attr_encrypted 3.0.0 → 3.1.0

data/lib/attr_encrypted.rb

@@ -16,90 +16,93 @@ module AttrEncrypted
   #
   # Options (any other options you specify are passed to the Encryptor's encrypt and decrypt methods)
   #
-  #   attribute:        The name of the referenced encrypted attribute. For example
-  #                     <tt>attr_accessor :email, attribute: :ee</tt> would generate an
-  #                     attribute named 'ee' to store the encrypted email. This is useful when defining
-  #                     one attribute to encrypt at a time or when the :prefix and :suffix options
-  #                     aren't enough.
-  #                     Defaults to nil.
-  #
-  #   prefix:           A prefix used to generate the name of the referenced encrypted attributes.
-  #                     For example <tt>attr_accessor :email, prefix: 'crypted_'</tt> would
-  #                     generate attributes named 'crypted_email' to store the encrypted
-  #                     email and password.
-  #                     Defaults to 'encrypted_'.
-  #
-  #   suffix:           A suffix used to generate the name of the referenced encrypted attributes.
-  #                     For example <tt>attr_accessor :email, prefix: '', suffix: '_encrypted'</tt>
-  #                     would generate attributes named 'email_encrypted' to store the
-  #                     encrypted email.
-  #                     Defaults to ''.
-  #
-  #   key:              The encryption key. This option may not be required if
-  #                     you're using a custom encryptor. If you pass a symbol
-  #                     representing an instance method then the :key option
-  #                     will be replaced with the result of the method before
-  #                     being passed to the encryptor. Objects that respond
-  #                     to :call are evaluated as well (including procs).
-  #                     Any other key types will be passed directly to the encryptor.
-  #                     Defaults to nil.
-  #
-  #   encode:           If set to true, attributes will be encoded as well as
-  #                     encrypted. This is useful if you're planning on storing
-  #                     the encrypted attributes in a database. The default
-  #                     encoding is 'm' (base64), however this can be overwritten
-  #                     by setting the :encode option to some other encoding
-  #                     string instead of just 'true'. See
-  #                     http://www.ruby-doc.org/core/classes/Array.html#M002245
-  #                     for more encoding directives.
-  #                     Defaults to false unless you're using it with ActiveRecord, DataMapper, or Sequel.
-  #
-  #   encode_iv:        Defaults to true.
-
-  #   encode_salt:      Defaults to true.
-  #
-  #   default_encoding: Defaults to 'm' (base64).
-  #
-  #   marshal:          If set to true, attributes will be marshaled as well
-  #                     as encrypted. This is useful if you're planning on
-  #                     encrypting something other than a string.
-  #                     Defaults to false.
-  #
-  #   marshaler:        The object to use for marshaling.
-  #                     Defaults to Marshal.
-  #
-  #   dump_method:      The dump method name to call on the <tt>:marshaler</tt> object to.
-  #                     Defaults to 'dump'.
-  #
-  #   load_method:      The load method name to call on the <tt>:marshaler</tt> object.
-  #                     Defaults to 'load'.
-  #
-  #   encryptor:        The object to use for encrypting.
-  #                     Defaults to Encryptor.
-  #
-  #   encrypt_method:   The encrypt method name to call on the <tt>:encryptor</tt> object.
-  #                     Defaults to 'encrypt'.
-  #
-  #   decrypt_method:   The decrypt method name to call on the <tt>:encryptor</tt> object.
-  #                     Defaults to 'decrypt'.
-  #
-  #   if:               Attributes are only encrypted if this option evaluates
-  #                     to true. If you pass a symbol representing an instance
-  #                     method then the result of the method will be evaluated.
-  #                     Any objects that respond to <tt>:call</tt> are evaluated as well.
-  #                     Defaults to true.
-  #
-  #   unless:           Attributes are only encrypted if this option evaluates
-  #                     to false. If you pass a symbol representing an instance
-  #                     method then the result of the method will be evaluated.
-  #                     Any objects that respond to <tt>:call</tt> are evaluated as well.
-  #                     Defaults to false.
-  #
-  #   mode:             Selects encryption mode for attribute: choose <tt>:single_iv_and_salt</tt> for compatibility
-  #                     with the old attr_encrypted API: the IV is derived from the encryption key by the underlying Encryptor class; salt is not used.
-  #                     The <tt>:per_attribute_iv_and_salt</tt> mode uses a per-attribute IV and salt. The salt is used to derive a unique key per attribute.
-  #                     A <tt>:per_attribute_iv</default> mode derives a unique IV per attribute; salt is not used.
-  #                     Defaults to <tt>:per_attribute_iv</tt>.
+  #   attribute:            The name of the referenced encrypted attribute. For example
+  #                         <tt>attr_accessor :email, attribute: :ee</tt> would generate an
