize(raw_old_value) != new_value
+          end
+
+          def force_equality?(value)
+            value.is_a?(::Array)
+          end
+
+          private
+            def type_cast_array(value, method)
+              if value.is_a?(::Array)
+                value.map { |item| type_cast_array(item, method) }
+              else
+                @subtype.public_send(method, value)
+              end
+            end
+        end
+      end
+    end
+  end
+end

data/lib/active_record/connection_adapters/6.1/cipherstash_pg/oid/date.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module ConnectionAdapters
+    module CipherStashPG
+      module OID # :nodoc:
+        class Date < Type::Date # :nodoc:
+          def cast_value(value)
+            case value
+            when "infinity" then ::Float::INFINITY
+            when "-infinity" then -::Float::INFINITY
+            when / BC$/
+              value = value.sub(/^\d+/) { |year| format("%04d", -year.to_i + 1) }
+              super(value.delete_suffix!(" BC"))
+            else
+              super
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_record/connection_adapters/6.1/cipherstash_pg/oid/date_time.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module ConnectionAdapters
+    module CipherStashPG
+      module OID # :nodoc:
+        class DateTime < Type::DateTime # :nodoc:
+          def cast_value(value)
+            case value
+            when "infinity" then ::Float::INFINITY
+            when "-infinity" then -::Float::INFINITY
+            when / BC$/
+              value = value.sub(/^\d+/) { |year| format("%04d", -year.to_i + 1) }
+              super(value.delete_suffix!(" BC"))
+            else
+              super
+            end
+          end
+
+          def type_cast_for_schema(value)
+            case value
+            when ::Float::INFINITY then "::Float::INFINITY"
+            when -::Float::INFINITY then "-::Float::INFINITY"
+            else super
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/active_record/connection_adapters/6.1/cipherstash_pg/oid/hstore.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require "strscan"
+
+module ActiveRecord
+  module ConnectionAdapters
+    module CipherStashPG
+      module OID # :nodoc:
+        class Hstore < Type::Value # :nodoc:
+          include ActiveModel::Type::Helpers::Mutable
+
+          def type
+            :hstore
+          end
+
+          def deserialize(value)
+            if value.is_a?(::String)
+              ::Hash[value.scan(HstorePair).map { |k, v|
+                v = v.upcase == "NULL" ? nil : v.gsub(/\A"(.*)"\Z/m, '\1').gsub(/\\(.)/, '\1')
+                k = k.gsub(/\A"(.*)"\Z/m, '\1').gsub(/\\(.)/, '\1')
+                [k, v]
+              }]
+            else
+              value
+            end
+          end
+
+          def serialize(value)
+            if value.is_a?(::Hash)
+              value.map { |k, v| "#{escape_hstore(k)}=>#{escape_hstore(v)}" }.join(", ")
+            elsif value.respond_to?(:to_unsafe_h)
+              serialize(value.to_unsafe_h)
+            else
+              value
+            end
+          end
+
+          def accessor
+            ActiveRecord::Store::StringKeyedHashAccessor
+          end
+
+          # Will compare the Hash equivalents of +raw_old_value+ and +new_value+.
+          # By comparing hashes, this avoids an edge case where the order of
+          # the keys change between the two hashes, and they would not be marked
+          # as equal.
+          def changed_in_place?(raw_old_value, new_value)
+            deserialize(raw_old_value) != new_value
+          end
+
+          private
+            HstorePair = begin
+              quoted_string = /"[^"\\]*(?:\\.[^"\\]*)*"/
+              unquoted_string = /(?:\\.|[^\s,])[^\s=,\\]*(?:\\.[^\s=,\\]*|=[^,>])*/
+              /(#{quoted_string}|#{unquoted_string})\s*=>\s*(#{quoted_string}|#{unquoted_string})/
+            end
+
+            def escape_hstore(value)
+              if value.nil?
+                "NULL"
+              else
+                if value == ""
+                  '""'
+                else
+                  '"%s"' % value.to_s.gsub(/(["\\])/, '\\\\\1')
+                end
+              end
+            end
+        end
+      end
+    end
+  end
+end

