attr_encrypted 1.3.3 → 2.0.0

data/test/active_record_test.rb

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 
 ActiveRecord::Base.establish_connection :adapter => 'sqlite3', :database => ':memory:'
 
@@ -25,6 +25,15 @@ def create_tables
         t.string :encrypted_password
         t.boolean :is_admin
       end
+      create_table :prime_ministers do |t|
+        t.string :encrypted_name
+      end
+      create_table :addresses do |t|
+        t.binary :encrypted_street
+        t.binary :encrypted_street_iv
+        t.binary :encrypted_zipcode
+        t.string :mode
+      end
     end
   end
 end
@@ -33,7 +42,6 @@ end
 create_tables
 
 ActiveRecord::MissingAttributeError = ActiveModel::MissingAttributeError unless defined?(ActiveRecord::MissingAttributeError)
-ActiveRecord::Base.logger = Logger.new(nil) if ::ActiveRecord::VERSION::STRING < "3.0"
 
 if ::ActiveRecord::VERSION::STRING > "4.0"
   module Rack
@@ -48,15 +56,9 @@ end
 class Person < ActiveRecord::Base
   self.attr_encrypted_options[:mode] = :per_attribute_iv_and_salt
   attr_encrypted :email, :key => SECRET_KEY
-  attr_encrypted :credentials, :key => Proc.new { |user| Encryptor.encrypt(:value => user.salt, :key => SECRET_KEY) }, :marshal => true
+  attr_encrypted :credentials, :key => Proc.new { |user| Encryptor.encrypt(:value => user.salt, :key => SECRET_KEY, iv: SecureRandom.random_bytes(12)) }, :marshal => true
 
-  if ActiveRecord::VERSION::STRING < "3"
-    def after_initialize
-      initialize_salt_and_credentials
-    end
-  else
-    after_initialize :initialize_salt_and_credentials
-  end
+  after_initialize :initialize_salt_and_credentials
 
   protected
 
@@ -70,6 +72,11 @@ class PersonWithValidation < Person
   validates_presence_of :email
 end
 
+class PersonWithProcMode < Person
+  attr_encrypted :email,       :key => SECRET_KEY, :mode => Proc.new { :per_attribute_iv_and_salt }
+  attr_encrypted :credentials, :key => SECRET_KEY, :mode => Proc.new { :single_iv_and_salt }, insecure_mode: true
+end
+
 class Account < ActiveRecord::Base
   attr_accessor :key
   attr_encrypted :password, :key => Proc.new {|account| account.key}
@@ -77,22 +84,33 @@ end
 
 class PersonWithSerialization < ActiveRecord::Base
   self.table_name = 'people'
-  attr_encrypted :email, :key => 'a secret key'
+  attr_encrypted :email, :key => SECRET_KEY
   serialize :password
 end
 
 class UserWithProtectedAttribute < ActiveRecord::Base
   self.table_name = 'users'
-  attr_encrypted :password, :key => 'a secret key'
+  attr_encrypted :password, :key => SECRET_KEY
   attr_protected :is_admin if ::ActiveRecord::VERSION::STRING < "4.0"
 end
 
 class PersonUsingAlias < ActiveRecord::Base
   self.table_name = 'people'
-  attr_encryptor :email, :key => 'a secret key'
+  attr_encryptor :email, :key => SECRET_KEY
 end
 
-class ActiveRecordTest < Test::Unit::TestCase
+class PrimeMinister < ActiveRecord::Base
+  attr_encrypted :name, :marshal => true, :key => SECRET_KEY
+end
+
+class Address < ActiveRecord::Base
+  self.attr_encrypted_options[:marshal] = false
+  self.attr_encrypted_options[:encode] = false
+  attr_encrypted :street, encode_iv: false, key: SECRET_KEY
+  attr_encrypted :zipcode, key: SECRET_KEY, mode: Proc.new { |address| address.mode.to_sym }, insecure_mode: true
+end
+
+class ActiveRecordTest < Minitest::Test
 
   def setup
     ActiveRecord::Base.connection.tables.each { |table| ActiveRecord::Base.connection.drop_table(table) }
@@ -102,16 +120,16 @@ class ActiveRecordTest < Test::Unit::TestCase
 