+  #                         attribute named 'ee' to store the encrypted email. This is useful when defining
+  #                         one attribute to encrypt at a time or when the :prefix and :suffix options
+  #                         aren't enough.
+  #                         Defaults to nil.
+  #
+  #   prefix:               A prefix used to generate the name of the referenced encrypted attributes.
+  #                         For example <tt>attr_accessor :email, prefix: 'crypted_'</tt> would
+  #                         generate attributes named 'crypted_email' to store the encrypted
+  #                         email and password.
+  #                         Defaults to 'encrypted_'.
+  #
+  #   suffix:               A suffix used to generate the name of the referenced encrypted attributes.
+  #                         For example <tt>attr_accessor :email, prefix: '', suffix: '_encrypted'</tt>
+  #                         would generate attributes named 'email_encrypted' to store the
+  #                         encrypted email.
+  #                         Defaults to ''.
+  #
+  #   key:                  The encryption key. This option may not be required if
+  #                         you're using a custom encryptor. If you pass a symbol
+  #                         representing an instance method then the :key option
+  #                         will be replaced with the result of the method before
+  #                         being passed to the encryptor. Objects that respond
+  #                         to :call are evaluated as well (including procs).
+  #                         Any other key types will be passed directly to the encryptor.
+  #                         Defaults to nil.
+  #
+  #   encode:               If set to true, attributes will be encoded as well as
+  #                         encrypted. This is useful if you're planning on storing
+  #                         the encrypted attributes in a database. The default
+  #                         encoding is 'm' (base64), however this can be overwritten
+  #                         by setting the :encode option to some other encoding
+  #                         string instead of just 'true'. See
+  #                         http://www.ruby-doc.org/core/classes/Array.html#M002245
+  #                         for more encoding directives.
+  #                         Defaults to false unless you're using it with ActiveRecord, DataMapper, or Sequel.
+  #
+  #   encode_iv:            Defaults to true.
+
+  #   encode_salt:          Defaults to true.
+  #
+  #   default_encoding:     Defaults to 'm' (base64).
+  #
+  #   marshal:              If set to true, attributes will be marshaled as well
+  #                         as encrypted. This is useful if you're planning on
+  #                         encrypting something other than a string.
+  #                         Defaults to false.
+  #
+  #   marshaler:            The object to use for marshaling.
+  #                         Defaults to Marshal.
+  #
+  #   dump_method:          The dump method name to call on the <tt>:marshaler</tt> object to.
+  #                         Defaults to 'dump'.
+  #
+  #   load_method:          The load method name to call on the <tt>:marshaler</tt> object.
+  #                         Defaults to 'load'.
+  #
+  #   encryptor:            The object to use for encrypting.
+  #                         Defaults to Encryptor.
+  #
+  #   encrypt_method:       The encrypt method name to call on the <tt>:encryptor</tt> object.
+  #                         Defaults to 'encrypt'.
+  #
+  #   decrypt_method:       The decrypt method name to call on the <tt>:encryptor</tt> object.
+  #                         Defaults to 'decrypt'.
+  #
+  #   if:                   Attributes are only encrypted if this option evaluates
+  #                         to true. If you pass a symbol representing an instance
+  #                         method then the result of the method will be evaluated.
+  #                         Any objects that respond to <tt>:call</tt> are evaluated as well.
+  #                         Defaults to true.
+  #
+  #   unless:               Attributes are only encrypted if this option evaluates
+  #                         to false. If you pass a symbol representing an instance
+  #                         method then the result of the method will be evaluated.
+  #                         Any objects that respond to <tt>:call</tt> are evaluated as well.
+  #                         Defaults to false.
+  #
+  #   mode:                 Selects encryption mode for attribute: choose <tt>:single_iv_and_salt</tt> for compatibility
+  #                         with the old attr_encrypted API: the IV is derived from the encryption key by the underlying Encryptor class; salt is not used.
+  #                         The <tt>:per_attribute_iv_and_salt</tt> mode uses a per-attribute IV and salt. The salt is used to derive a unique key per attribute.
+  #                         A <tt>:per_attribute_iv</default> mode derives a unique IV per attribute; salt is not used.
+  #                         Defaults to <tt>:per_attribute_iv</tt>.
+  #
+  #   allow_empty_value:    Attributes which have nil or empty string values will not be encrypted unless this option
+  #                         has a truthy value.
   #
   # You can specify your own default options
   #
@@ -140,16 +143,19 @@ module AttrEncrypted
       encrypted_attribute_name = (options[:attribute] ? options[:attribute] : [options[:prefix], attribute, options[:suffix]].join).to_sym
 