data/lib/active_record/connection_adapters/6.1/cipherstash_pg/oid/type_map_initializer.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/array/extract"
+
+module ActiveRecord
+  module ConnectionAdapters
+    module CipherStashPG
+      module OID # :nodoc:
+        # This class uses the data from PostgreSQL pg_type table to build
+        # the OID -> Type mapping.
+        #   - OID is an integer representing the type.
+        #   - Type is an OID::Type object.
+        # This class has side effects on the +store+ passed during initialization.
+        class TypeMapInitializer # :nodoc:
+          def initialize(store)
+            @store = store
+          end
+
+          def run(records)
+            nodes = records.reject { |row| @store.key? row["oid"].to_i }
+            mapped = nodes.extract! { |row| @store.key? row["typname"] }
+            ranges = nodes.extract! { |row| row["typtype"] == "r" }
+            enums = nodes.extract! { |row| row["typtype"] == "e" }
+            domains = nodes.extract! { |row| row["typtype"] == "d" }
+            arrays = nodes.extract! { |row| row["typinput"] == "array_in" }
+            composites = nodes.extract! { |row| row["typelem"].to_i != 0 }
+
+            mapped.each     { |row| register_mapped_type(row)    }
+            enums.each      { |row| register_enum_type(row)      }
+            domains.each    { |row| register_domain_type(row)    }
+            arrays.each     { |row| register_array_type(row)     }
+            ranges.each     { |row| register_range_type(row)     }
+            composites.each { |row| register_composite_type(row) }
+          end
+
+          def query_conditions_for_initial_load
+            known_type_names = @store.keys.map { |n| "'#{n}'" }
+            known_type_types = %w('r' 'e' 'd')
+            <<~SQL % [known_type_names.join(", "), known_type_types.join(", ")]
+              WHERE
+                t.typname IN (%s)
+                OR t.typtype IN (%s)
+                OR t.typinput = 'array_in(cstring,oid,integer)'::regprocedure
+                OR t.typelem != 0
+            SQL
+          end
+
+          private
+            def register_mapped_type(row)
+              alias_type row["oid"], row["typname"]
+            end
+
+            def register_enum_type(row)
+              register row["oid"], OID::Enum.new
+            end
+
+            def register_array_type(row)
+              register_with_subtype(row["oid"], row["typelem"].to_i) do |subtype|
+                OID::Array.new(subtype, row["typdelim"])
+              end
+            end
+
+            def register_range_type(row)
+              register_with_subtype(row["oid"], row["rngsubtype"].to_i) do |subtype|
+                OID::Range.new(subtype, row["typname"].to_sym)
+              end
+            end
+
+            def register_domain_type(row)
+              if base_type = @store.lookup(row["typbasetype"].to_i)
+                register row["oid"], base_type
+              else
+                warn "unknown base type (OID: #{row["typbasetype"]}) for domain #{row["typname"]}."
+              end
+            end
+
+            def register_composite_type(row)
+              if subtype = @store.lookup(row["typelem"].to_i)
+                register row["oid"], OID::Vector.new(row["typdelim"], subtype)
+              end
+            end
+
+            def register(oid, oid_type = nil, &block)
+              oid = assert_valid_registration(oid, oid_type || block)
+              if block_given?
+                @store.register_type(oid, &block)
+              else
+                @store.register_type(oid, oid_type)
+              end
+            end
+
+            def alias_type(oid, target)
+              oid = assert_valid_registration(oid, target)
+              @store.alias_type(oid, target)
+            end
+
+            def register_with_subtype(oid, target_oid)
+              if @store.key?(target_oid)
+                register(oid) do |_, *args|
+                  yield @store.lookup(target_oid, *args)
+                end
+              end
+            end
+
+            def assert_valid_registration(oid, oid_type)
+              raise ArgumentError, "can't register nil type for OID #{oid}" if oid_type.nil?
+              oid.to_i
+            end
+        end
+      end
+    end
+  end
+end

data/lib/active_record/connection_adapters/6.1/cipherstash_pg/oid.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require_relative "./oid/array"
+require_relative "./oid/bit"
+require_relative "./oid/bit_varying"
+require_relative "./oid/bytea"
+require_relative "./oid/cidr"
+require_relative "./oid/date"
+require_relative "./oid/date_time"
+require_relative "./oid/decimal"
+require_relative "./oid/enum"
+require_relative "./oid/hstore"
+require_relative "./oid/inet"
+require_relative "./oid/interval"
+require_relative "./oid/jsonb"
+require_relative "./oid/macaddr"
+require_relative "./oid/money"
+require_relative "./oid/oid"
+require_relative "./oid/point"
+require_relative "./oid/legacy_point"
+require_relative "./oid/range"
+require_relative "./oid/specialized_string"
+require_relative "./oid/uuid"
+require_relative "./oid/vector"
+require_relative "./oid/xml"
+
+require_relative "./oid/type_map_initializer"
+
+module ActiveRecord
+  module ConnectionAdapters
+    module CipherStashPG
+      module OID # :nodoc:
+      end
+    end
+  end
+end