   def test_should_encrypt_email
     @person = Person.create :email => 'test@example.com'
-    assert_not_nil @person.encrypted_email
-    assert_not_equal @person.email, @person.encrypted_email
-    assert_equal @person.email, Person.find(:first).email
+    refute_nil @person.encrypted_email
+    refute_equal @person.email, @person.encrypted_email
+    assert_equal @person.email, Person.first.email
   end
 
   def test_should_marshal_and_encrypt_credentials
     @person = Person.create
-    assert_not_nil @person.encrypted_credentials
-    assert_not_equal @person.credentials, @person.encrypted_credentials
-    assert_equal @person.credentials, Person.find(:first).credentials
+    refute_nil @person.encrypted_credentials
+    refute_equal @person.credentials, @person.encrypted_credentials
+    assert_equal @person.credentials, Person.first.credentials
   end
 
   def test_should_encode_by_default
@@ -127,7 +145,7 @@ class ActiveRecordTest < Test::Unit::TestCase
   def test_should_encrypt_decrypt_with_iv
     @person = Person.create :email => 'test@example.com'
     @person2 = Person.find(@person.id)
-    assert_not_nil @person2.encrypted_email_iv
+    refute_nil @person2.encrypted_email_iv
     assert_equal 'test@example.com', @person2.email
   end
 
@@ -142,6 +160,32 @@ class ActiveRecordTest < Test::Unit::TestCase
     Account.create!(:password => "password" , :key => SECRET_KEY)
   end
 
+  def test_should_set_attributes_regardless_of_arguments_order
+    # minitest does not implement `assert_nothing_raised` https://github.com/seattlerb/minitest/issues/112
+    Account.new.attributes = { :password => "password" , :key => SECRET_KEY }
+  end
+
+  def test_should_preserve_hash_key_type
+    hash = { :foo => 'bar' }
+    account = Account.create!(:key => hash)
+    assert_equal account.key, hash
+  end
+
+  def test_should_create_changed_predicate
+    person = Person.create!(:email => 'test@example.com')
+    assert !person.email_changed?
+    person.email = 'test2@example.com'
+    assert person.email_changed?
+  end
+
+  def test_should_create_was_predicate
+    original_email = 'test@example.com'
+    person = Person.create!(:email => original_email)
+    assert !person.email_was
+    person.email = 'test2@example.com'
+    assert_equal person.email_was, original_email
+  end
+
   if ::ActiveRecord::VERSION::STRING > "4.0"
     def test_should_assign_attributes
       @user = UserWithProtectedAttribute.new :login => 'login', :is_admin => false
@@ -157,13 +201,13 @@ class ActiveRecordTest < Test::Unit::TestCase
 
     def test_should_raise_exception_if_not_permitted
       @user = UserWithProtectedAttribute.new :login => 'login', :is_admin => false
-      assert_raise ActiveModel::ForbiddenAttributesError do
+      assert_raises ActiveModel::ForbiddenAttributesError do
         @user.attributes = ActionController::Parameters.new(:login => 'modified', :is_admin => true)
       end
     end
 
     def test_should_raise_exception_on_init_if_not_permitted
-      assert_raise ActiveModel::ForbiddenAttributesError do
+      assert_raises ActiveModel::ForbiddenAttributesError do
         @user = UserWithProtectedAttribute.new ActionController::Parameters.new(:login => 'modified', :is_admin => true)
       end
     end
@@ -196,6 +240,22 @@ class ActiveRecordTest < Test::Unit::TestCase
     assert_nil(@person.attributes = nil)
   end
 