       instance_methods_as_symbols = attribute_instance_methods_as_symbols
-      attr_reader encrypted_attribute_name unless instance_methods_as_symbols.include?(encrypted_attribute_name)
-      attr_writer encrypted_attribute_name unless instance_methods_as_symbols.include?(:"#{encrypted_attribute_name}=")
 
-      iv_name = "#{encrypted_attribute_name}_iv".to_sym
-      attr_reader iv_name unless instance_methods_as_symbols.include?(iv_name)
-      attr_writer iv_name unless instance_methods_as_symbols.include?(:"#{iv_name}=")
+      if attribute_instance_methods_as_symbols_available?
+        attr_reader encrypted_attribute_name unless instance_methods_as_symbols.include?(encrypted_attribute_name)
+        attr_writer encrypted_attribute_name unless instance_methods_as_symbols.include?(:"#{encrypted_attribute_name}=")
 
-      salt_name = "#{encrypted_attribute_name}_salt".to_sym
-      attr_reader salt_name unless instance_methods_as_symbols.include?(salt_name)
-      attr_writer salt_name unless instance_methods_as_symbols.include?(:"#{salt_name}=")
+        iv_name = "#{encrypted_attribute_name}_iv".to_sym
+        attr_reader iv_name unless instance_methods_as_symbols.include?(iv_name)
+        attr_writer iv_name unless instance_methods_as_symbols.include?(:"#{iv_name}=")
+
+        salt_name = "#{encrypted_attribute_name}_salt".to_sym
+        attr_reader salt_name unless instance_methods_as_symbols.include?(salt_name)
+        attr_writer salt_name unless instance_methods_as_symbols.include?(:"#{salt_name}=")
+      end
 
       define_method(attribute) do
         instance_variable_get("@#{attribute}") || instance_variable_set("@#{attribute}", decrypt(attribute, send(encrypted_attribute_name)))
@@ -197,6 +203,7 @@ module AttrEncrypted
       decrypt_method:    'decrypt',
       mode:              :per_attribute_iv,
       algorithm:         'aes-256-gcm',
+      allow_empty_value: false,
     }
   end
 
@@ -228,7 +235,7 @@ module AttrEncrypted
   #   email = User.decrypt(:email, 'SOME_ENCRYPTED_EMAIL_STRING')
   def decrypt(attribute, encrypted_value, options = {})
     options = encrypted_attributes[attribute.to_sym].merge(options)
-    if options[:if] && !options[:unless] && !encrypted_value.nil? && !(encrypted_value.is_a?(String) && encrypted_value.empty?)
+    if options[:if] && !options[:unless] && not_empty?(encrypted_value)
       encrypted_value = encrypted_value.unpack(options[:encode]).first if options[:encode]
       value = options[:encryptor].send(options[:decrypt_method], options.merge!(value: encrypted_value))
       if options[:marshal]
@@ -254,7 +261,7 @@ module AttrEncrypted
   #   encrypted_email = User.encrypt(:email, 'test@example.com')
   def encrypt(attribute, value, options = {})
     options = encrypted_attributes[attribute.to_sym].merge(options)
-    if options[:if] && !options[:unless] && !value.nil? && !(value.is_a?(String) && value.empty?)
+    if options[:if] && !options[:unless] && (options[:allow_empty_value] || not_empty?(value))
       value = options[:marshal] ? options[:marshaler].send(options[:dump_method], value) : value.to_s
       encrypted_value = options[:encryptor].send(options[:encrypt_method], options.merge!(value: value))
       encrypted_value = [encrypted_value].pack(options[:encode]) if options[:encode]
@@ -264,6 +271,10 @@ module AttrEncrypted
     end
   end
 
