activerecord 5.2.8 → 7.0.2

data/lib/active_record/encryption/key_provider.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Encryption
+    # A +KeyProvider+ serves keys:
+    #
+    # * An encryption key
+    # * A list of potential decryption keys. Serving multiple decryption keys supports rotation-schemes
+    #   where new keys are added but old keys need to continue working
+    class KeyProvider
+      def initialize(keys)
+        @keys = Array(keys)
+      end
+
+      # Returns the first key in the list as the active key to perform encryptions
+      #
+      # When +ActiveRecord::Encryption.config.store_key_references+ is true, the key will include
+      # a public tag referencing the key itself. That key will be stored in the public
+      # headers of the encrypted message
+      def encryption_key
+        @encryption_key ||= @keys.last.tap do |key|
+          key.public_tags.encrypted_data_key_id = key.id if ActiveRecord::Encryption.config.store_key_references
+        end
+
+        @encryption_key
+      end
+
+      # Returns the list of decryption keys
+      #
+      # When the message holds a reference to its encryption key, it will return an array
+      # with that key. If not, it will return the list of keys.
+      def decryption_keys(encrypted_message)
+        if encrypted_message.headers.encrypted_data_key_id
+          keys_grouped_by_id[encrypted_message.headers.encrypted_data_key_id]
+        else
+          @keys
+        end
+      end
+
+      private
+        def keys_grouped_by_id
+          @keys_grouped_by_id ||= @keys.group_by(&:id)
+        end
+    end
+  end
+end

data/lib/active_record/encryption/message.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Encryption
+    # A message defines the structure of the data we store in encrypted attributes. It contains:
+    #
+    # * An encrypted payload
+    # * A list of unencrypted headers
+    #
+    # See +Encryptor#encrypt+
+    class Message
+      attr_accessor :payload, :headers
+
+      def initialize(payload: nil, headers: {})
+        validate_payload_type(payload)
+
+        @payload = payload
+        @headers = Properties.new(headers)
+      end
+
+      def ==(other_message)
+        payload == other_message.payload && headers == other_message.headers
+      end
+
+      private
+        def validate_payload_type(payload)
+          unless payload.is_a?(String) || payload.nil?
+            raise ActiveRecord::Encryption::Errors::ForbiddenClass, "Only string payloads allowed"
+          end
+        end
+    end
+  end
+end

data/lib/active_record/encryption/message_serializer.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Encryption
+    # A message serializer that serializes +Messages+ with JSON.
+    #
+    # The generated structure is pretty simple:
+    #
+    #   {
+    #     p: <payload>,
+    #     h: {
+    #       header1: value1,
+    #       header2: value2,
+    #       ...
+    #     }
+    #   }
+    #
+    # Both the payload and the header values are encoded with Base64
+    # to prevent JSON parsing errors and encoding issues when
+    # storing the resulting serialized data.
+    class MessageSerializer
+      def load(serialized_content)
+        data = JSON.parse(serialized_content)
+        parse_message(data, 1)
+      rescue JSON::ParserError
+        raise ActiveRecord::Encryption::Errors::Encoding
+      end
+
+      def dump(message)
+        raise ActiveRecord::Encryption::Errors::ForbiddenClass unless message.is_a?(ActiveRecord::Encryption::Message)
+        JSON.dump message_to_json(message)
+      end
+
+      private
+        def parse_message(data, level)
+          validate_message_data_format(data, level)
+          ActiveRecord::Encryption::Message.new(payload: decode_if_needed(data["p"]), headers: parse_properties(data["h"], level))
+        end
+
+        def validate_message_data_format(data, level)
+          if level > 2
+            raise ActiveRecord::Encryption::Errors::Decryption, "More than one level of hash nesting in headers is not supported"
+          end
+
+          unless data.is_a?(Hash) && data.has_key?("p")
+            raise ActiveRecord::Encryption::Errors::Decryption, "Invalid data format: hash without payload"
+          end
+        end
+
+        def parse_properties(headers, level)
+          ActiveRecord::Encryption::Properties.new.tap do |properties|
+            headers&.each do |key, value|
+              properties[key] = value.is_a?(Hash) ? parse_message(value, level + 1) : decode_if_needed(value)
+            end
+          end
+        end
+
+        def message_to_json(message)
+          {
+            p: encode_if_needed(message.payload),
+            h: headers_to_json(message.headers)
+          }
+        end
+
+        def headers_to_json(headers)
+          headers.transform_values do |value|
+            value.is_a?(ActiveRecord::Encryption::Message) ? message_to_json(value) : encode_if_needed(value)
+          end
+        end
+
+        def encode_if_needed(value)
+          if value.is_a?(String)
+            ::Base64.strict_encode64 value
+          else
+            value
+          end
+        end
+
+        def decode_if_needed(value)
+          if value.is_a?(String)
+            ::Base64.strict_decode64(value)
+          else
+            value
+          end
+        rescue ArgumentError, TypeError
+          raise Errors::Encoding
+        end
+    end
+  end
+end

