acts_as_secure 0.0.1

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2007 Revolution Health Group LLC. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README

@@ -0,0 +1,149 @@
+== Introduction
+
+ActsAsSecure adds an ability to store ActiveRecord model's fields encrypted in a DB. When a model is marked with acts_as_secure, the :binary type fields are recognized as needed to be stored encrypted. The plugin does before_save/after_save/after_find encryption/decryption thus making it transparent for a code using the secure models.
+
+The plugin supports a master key approach as well as individual records encryption keys. It does not contain any crypto provider but allows to plug in any external one as long as it supports encrypt/decrypt methods.
+
+The fields are converted to a YAML form before encryption. After description they are restored via YAML.load. Since fields are stored encrypted, the find usage is very limited. 
+
+== Usage
+
+=== Master Key Provider Usage
+
+class SecureModel < ActiveRecord::Base
+  acts_as_secure :crypto_provider => MasterKeyProviderClassOrInstance
+end
+
+SecureModel.create()
+SecureModel.find(:first)
+
+=== Individual Keys Provider Usage
+
+class SecureModel < ActiveRecord::Base
+  acts_as_secure
+end
+
+SecureModel.with_crypto_provider(SomeProvider.new(some_param)) { SecureModel.find(:first) }
+SecureModel.with_crypto_provider(SomeProvider.new(some_param)) { SecureModel.create() }
+
+=== Other Options
+
+acts_as_secure :storage_type => :text  -- changes the secure storage type from :binary to the supplied one
+acts_as_secure :except => [:field1, :field2] -- disables the secure behavior for the :binary type fields in a supplied list
+
+== Example
+
+Let's define three models: Fruit (not secure), SecretFruit (uses the master key approach), and UberSecretFruit (uses the individual key approach).
+
+Rot13CryptoProvider represents a master key provider. SaltedRot13CryptoProvider depends on a salt individual for each record.
+
+
+=== Models
+
+class Fruit < ActiveRecord::Base
+  has_one :secret_fruit
+  has_one :uber_secret_fruit 
+end
+
+class CreateFruits < ActiveRecord::Migration
+  def self.up
+    create_table :fruits do |t|
+      t.column :name, :string
+    end
+  end
+end
+
+class Rot13CryptoProvider
+  class << self
+    def encrypt(arg)
+      arg.tr("A-Za-z", "N-ZA-Mn-za-m")
+    end
+    alias_method :decrypt, :encrypt
+  end
+end
+
+class SecretFruit < ActiveRecord::Base
+  acts_as_secure :crypto_provider => Rot13CryptoProvider
+  belongs_to :fruit
+end
+
+class CreateSecretFruits < ActiveRecord::Migration
+  def self.up
+    create_table :secret_fruits do |t|
+      t.column :name, :binary
+      t.column :fruit_id, :integer
+    end
+  end
+end
+
+class SaltedRot13CryptoProvider
+  def initialize(salt)
+    @salt = salt
+  end
+  def encrypt(arg)
+    @salt + arg.tr("A-Za-z", "N-ZA-Mn-za-m")
+  end  
+  def decrypt(arg)
+    arg[@salt.size .. -1].tr("A-Za-z", "N-ZA-Mn-za-m")
+  end  
+end
+
+class UberSecretFruit < ActiveRecord::Base
+  acts_as_secure
+  belongs_to :fruit 
+end
+
+class CreateUberSecretFruits < ActiveRecord::Migration
+  def self.up
+    create_table :uber_secret_fruits do |t|
+      t.column :name, :binary
+      t.column :fruit_id, :integer
+    end
+  end
+end
+
+=== Usage
+
+>> f = Fruit.create(:name => 'passion fruit')
+>> SecretFruit.create(:name => 'maracuya', :fruit => f)
+>> puts f.secret_fruit.name
+maracuya
+>> secret = readline.chomp
+uber_secret
+>> crypto_provider = SaltedRot13CryptoProvider.new(secret)
+>> UberSecretFruit.with_crypto_provider(crypto_provider) { UberSecretFruit.create(:name => 'Passiflora edulis', :fruit => f) }
+>> UberSecretFruit.with_crypto_provider(crypto_provider) { puts f.uber_secret_fruit.name }
+Passiflora edulis
+
+=== DB
+
+> select * from secret_fruits;
++----+---------------+----------+
+| id | name          | fruit_id |
++----+---------------+----------+
+|  1 | --- znenphln  |        1 | 
++----+---------------+----------+
+
+> select * from uber_secret_fruits;
++----+-----------------------------------+----------+
+| id | name                              | fruit_id |
++----+-----------------------------------+----------+
+|  1 | uber_secret--- Cnffvsyben rqhyvf  |        1 | 
++----+-----------------------------------+----------+
+
+
+== Installation
+
+As plugin: 
+script/plugin install svn://rubyforge.org/var/svn/acts-as-secure/trunk/vendor/plugins/acts_as_secure
+
+
+== License
+
+ActsAsSecure released under the MIT license.
+
+
+== Support
+
+The plugin RubyForge page is http://rubyforge.org/projects/acts-as-secure
+