+  def not_empty?(value)
+    !value.nil? && !(value.is_a?(String) && value.empty?)
+  end
+
   # Contains a hash of encrypted attributes with virtual attribute names as keys
   # and their corresponding options as values
   #
@@ -314,6 +325,7 @@ module AttrEncrypted
     #  @user.decrypt(:email, 'SOME_ENCRYPTED_EMAIL_STRING')
     def decrypt(attribute, encrypted_value)
       encrypted_attributes[attribute.to_sym][:operation] = :decrypting
+      encrypted_attributes[attribute.to_sym][:value_present] = self.class.not_empty?(encrypted_value)
       self.class.decrypt(attribute, encrypted_value, evaluated_attr_encrypted_options_for(attribute))
     end
 
@@ -334,6 +346,7 @@ module AttrEncrypted
     #  @user.encrypt(:email, 'test@example.com')
     def encrypt(attribute, value)
       encrypted_attributes[attribute.to_sym][:operation] = :encrypting
+      encrypted_attributes[attribute.to_sym][:value_present] = self.class.not_empty?(value)
       self.class.encrypt(attribute, value, evaluated_attr_encrypted_options_for(attribute))
     end
 
@@ -357,12 +370,14 @@ module AttrEncrypted
         evaluated_options[:attribute] = attribute_option_value
 
         evaluated_options.tap do |options|
-          unless options[:mode] == :single_iv_and_salt
-            load_iv_for_attribute(attribute, options)
-          end
-
-          if options[:mode] == :per_attribute_iv_and_salt
-            load_salt_for_attribute(attribute, options)
+          if options[:if] && !options[:unless] && options[:value_present] || options[:allow_empty_value]
+            unless options[:mode] == :single_iv_and_salt
+              load_iv_for_attribute(attribute, options)
+            end
+
+            if options[:mode] == :per_attribute_iv_and_salt
+              load_salt_for_attribute(attribute, options)
+            end
           end
         end
       end
@@ -371,7 +386,7 @@ module AttrEncrypted
       #
       # If the option is not a symbol or proc then the original option is returned
       def evaluate_attr_encrypted_option(option)
-        if option.is_a?(Symbol) && respond_to?(option)
+        if option.is_a?(Symbol) && respond_to?(option, true)
           send(option)
         elsif option.respond_to?(:call)
           option.call(self)
@@ -408,7 +423,7 @@ module AttrEncrypted
         encrypted_attribute_name = options[:attribute]
         encode_salt = options[:encode_salt]
         salt = options[:salt] || send("#{encrypted_attribute_name}_salt")
-        if (salt == nil)
+        if options[:operation] == :encrypting
           salt = SecureRandom.random_bytes
           salt = prefix_and_encode_salt(salt, encode_salt) if encode_salt
           send("#{encrypted_attribute_name}_salt=", salt)
@@ -436,6 +451,10 @@ module AttrEncrypted
     instance_methods.collect { |method| method.to_sym }
   end
 
+  def attribute_instance_methods_as_symbols_available?
+    true
+  end
+
 end
 
 

data/test/active_record_test.rb

@@ -3,47 +3,44 @@ require_relative 'test_helper'
 ActiveRecord::Base.establish_connection(adapter: 'sqlite3', database: ':memory:')
 