data/lib/active_record/encryption/null_encryptor.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Encryption
+    # An encryptor that won't decrypt or encrypt. It will just return the passed
+    # values
+    class NullEncryptor
+      def encrypt(clean_text, key_provider: nil, cipher_options: {})
+        clean_text
+      end
+
+      def decrypt(encrypted_text, key_provider: nil, cipher_options: {})
+        encrypted_text
+      end
+
+      def encrypted?(text)
+        false
+      end
+    end
+  end
+end

data/lib/active_record/encryption/properties.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Encryption
+    # This is a wrapper for a hash of encryption properties. It is used by
+    # +Key+ (public tags) and +Message+ (headers).
+    #
+    # Since properties are serialized in messages, it is important for storage
+    # efficiency to keep their keys as short as possible. It defines accessors
+    # for common properties that will keep these keys very short while exposing
+    # a readable name.
+    #
+    #   message.headers.encrypted_data_key # instead of message.headers[:k]
+    #
+    # See +Properties#DEFAULT_PROPERTIES+, +Key+, +Message+
+    class Properties
+      ALLOWED_VALUE_CLASSES = [String, ActiveRecord::Encryption::Message, Numeric, TrueClass, FalseClass, Symbol, NilClass]
+
+      delegate_missing_to :data
+      delegate :==, to: :data
+
+      # For each entry it generates an accessor exposing the full name
+      DEFAULT_PROPERTIES = {
+        encrypted_data_key: "k",
+        encrypted_data_key_id: "i",
+        compressed: "c",
+        iv: "iv",
+        auth_tag: "at",
+        encoding: "e"
+      }
+
+      DEFAULT_PROPERTIES.each do |name, key|
+        define_method name do
+          self[key.to_sym]
+        end
+
+        define_method "#{name}=" do |value|
+          self[key.to_sym] = value
+        end
+      end
+
+      def initialize(initial_properties = {})
+        @data = {}
+        add(initial_properties)
+      end
+
+      # Set a value for a given key
+      #
+      # It will raise an +EncryptedContentIntegrity+ if the value exists
+      def []=(key, value)
+        raise Errors::EncryptedContentIntegrity, "Properties can't be overridden: #{key}" if key?(key)
+        validate_value_type(value)
+        data[key] = value
+      end
+
+      def validate_value_type(value)
+        unless ALLOWED_VALUE_CLASSES.find { |klass| value.is_a?(klass) }
+          raise ActiveRecord::Encryption::Errors::ForbiddenClass, "Can't store a #{value.class}, only properties of type #{ALLOWED_VALUE_CLASSES.inspect} are allowed"
+        end
+      end
+
+      def add(other_properties)
+        other_properties.each do |key, value|
+          self[key.to_sym] = value
+        end
+      end
+
+      def to_h
+        data
+      end
+
+      private
+        attr_reader :data
+    end
+  end
+end

data/lib/active_record/encryption/read_only_null_encryptor.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Encryption
+    # A +NullEncryptor+ that will raise an error when trying to encrypt data
+    #
+    # This is useful when you want to reveal ciphertexts for debugging purposes
+    # and you want to make sure you won't overwrite any encryptable attribute with
+    # the wrong content.
+    class ReadOnlyNullEncryptor
+      def encrypt(clean_text, key_provider: nil, cipher_options: {})
+        raise Errors::Encryption, "This encryptor is read-only"
+      end
+
+      def decrypt(encrypted_text, key_provider: nil, cipher_options: {})
+        encrypted_text
+      end
+
+      def encrypted?(text)
+        false
+      end
+    end
+  end
+end