+  def test_should_allow_proc_based_mode
+    @person = PersonWithProcMode.create :email => 'test@example.com', :credentials => 'password123'
+
+    # Email is :per_attribute_iv_and_salt
+    assert_equal @person.class.encrypted_attributes[:email][:mode].class, Proc
+    assert_equal @person.class.encrypted_attributes[:email][:mode].call, :per_attribute_iv_and_salt
+    refute_nil @person.encrypted_email_salt
+    refute_nil @person.encrypted_email_iv
+
+    # Credentials is :single_iv_and_salt
+    assert_equal @person.class.encrypted_attributes[:credentials][:mode].class, Proc
+    assert_equal @person.class.encrypted_attributes[:credentials][:mode].call, :single_iv_and_salt
+    assert_nil @person.encrypted_credentials_salt
+    assert_nil @person.encrypted_credentials_iv
+  end
+
   if ::ActiveRecord::VERSION::STRING > "3.1"
     def test_should_allow_assign_attributes_with_nil
       @person = Person.new
@@ -203,15 +263,41 @@ class ActiveRecordTest < Test::Unit::TestCase
     end
   end
 
-  class TestAlias < Test::Unit::TestCase
-    def test_that_alias_encrypts_column
-      user = PersonUsingAlias.new
-      user.email = 'test@example.com'
-      user.save
+  def test_that_alias_encrypts_column
+    user = PersonUsingAlias.new
+    user.email = 'test@example.com'
+    user.save
 
-      assert_not_nil user.encrypted_email
-      assert_not_equal user.email, user.encrypted_email
-      assert_equal user.email, PersonUsingAlias.find(:first).email
-    end
+    refute_nil user.encrypted_email
+    refute_equal user.email, user.encrypted_email
+    assert_equal user.email, PersonUsingAlias.first.email
+  end
+
+  # See https://github.com/attr-encrypted/attr_encrypted/issues/68
+  def test_should_invalidate_virtual_attributes_on_reload
+    pm = PrimeMinister.new(:name => 'Winston Churchill')
+    pm.save!
+    assert_equal 'Winston Churchill', pm.name
+    pm.name = 'Neville Chamberlain'
+    assert_equal 'Neville Chamberlain', pm.name
+
+    result = pm.reload
+    assert_equal pm, result
+    assert_equal 'Winston Churchill', pm.name
+  end
+
+  def test_should_save_encrypted_data_as_binary
+    street = '123 Elm'
+    address = Address.new(street: street)
+    address.save!
+    refute_equal address.encrypted_street, street
+    assert_equal Address.first.street, street
+  end
+
+  def test_should_evaluate_proc_based_mode
+    street = '123 Elm'
+    zipcode = '12345'
+    address = Address.new(street: street, zipcode: zipcode, mode: :single_iv_and_salt)
+    assert_nil address.encrypted_zipcode_iv
   end
 end

data/test/attr_encrypted_test.rb

@@ -1,5 +1,5 @@
 # encoding: UTF-8
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 
 class SillyEncryptor
   def self.silly_encrypt(options)
@@ -12,6 +12,7 @@ class SillyEncryptor
 end
 
 class User
+  extend AttrEncrypted
   self.attr_encrypted_options[:key] = Proc.new { |user| SECRET_KEY } # default key
   self.attr_encrypted_options[:mode] = :per_attribute_iv_and_salt
 
@@ -33,7 +34,8 @@ class User
   attr_accessor :salt
   attr_accessor :should_encrypt
 
-  def initialize
+  def initialize(email: nil)
+    self.email = email
     self.salt = Time.now.to_i.to_s
     self.should_encrypt = true
   end
@@ -48,19 +50,40 @@ class Admin < User
 end
 
 class SomeOtherClass
+  extend AttrEncrypted
   def self.call(object)
     object.class
   end
 end
 
-class AttrEncryptedTest < Test::Unit::TestCase
+class YetAnotherClass
+  extend AttrEncrypted
+  self.attr_encrypted_options[:encode_iv] = false
+
+  attr_encrypted :email, :key => SECRET_KEY
+  attr_encrypted :phone_number, :key => SECRET_KEY, mode: Proc.new { |thing| thing.mode }, encode_iv: Proc.new { |thing| thing.encode_iv }, encode_salt: Proc.new { |thing| thing.encode_salt }
+
+  def initialize(email: nil, encode_iv: 'm', encode_salt: 'm', mode: :per_attribute_iv_and_salt)
+    self.email = email
+    @encode_iv = encode_iv
+    @encode_salt = encode_salt
+    @mode = mode
+  end
+
+  attr_reader :encode_iv, :encode_salt, :mode
+end
+
+class AttrEncryptedTest < Minitest::Test
+  def setup
+    @iv = SecureRandom.random_bytes(12)
+  end
 