 def create_tables
-  silence_stream(STDOUT) do
-    ActiveRecord::Schema.define(version: 1) do
-      create_table :people do |t|
-        t.string   :encrypted_email
-        t.string   :password
-        t.string   :encrypted_credentials
-        t.binary   :salt
-        t.binary   :key_iv
-        t.string   :encrypted_email_salt
-        t.string   :encrypted_credentials_salt
-        t.string   :encrypted_email_iv
-        t.string   :encrypted_credentials_iv
-      end
-      create_table :accounts do |t|
-        t.string :encrypted_password
-        t.string :encrypted_password_iv
-        t.string :encrypted_password_salt
-      end
-      create_table :users do |t|
-        t.string :login
-        t.string :encrypted_password
-        t.string :encrypted_password_iv
-        t.boolean :is_admin
-      end
-      create_table :prime_ministers do |t|
-        t.string :encrypted_name
-        t.string :encrypted_name_iv
-      end
-      create_table :addresses do |t|
-        t.binary :encrypted_street
-        t.binary :encrypted_street_iv
-        t.binary :encrypted_zipcode
-        t.string :mode
-      end
+  ActiveRecord::Schema.define(version: 1) do
+    self.verbose = false
+    create_table :people do |t|
+      t.string   :encrypted_email
+      t.string   :password
+      t.string   :encrypted_credentials
+      t.binary   :salt
+      t.binary   :key_iv
+      t.string   :encrypted_email_salt
+      t.string   :encrypted_credentials_salt
+      t.string   :encrypted_email_iv
+      t.string   :encrypted_credentials_iv
+    end
+    create_table :accounts do |t|
+      t.string :encrypted_password
+      t.string :encrypted_password_iv
+      t.string :encrypted_password_salt
+      t.string :key
+    end
+    create_table :users do |t|
+      t.string :login
+      t.string :encrypted_password
+      t.string :encrypted_password_iv
+      t.boolean :is_admin
+    end
+    create_table :prime_ministers do |t|
+      t.string :encrypted_name
+      t.string :encrypted_name_iv
+    end
+    create_table :addresses do |t|
+      t.binary :encrypted_street
+      t.binary :encrypted_street_iv
+      t.binary :encrypted_zipcode
+      t.string :mode
     end
   end
 end
 
-# The table needs to exist before defining the class
-create_tables
-
 ActiveRecord::MissingAttributeError = ActiveModel::MissingAttributeError unless defined?(ActiveRecord::MissingAttributeError)
 
 if ::ActiveRecord::VERSION::STRING > "4.0"
@@ -82,8 +79,20 @@ class PersonWithProcMode < Person
 end
 
 class Account < ActiveRecord::Base
-  attr_accessor :key
-  attr_encrypted :password, key: Proc.new {|account| account.key}
+  ACCOUNT_ENCRYPTION_KEY = SecureRandom.urlsafe_base64(24)
+  attr_encrypted :password, key: :password_encryption_key
+
+  def encrypting?(attr)
+    encrypted_attributes[attr][:operation] == :encrypting
+  end
+
+  def password_encryption_key
+    if encrypting?(:password)
+      self.key = ACCOUNT_ENCRYPTION_KEY
+    else
+      self.key
+    end
+  end
 end
 
 class PersonWithSerialization < ActiveRecord::Base
@@ -117,9 +126,8 @@ end
 class ActiveRecordTest < Minitest::Test
 
   def setup
-    ActiveRecord::Base.connection.tables.each { |table| ActiveRecord::Base.connection.drop_table(table) }
+    drop_all_tables
     create_tables
-    Account.create!(key: SECRET_KEY, password: "password")
   end
 
   def test_should_encrypt_email
@@ -169,12 +177,6 @@ class ActiveRecordTest < Minitest::Test
     Account.new.attributes = { password: "password", key: SECRET_KEY }
   end
 
-  def test_should_preserve_hash_key_type
-    hash = { foo: 'bar' }
-    account = Account.create!(key: hash)
-    assert_equal account.key, hash
-  end
-
   def test_should_create_changed_predicate
     person = Person.create!(email: 'test@example.com')
     refute person.email_changed?
@@ -192,6 +194,29 @@ class ActiveRecordTest < Minitest::Test
     assert_equal original_email, person.email_was
     person.email = 'test2@example.com'
     assert_equal original_email, person.email_was
+    old_pm_name = "Winston Churchill"
+    pm = PrimeMinister.create!(name: old_pm_name)
+    assert_equal old_pm_name, pm.name_was
+    old_zipcode = "90210"
+    address = Address.create!(zipcode: old_zipcode, mode: "single_iv_and_salt")
+    assert_equal old_zipcode, address.zipcode_was
+  end
+
+  def test_attribute_was_works_when_options_for_old_encrypted_value_are_different_than_options_for_new_encrypted_value
+    pw = 'password'
+    crypto_key = SecureRandom.urlsafe_base64(24)
+    old_iv = SecureRandom.random_bytes(12)
+    account = Account.create
+    encrypted_value = Encryptor.encrypt(value: pw, iv: old_iv, key: crypto_key)
+    Account.where(id: account.id).update_all(key: crypto_key, encrypted_password_iv: [old_iv].pack('m'), encrypted_password: [encrypted_value].pack('m'))
+    account = Account.find(account.id)
+    assert_equal pw, account.password
+    account.password = pw.reverse
+    assert_equal pw, account.password_was
+    account.save
+    account.reload
+    assert_equal Account::ACCOUNT_ENCRYPTION_KEY, account.key
+    assert_equal pw.reverse, account.password
   end
 