data/lib/active_record/encryption/scheme.rb

@@ -0,0 +1,99 @@
+# frozen_string_literal: true
+
+module ActiveRecord
+  module Encryption
+    # A container of attribute encryption options.
+    #
+    # It validates and serves attribute encryption options.
+    #
+    # See +EncryptedAttributeType+, +Context+
+    class Scheme
+      attr_accessor :previous_schemes
+
+      def initialize(key_provider: nil, key: nil, deterministic: nil, downcase: nil, ignore_case: nil,
+                     previous_schemes: nil, **context_properties)
+        # Initializing all attributes to +nil+ as we want to allow a "not set" semantics so that we
+        # can merge schemes without overriding values with defaults. See +#merge+
+
+        @key_provider_param = key_provider
+        @key = key
+        @deterministic = deterministic
+        @downcase = downcase || ignore_case
+        @ignore_case = ignore_case
+        @previous_schemes_param = previous_schemes
+        @previous_schemes = Array.wrap(previous_schemes)
+        @context_properties = context_properties
+
+        validate_config!
+      end
+
+      def ignore_case?
+        @ignore_case
+      end
+
+      def downcase?
+        @downcase
+      end
+
+      def deterministic?
+        @deterministic
+      end
+
+      def fixed?
+        # by default deterministic encryption is fixed
+        @fixed ||= @deterministic && (!@deterministic.is_a?(Hash) || @deterministic[:fixed])
+      end
+
+      def key_provider
+        @key_provider ||= begin
+          validate_keys!
+          @key_provider_param || build_key_provider
+        end
+      end
+
+      def merge(other_scheme)
+        self.class.new(**to_h.merge(other_scheme.to_h))
+      end
+
+      def to_h
+        { key_provider: @key_provider_param, key: @key, deterministic: @deterministic, downcase: @downcase, ignore_case: @ignore_case,
+          previous_schemes: @previous_schemes_param, **@context_properties }.compact
+      end
+
+      def with_context(&block)
+        if @context_properties.present?
+          ActiveRecord::Encryption.with_encryption_context(**@context_properties, &block)
+        else
+          block.call
+        end
+      end
+
+      private
+        def validate_config!
+          raise Errors::Configuration, "ignore_case: can only be used with deterministic encryption" if @ignore_case && !@deterministic
+          raise Errors::Configuration, "key_provider: and key: can't be used simultaneously" if @key_provider_param && @key
+        end
+
+        def validate_keys!
+          validate_credential :key_derivation_salt
+          validate_credential :primary_key, "needs to be configured to use non-deterministic encryption" unless @deterministic
+          validate_credential :deterministic_key, "needs to be configured to use deterministic encryption" if @deterministic
+        end
+
+        def validate_credential(key, error_message = "is not configured")
+          unless ActiveRecord::Encryption.config.public_send(key).present?
+            raise Errors::Configuration, "#{key} #{error_message}. Please configure it via credential "\
+              "active_record_encryption.#{key} or by setting config.active_record.encryption.#{key}"
+          end
+        end
+
+        def build_key_provider
+          return DerivedSecretKeyProvider.new(@key) if @key.present?
+
+          if @deterministic && (deterministic_key = ActiveRecord::Encryption.config.deterministic_key)
+            DeterministicKeyProvider.new(deterministic_key)
+          end
+        end
+    end
+  end
+end

data/lib/active_record/encryption.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "active_support/core_ext/module"
+require "active_support/core_ext/array"
+
+module ActiveRecord
+  module Encryption
+    extend ActiveSupport::Autoload
+
+    eager_autoload do
+      autoload :Cipher
+      autoload :Config
+      autoload :Configurable
+      autoload :Context
+      autoload :Contexts
+      autoload :DerivedSecretKeyProvider
+      autoload :EncryptableRecord
+      autoload :EncryptedAttributeType
+      autoload :EncryptedFixtures
+      autoload :EncryptingOnlyEncryptor
+      autoload :DeterministicKeyProvider
+      autoload :Encryptor
+      autoload :EnvelopeEncryptionKeyProvider
+      autoload :Errors
+      autoload :ExtendedDeterministicQueries
+      autoload :ExtendedDeterministicUniquenessValidator
+      autoload :Key
+      autoload :KeyGenerator
+      autoload :KeyProvider
+      autoload :Message
+      autoload :MessageSerializer
+      autoload :NullEncryptor
+      autoload :Properties
+      autoload :ReadOnlyNullEncryptor
+      autoload :Scheme
+    end
+
+    class Cipher
+      extend ActiveSupport::Autoload
+
+      eager_autoload do
+        autoload :Aes256Gcm
+      end
+    end
+
+    include Configurable
+    include Contexts
+
+    def self.eager_load!
+      super
+
+      Cipher.eager_load!
+    end
+  end
+end