   def test_should_store_email_in_encrypted_attributes
     assert User.encrypted_attributes.include?(:email)
   end
 
   def test_should_not_store_salt_in_encrypted_attributes
-    assert !User.encrypted_attributes.include?(:salt)
+    refute User.encrypted_attributes.include?(:salt)
   end
 
   def test_attr_encrypted_should_return_true_for_email
@@ -68,7 +91,7 @@ class AttrEncryptedTest < Test::Unit::TestCase
   end
 
   def test_attr_encrypted_should_not_use_the_same_attribute_name_for_two_attributes_in_the_same_line
-    assert_not_equal User.encrypted_attributes[:email][:attribute], User.encrypted_attributes[:without_encoding][:attribute]
+    refute_equal User.encrypted_attributes[:email][:attribute], User.encrypted_attributes[:without_encoding][:attribute]
   end
 
   def test_attr_encrypted_should_return_false_for_salt
@@ -88,71 +111,75 @@ class AttrEncryptedTest < Test::Unit::TestCase
   end
 
   def test_should_not_encrypt_nil_value
-    assert_nil User.encrypt_email(nil)
+    assert_nil User.encrypt_email(nil, iv: @iv)
   end
 
   def test_should_not_encrypt_empty_string
-    assert_equal '', User.encrypt_email('')
+    assert_equal '', User.encrypt_email('', iv: @iv)
   end
 
   def test_should_encrypt_email
-    assert_not_nil User.encrypt_email('test@example.com')
-    assert_not_equal 'test@example.com', User.encrypt_email('test@example.com')
+    refute_nil User.encrypt_email('test@example.com', iv: @iv)
+    refute_equal 'test@example.com', User.encrypt_email('test@example.com', iv: @iv)
   end
 
   def test_should_encrypt_email_when_modifying_the_attr_writer
     @user = User.new
     assert_nil @user.encrypted_email
     @user.email = 'test@example.com'
-    assert_not_nil @user.encrypted_email
-    assert_equal User.encrypt_email('test@example.com'), @user.encrypted_email
+    refute_nil @user.encrypted_email
+    iv = @user.encrypted_email_iv.unpack('m').first
+    salt = @user.encrypted_email_salt[1..-1].unpack('m').first
+    assert_equal User.encrypt_email('test@example.com', iv: iv, salt: salt), @user.encrypted_email
   end
 
   def test_should_not_decrypt_nil_value
-    assert_nil User.decrypt_email(nil)
+    assert_nil User.decrypt_email(nil, iv: @iv)
   end
 
   def test_should_not_decrypt_empty_string
-    assert_equal '', User.decrypt_email('')
+    assert_equal '', User.decrypt_email('', iv: @iv)
   end
 
   def test_should_decrypt_email
-    encrypted_email = User.encrypt_email('test@example.com')
-    assert_not_equal 'test@test.com', encrypted_email
-    assert_equal 'test@example.com', User.decrypt_email(encrypted_email)
+    encrypted_email = User.encrypt_email('test@example.com', iv: @iv)
+    refute_equal 'test@test.com', encrypted_email
+    assert_equal 'test@example.com', User.decrypt_email(encrypted_email, iv: @iv)
   end
 
   def test_should_decrypt_email_when_reading
     @user = User.new
     assert_nil @user.email
-    @user.encrypted_email = User.encrypt_email('test@example.com')
+    iv = @user.encrypted_email_iv.unpack('m').first
+    salt = @user.encrypted_email_salt[1..-1].unpack('m').first
+    @user.encrypted_email = User.encrypt_email('test@example.com', iv: iv, salt: salt)
     assert_equal 'test@example.com', @user.email
   end
 
   def test_should_encrypt_with_encoding
-    assert_equal User.encrypt_with_encoding('test'), [User.encrypt_without_encoding('test')].pack('m')
+    assert_equal User.encrypt_with_encoding('test', iv: @iv), [User.encrypt_without_encoding('test', iv: @iv)].pack('m')
   end
 