   if ::ActiveRecord::VERSION::STRING > "4.0"
@@ -305,7 +330,9 @@ class ActiveRecordTest < Minitest::Test
   def test_should_evaluate_proc_based_mode
     street = '123 Elm'
     zipcode = '12345'
-    address = Address.new(street: street, zipcode: zipcode, mode: :single_iv_and_salt)
-    assert_nil address.encrypted_zipcode_iv
+    address = Address.create(street: street, zipcode: zipcode, mode: :single_iv_and_salt)
+    address.reload
+    refute_equal address.encrypted_zipcode, zipcode
+    assert_equal address.zipcode, zipcode
   end
 end

data/test/attr_encrypted_test.rb

@@ -23,11 +23,12 @@ class User
   attr_encrypted :with_encoding, :key => SECRET_KEY, :encode => true
   attr_encrypted :with_custom_encoding, :key => SECRET_KEY, :encode => 'm'
   attr_encrypted :with_marshaling, :key => SECRET_KEY, :marshal => true
-  attr_encrypted :with_true_if, :key => SECRET_KEY, :if => true
-  attr_encrypted :with_false_if, :key => SECRET_KEY, :if => false
-  attr_encrypted :with_true_unless, :key => SECRET_KEY, :unless => true
-  attr_encrypted :with_false_unless, :key => SECRET_KEY, :unless => false
+  attr_encrypted :with_true_if, :key => SECRET_KEY, :if => true, mode: :per_attribute_iv_and_salt
+  attr_encrypted :with_false_if, :key => SECRET_KEY, :if => false, mode: :per_attribute_iv_and_salt
+  attr_encrypted :with_true_unless, :key => SECRET_KEY, :unless => true, mode: :per_attribute_iv_and_salt
+  attr_encrypted :with_false_unless, :key => SECRET_KEY, :unless => false, mode: :per_attribute_iv_and_salt
   attr_encrypted :with_if_changed, :key => SECRET_KEY, :if => :should_encrypt
+  attr_encrypted :with_allow_empty_value, key: SECRET_KEY, allow_empty_value: true, marshal: true
 
   attr_encryptor :aliased, :key => SECRET_KEY
 
@@ -40,6 +41,7 @@ class User
     self.should_encrypt = true
   end
 
+  private
   def secret_key
     SECRET_KEY
   end
@@ -114,7 +116,7 @@ class AttrEncryptedTest < Minitest::Test
     assert_nil User.encrypt_email(nil, iv: @iv)
   end
 
-  def test_should_not_encrypt_empty_string
+  def test_should_not_encrypt_empty_string_by_default
     assert_equal '', User.encrypt_email('', iv: @iv)
   end
 
@@ -150,9 +152,14 @@ class AttrEncryptedTest < Minitest::Test
   def test_should_decrypt_email_when_reading
     @user = User.new
     assert_nil @user.email
-    iv = @user.encrypted_email_iv.unpack('m').first
-    salt = @user.encrypted_email_salt[1..-1].unpack('m').first
+    options = @user.encrypted_attributes[:email]
+    iv = @user.send(:generate_iv, options[:algorithm])
+    encoded_iv = [iv].pack(options[:encode_iv])
+    salt = SecureRandom.random_bytes
+    encoded_salt = @user.send(:prefix_and_encode_salt, salt, options[:encode_salt])
     @user.encrypted_email = User.encrypt_email('test@example.com', iv: iv, salt: salt)
+    @user.encrypted_email_iv = encoded_iv
+    @user.encrypted_email_salt = encoded_salt
     assert_equal 'test@example.com', @user.email
   end
 
@@ -282,6 +289,18 @@ class AttrEncryptedTest < Minitest::Test
     assert_equal 'testing', @user.encrypted_with_true_unless
   end
 