data/init.rb

@@ -0,0 +1 @@
+require 'acts_as_secure'

data/lib/acts_as_secure.rb

@@ -0,0 +1,98 @@
+# Copyright (c) 2007 Revolution Health Group LLC. All rights reserved.
+
+module ActiveRecord; module Acts; end; end 
+
+module ActiveRecord::Acts::ActsAsSecure
+  
+  require 'yaml'
+    
+  def self.included(base)
+    base.extend(ClassMethods)
+  end
+  
+  module ClassMethods
+    
+    @@secure_crypto_providers = {}
+        
+    def acts_as_secure(options = {})
+      parse_options!(options)
+      add_callbacks
+      send(:include, InstanceMethods)
+    end
+
+    def with_crypto_provider(provider)
+      begin
+        @@secure_crypto_providers[Thread.current.object_id] = provider
+        yield
+      ensure
+        @@secure_crypto_providers.delete(Thread.current.object_id)
+      end
+    end
+    
+    def secure_columns
+      columns.reject { |col| (col.type != @secure_storage_type) || @secure_except.include?(col.name) }
+    end
+    
+    def secure_crypto_provider
+      @@secure_crypto_providers[Thread.current.object_id] || @secure_class_crypto_provider
+    end
+      
+  private
+            
+    def parse_options!(options)
+      @secure_except = unsecure_columns(options.delete(:except))
+      @secure_storage_type = options.delete(:storage_type) || :binary
+      @secure_class_crypto_provider = options.delete(:crypto_provider)
+      fail("Unknown option(s): #{ options.keys.join(', ') }") unless options.empty?
+    end
+    
+    def add_callbacks
+      before_save :encrypt_secure_columns
+      after_save :decrypt_secure_columns
+      after_find :decrypt_secure_columns
+      define_method(:after_find) { } 
+    end
+
+    def unsecure_columns(*names)
+      names.flatten.collect(&:to_s)
+    end
+    
+    module InstanceMethods
+
+      def encrypt_secure_columns
+        self.class.secure_columns.each do |col|
+          self[col.name] = secure_encrypt(self[col.name])
+        end
+      end
+      
+      def decrypt_secure_columns
+        self.class.secure_columns.each do |col|
+          self[col.name] = secure_decrypt(send("#{ col.name }_before_type_cast"))
+        end
+      end
+      
+    private
+      
+      def secure_encrypt(arg)
+        secure_crypto_provider.encrypt(arg.to_yaml)
+      end 
+           
+      def secure_decrypt(arg)
+        begin
+          YAML.load(secure_crypto_provider.decrypt(arg))
+        rescue Exception => ex
+          raise "Failed to decode the field. Incorrect key?"
+        end
+      end
+      
+      def secure_crypto_provider
+        self.class.secure_crypto_provider || fail('No crypto provider defined')
+      end
+      
+    end
+    
+  end
+  
+end
+
+ActiveRecord::Base.send(:include, ActiveRecord::Acts::ActsAsSecure)

metadata

@@ -0,0 +1,50 @@
+--- !ruby/object:Gem::Specification 
+rubygems_version: 0.9.2
+specification_version: 1
+name: acts_as_secure
+version: !ruby/object:Gem::Version 
+  version: 0.0.1
+date: 2007-06-07 00:00:00 -04:00
+summary: acts_as_secure adds attributes encryption to ActiveRecord models
+require_paths: 
+- lib
+email: rails-trunk@revolution.com
+homepage: 
+rubyforge_project: 
+description: 
+autorequire: acts_as_secure
+default_executable: 
+bindir: bin
+has_rdoc: false
+required_ruby_version: !ruby/object:Gem::Version::Requirement 
+  requirements: 
+  - - ">"
+    - !ruby/object:Gem::Version 
+      version: 0.0.0
+  version: 
+platform: ruby
+signing_key: 
+cert_chain: 
+post_install_message: 
+authors: 
+- RHG Team
+files: 
+- init.rb
+- lib/acts_as_secure.rb
+- README
+- MIT-LICENSE
+test_files: []
+
+rdoc_options: []
+
+extra_rdoc_files: 
+- README
+- MIT-LICENSE
+executables: []
+
+extensions: []
+
+requirements: []
+
+dependencies: []
+