   def test_should_decrypt_with_encoding
-    encrypted = User.encrypt_with_encoding('test')
-    assert_equal 'test', User.decrypt_with_encoding(encrypted)
-    assert_equal User.decrypt_with_encoding(encrypted), User.decrypt_without_encoding(encrypted.unpack('m').first)
+    encrypted = User.encrypt_with_encoding('test', iv: @iv)
+    assert_equal 'test', User.decrypt_with_encoding(encrypted, iv: @iv)
+    assert_equal User.decrypt_with_encoding(encrypted, iv: @iv), User.decrypt_without_encoding(encrypted.unpack('m').first, iv: @iv)
   end
 
   def test_should_encrypt_with_custom_encoding
-    assert_equal User.encrypt_with_encoding('test'), [User.encrypt_without_encoding('test')].pack('m')
+    assert_equal User.encrypt_with_encoding('test', iv: @iv), [User.encrypt_without_encoding('test', iv: @iv)].pack('m')
   end
 
   def test_should_decrypt_with_custom_encoding
-    encrypted = User.encrypt_with_encoding('test')
-    assert_equal 'test', User.decrypt_with_encoding(encrypted)
-    assert_equal User.decrypt_with_encoding(encrypted), User.decrypt_without_encoding(encrypted.unpack('m').first)
+    encrypted = User.encrypt_with_encoding('test', iv: @iv)
+    assert_equal 'test', User.decrypt_with_encoding(encrypted, iv: @iv)
+    assert_equal User.decrypt_with_encoding(encrypted, iv: @iv), User.decrypt_without_encoding(encrypted.unpack('m').first, iv: @iv)
   end
 
   def test_should_encrypt_with_marshaling
     @user = User.new
     @user.with_marshaling = [1, 2, 3]
-    assert_not_nil @user.encrypted_with_marshaling
+    refute_nil @user.encrypted_with_marshaling
   end
 
   def test_should_use_custom_encryptor_and_crypt_method_names_and_arguments
@@ -163,8 +190,8 @@ class AttrEncryptedTest < Test::Unit::TestCase
     @user = User.new
     assert_nil @user.ssn_encrypted
     @user.ssn = 'testing'
-    assert_not_nil @user.ssn_encrypted
-    encrypted =  Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.ssn_encrypted_iv.unpack("m").first, :salt => @user.ssn_encrypted_salt )
+    refute_nil @user.ssn_encrypted
+    encrypted =  Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.ssn_encrypted_iv.unpack("m").first, :salt => @user.ssn_encrypted_salt.unpack("m").first )
     assert_equal encrypted, @user.ssn_encrypted
   end
 
@@ -172,8 +199,8 @@ class AttrEncryptedTest < Test::Unit::TestCase
     @user = User.new
     assert_nil @user.crypted_password_test
     @user.password = 'testing'
-    assert_not_nil @user.crypted_password_test
-    encrypted = Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.crypted_password_test_iv.unpack("m").first, :salt =>  @user.crypted_password_test_salt)
+    refute_nil @user.crypted_password_test
+    encrypted = Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.crypted_password_test_iv.unpack("m").first, :salt =>  @user.crypted_password_test_salt.unpack("m").first)
     assert_equal encrypted, @user.crypted_password_test
   end
 
@@ -181,8 +208,8 @@ class AttrEncryptedTest < Test::Unit::TestCase
     @user = User.new
     assert_nil @user.crypted_password_test
     @user.password = 'testing'
-    assert_not_nil @user.crypted_password_test
-    encrypted = Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.crypted_password_test_iv.unpack("m").first, :salt => @user.crypted_password_test_salt)
+    refute_nil @user.crypted_password_test
+    encrypted = Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.crypted_password_test_iv.unpack("m").first, :salt => @user.crypted_password_test_salt.unpack("m").first)
     assert_equal encrypted, @user.crypted_password_test
   end
 