+  def test_should_encrypt_empty_with_truthy_allow_empty_value_option
+    @user = User.new
+    assert_nil @user.encrypted_with_allow_empty_value
+    @user.with_allow_empty_value = ''
+    refute_nil @user.encrypted_with_allow_empty_value
+    assert_equal '', @user.with_allow_empty_value
+    @user = User.new
+    @user.with_allow_empty_value = nil
+    refute_nil @user.encrypted_with_allow_empty_value
+    assert_nil @user.with_allow_empty_value
+  end
+
   def test_should_work_with_aliased_attr_encryptor
     assert User.encrypted_attributes.include?(:aliased)
   end
@@ -390,4 +409,61 @@ class AttrEncryptedTest < Minitest::Test
     user.email = 'revised_value@test.com'
     refute_equal original_iv, user.encrypted_email_iv
   end
+
+  def test_should_not_generate_iv_for_attribute_when_if_option_is_false
+    user = User.new
+    user.with_false_if = 'derp'
+    assert_nil user.encrypted_with_false_if_iv
+  end
+
+  def test_should_generate_iv_for_attribute_when_if_option_is_true
+    user = User.new
+    user.with_true_if = 'derp'
+    refute_nil user.encrypted_with_true_if_iv
+
+    user.with_true_if = Object.new
+    refute_nil user.encrypted_with_true_if_iv
+  end
+
+  def test_should_not_generate_salt_for_attribute_when_if_option_is_false
+    user = User.new
+    user.with_false_if = 'derp'
+    assert_nil user.encrypted_with_false_if_salt
+  end
+
+  def test_should_generate_salt_for_attribute_when_if_option_is_true
+    user = User.new
+    user.with_true_if = 'derp'
+    refute_nil user.encrypted_with_true_if_salt
+  end
+
+  def test_should_generate_iv_for_attribute_when_unless_option_is_false
+    user = User.new
+    user.with_false_unless = 'derp'
+    refute_nil user.encrypted_with_false_unless_iv
+  end
+
+  def test_should_not_generate_iv_for_attribute_when_unless_option_is_true
+    user = User.new
+    user.with_true_unless = 'derp'
+    assert_nil user.encrypted_with_true_unless_iv
+  end
+
+  def test_should_generate_salt_for_attribute_when_unless_option_is_false
+    user = User.new
+    user.with_false_unless = 'derp'
+    refute_nil user.encrypted_with_false_unless_salt
+  end
+
+  def test_should_not_generate_salt_for_attribute_when_unless_option_is_true
+    user = User.new
+    user.with_true_unless = 'derp'
+    assert_nil user.encrypted_with_true_unless_salt
+  end
+
+  def test_should_not_by_default_generate_iv_when_attribute_is_empty
+    user = User.new
+    user.with_true_if = nil
+    assert_nil user.encrypted_with_true_if_iv
+  end
 end

data/test/compatibility_test.rb

@@ -41,7 +41,7 @@ class CompatibilityTest < Minitest::Test
   end
 
   def setup
-    ActiveRecord::Base.connection.tables.each { |table| ActiveRecord::Base.connection.drop_table(table) }
+    drop_all_tables
     create_tables
   end
 
@@ -81,26 +81,24 @@ class CompatibilityTest < Minitest::Test
   private
 
   def create_tables
-    silence_stream(STDOUT) do
-      ActiveRecord::Schema.define(:version => 1) do
-        create_table :nonmarshalling_pets do |t|
-          t.string :name
-          t.string :encrypted_nickname
-          t.string :encrypted_nickname_iv
-          t.string :encrypted_nickname_salt
-          t.string :encrypted_birthdate
-          t.string :encrypted_birthdate_iv
-          t.string :encrypted_birthdate_salt
-        end
-        create_table :marshalling_pets do |t|
-          t.string :name
-          t.string :encrypted_nickname
-          t.string :encrypted_nickname_iv
-          t.string :encrypted_nickname_salt
-          t.string :encrypted_birthdate
-          t.string :encrypted_birthdate_iv
-          t.string :encrypted_birthdate_salt
-        end
+    ActiveRecord::Schema.define(:version => 1) do
+      create_table :nonmarshalling_pets do |t|
+        t.string :name
+        t.string :encrypted_nickname
+        t.string :encrypted_nickname_iv
+        t.string :encrypted_nickname_salt
+        t.string :encrypted_birthdate
+        t.string :encrypted_birthdate_iv
+        t.string :encrypted_birthdate_salt
+      end
+      create_table :marshalling_pets do |t|
+        t.string :name
+        t.string :encrypted_nickname
+        t.string :encrypted_nickname_iv
+        t.string :encrypted_nickname_salt
+        t.string :encrypted_birthdate
+        t.string :encrypted_birthdate_iv
+        t.string :encrypted_birthdate_salt
       end
     end
   end