@@ -201,31 +228,32 @@ class AttrEncryptedTest < Test::Unit::TestCase
   end
 
   def test_should_evaluate_a_symbol_option
-    assert_equal Object, Object.new.send(:evaluate_attr_encrypted_option, :class)
+    assert_equal SomeOtherClass, SomeOtherClass.new.send(:evaluate_attr_encrypted_option, :class)
   end
 
   def test_should_evaluate_a_proc_option
-    assert_equal Object, Object.new.send(:evaluate_attr_encrypted_option, proc { |object| object.class })
+    assert_equal SomeOtherClass, SomeOtherClass.new.send(:evaluate_attr_encrypted_option, proc { |object| object.class })
   end
 
   def test_should_evaluate_a_lambda_option
-    assert_equal Object, Object.new.send(:evaluate_attr_encrypted_option, lambda { |object| object.class })
+    assert_equal SomeOtherClass, SomeOtherClass.new.send(:evaluate_attr_encrypted_option, lambda { |object| object.class })
   end
 
   def test_should_evaluate_a_method_option
-    assert_equal Object, Object.new.send(:evaluate_attr_encrypted_option, SomeOtherClass.method(:call))
+    assert_equal SomeOtherClass, SomeOtherClass.new.send(:evaluate_attr_encrypted_option, SomeOtherClass.method(:call))
   end
 
   def test_should_return_a_string_option
-    assert_equal 'Object', Object.new.send(:evaluate_attr_encrypted_option, 'Object')
+    class_string = 'SomeOtherClass'
+    assert_equal class_string, SomeOtherClass.new.send(:evaluate_attr_encrypted_option, class_string)
   end
 
   def test_should_encrypt_with_true_if
     @user = User.new
     assert_nil @user.encrypted_with_true_if
     @user.with_true_if = 'testing'
-    assert_not_nil @user.encrypted_with_true_if
-    encrypted = Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.encrypted_with_true_if_iv.unpack("m").first, :salt => @user.encrypted_with_true_if_salt)
+    refute_nil @user.encrypted_with_true_if
+    encrypted = Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.encrypted_with_true_if_iv.unpack("m").first, :salt => @user.encrypted_with_true_if_salt.unpack("m").first)
     assert_equal encrypted, @user.encrypted_with_true_if
   end
 
@@ -233,7 +261,7 @@ class AttrEncryptedTest < Test::Unit::TestCase
     @user = User.new
     assert_nil @user.encrypted_with_false_if
     @user.with_false_if = 'testing'
-    assert_not_nil @user.encrypted_with_false_if
+    refute_nil @user.encrypted_with_false_if
     assert_equal 'testing', @user.encrypted_with_false_if
   end
 
@@ -241,8 +269,8 @@ class AttrEncryptedTest < Test::Unit::TestCase
     @user = User.new
     assert_nil @user.encrypted_with_false_unless
     @user.with_false_unless = 'testing'
-    assert_not_nil @user.encrypted_with_false_unless
-    encrypted = Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.encrypted_with_false_unless_iv.unpack("m").first, :salt => @user.encrypted_with_false_unless_salt)
+    refute_nil @user.encrypted_with_false_unless
+    encrypted = Encryptor.encrypt(:value => 'testing', :key => SECRET_KEY, :iv => @user.encrypted_with_false_unless_iv.unpack("m").first, :salt => @user.encrypted_with_false_unless_salt.unpack("m").first)
     assert_equal encrypted,  @user.encrypted_with_false_unless
   end
 
@@ -250,7 +278,7 @@ class AttrEncryptedTest < Test::Unit::TestCase
     @user = User.new
     assert_nil @user.encrypted_with_true_unless
     @user.with_true_unless = 'testing'
-    assert_not_nil @user.encrypted_with_true_unless
+    refute_nil @user.encrypted_with_true_unless
     assert_equal 'testing', @user.encrypted_with_true_unless
   end
 
@@ -261,11 +289,6 @@ class AttrEncryptedTest < Test::Unit::TestCase
   def test_should_always_reset_options
     @user = User.new
     @user.with_if_changed = "encrypt_stuff"
-    @user.stubs(:instance_variable_get).returns(nil)
-    @user.stubs(:instance_variable_set).raises("BadStuff")
-    assert_raise RuntimeError do
-      @user.with_if_changed
-    end
 
     @user = User.new
     @user.should_encrypt = false
@@ -275,9 +298,9 @@ class AttrEncryptedTest < Test::Unit::TestCase
   end
 
   def test_should_cast_values_as_strings_before_encrypting
-    string_encrypted_email = User.encrypt_email('3')
-    assert_equal string_encrypted_email, User.encrypt_email(3)
-    assert_equal '3', User.decrypt_email(string_encrypted_email)
+    string_encrypted_email = User.encrypt_email('3', iv: @iv)
+    assert_equal string_encrypted_email, User.encrypt_email(3, iv: @iv)
+    assert_equal '3', User.decrypt_email(string_encrypted_email, iv: @iv)
   end
 
   def test_should_create_query_accessor
@@ -293,7 +316,12 @@ class AttrEncryptedTest < Test::Unit::TestCase
     @user = User.new
     @user.email = 'email@example.com'
     @user.password = 'p455w0rd'
-    assert_not_equal @user.encrypted_email_iv, @user.crypted_password_test_iv
+    refute_equal @user.encrypted_email_iv, @user.crypted_password_test_iv
+  end
+
+  def test_should_generate_iv_per_attribute_by_default
+    thing = YetAnotherClass.new(email: 'thing@thing.com')
+    refute_nil thing.encrypted_email_iv
   end
 
   def test_should_vary_iv_per_instance
@@ -301,14 +329,15 @@ class AttrEncryptedTest < Test::Unit::TestCase
     @user1.email = 'email@example.com'
     @user2 = User.new
     @user2.email = 'email@example.com'
-    assert_not_equal @user1.encrypted_email_iv, @user2.encrypted_email_iv
+    refute_equal @user1.encrypted_email_iv, @user2.encrypted_email_iv
+    refute_equal @user1.encrypted_email, @user2.encrypted_email
   end
 
   def test_should_vary_salt_per_attribute
     @user = User.new
     @user.email = 'email@example.com'
     @user.password = 'p455w0rd'
-    assert_not_equal @user.encrypted_email_salt, @user.crypted_password_test_salt
+    refute_equal @user.encrypted_email_salt, @user.crypted_password_test_salt
   end
 
   def test_should_vary_salt_per_instance
@@ -316,7 +345,12 @@ class AttrEncryptedTest < Test::Unit::TestCase
     @user1.email = 'email@example.com'
     @user2 = User.new
     @user2.email = 'email@example.com'
-    assert_not_equal @user1.encrypted_email_salt, @user2.encrypted_email_salt
+    refute_equal @user1.encrypted_email_salt, @user2.encrypted_email_salt
+  end
+
+  def test_should_not_generate_salt_per_attribute_by_default
+    thing = YetAnotherClass.new(email: 'thing@thing.com')
+    assert_nil thing.encrypted_email_salt
   end
 
   def test_should_decrypt_second_record
@@ -328,4 +362,32 @@ class AttrEncryptedTest < Test::Unit::TestCase
 
     assert_equal 'test@example.com', @user1.decrypt(:email, @user1.encrypted_email)
   end
+
+  def test_should_specify_the_default_algorithm
+    assert YetAnotherClass.encrypted_attributes[:email][:algorithm]
+    assert_equal YetAnotherClass.encrypted_attributes[:email][:algorithm], 'aes-256-gcm'
+  end
+
+  def test_should_not_encode_iv_when_encode_iv_is_false
+    email = 'thing@thing.com'
+    thing = YetAnotherClass.new(email: email)
+    refute thing.encrypted_email_iv =~ base64_encoding_regex
+    assert_equal thing.email, email
+  end
+
+  def test_should_base64_encode_iv_by_default
+    phone_number = '555-555-5555'
+    thing = YetAnotherClass.new
+    thing.phone_number = phone_number
+    assert thing.encrypted_phone_number_iv =~ base64_encoding_regex
+    assert_equal thing.phone_number, phone_number
+  end
+
+  def test_should_generate_unique_iv_for_every_encrypt_operation
+    user = User.new
+    user.email = 'initial_value@test.com'
+    original_iv = user.encrypted_email_iv
+    user.email = 'revised_value@test.com'
+    refute_equal original_iv, user.encrypted_email_iv
+  end
 end