aws-s3-cse 0.1.0

data/.document

@@ -0,0 +1,5 @@
+lib/**/*.rb
+bin/*
+- 
+features/**/*.feature
+LICENSE.txt

data/Gemfile

@@ -0,0 +1,18 @@
+source "http://rubygems.org"
+# Add dependencies required to use your gem here.
+# Example:
+#   gem "activesupport", ">= 2.3.5"
+
+# Add dependencies to develop your gem here.
+# Include everything needed to run rake, tests, features, etc.
+
+gem 'aws-sdk'
+gem 'builder'
+
+group :development do
+  gem "jeweler", "~> 1.8.3"
+  gem "rspec", ">= 2.8.0"
+  gem "rspec-mocks", ">= 2.9.0"
+  gem "rspec-spies", ">= 2.1.0"
+  gem "rcov", "0.9.9"
+end

data/Gemfile.lock

@@ -0,0 +1,50 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    aws-sdk (1.3.9)
+      httparty (~> 0.7)
+      json (~> 1.4)
+      nokogiri (>= 1.4.4)
+      uuidtools (~> 2.1)
+    builder (3.0.0)
+    diff-lcs (1.1.3)
+    git (1.2.5)
+    httparty (0.8.1)
+      multi_json
+      multi_xml
+    jeweler (1.8.3)
+      bundler (~> 1.0)
+      git (>= 1.2.5)
+      rake
+      rdoc
+    json (1.6.6)
+    multi_json (1.2.0)
+    multi_xml (0.4.2)
+    nokogiri (1.5.2)
+    rake (0.9.2.2)
+    rcov (0.9.9)
+    rdoc (3.12)
+      json (~> 1.4)
+    rspec (2.9.0)
+      rspec-core (~> 2.9.0)
+      rspec-expectations (~> 2.9.0)
+      rspec-mocks (~> 2.9.0)
+    rspec-core (2.9.0)
+    rspec-expectations (2.9.1)
+      diff-lcs (~> 1.1.3)
+    rspec-mocks (2.9.0)
+    rspec-spies (2.1.0)
+      rspec (~> 2.0)
+    uuidtools (2.1.2)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  aws-sdk
+  builder
+  jeweler (~> 1.8.3)
+  rcov (= 0.9.9)
+  rspec (>= 2.8.0)
+  rspec-mocks (>= 2.9.0)
+  rspec-spies (>= 2.1.0)

data/LICENSE.txt

@@ -0,0 +1,20 @@
+Copyright (c) 2012 Tom Nijmeijer
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,24 @@
+= aws-s3-cse
+
+Provides a bare-bones Ruby implementation of the client-side encryption for the AWS S3 service. When writing data to AWS the data is encrypted using a randomly generated envelope key and initialization vector. The envelope key is encrypted using a private key provided by the user and added as metadata to the object together with the initialization vector. When reading the object the envelope key is decrypted using the user-provided public key. The data is then decrypted using the envelope key.
+
+The following config options are added to AWS.config:
+* s3_private_key - the private key with which to encrypt the envelope key
+* s3_public_key - the public key with which to decrypt the envelope key
+* s3_client_side_encryption - boolean indicating whether to use client side encryption or not
+
+== Contributing to aws-s3-cse
+ 
+* Check out the latest master to make sure the feature hasn't been implemented or the bug hasn't been fixed yet.
+* Check out the issue tracker to make sure someone already hasn't requested it and/or contributed it.
+* Fork the project.
+* Start a feature/bugfix branch.
+* Commit and push until you are happy with your contribution.
+* Make sure to add tests for it. This is important so I don't break it in a future version unintentionally.
+* Please try not to mess with the Rakefile, version, or history. If you want to have your own version, or is otherwise necessary, that is fine, but please isolate to its own commit so I can cherry-pick around it.
+
+== Copyright
+
+Copyright (c) 2012 Tom Nijmeijer. See LICENSE.txt for
+further details.
+

data/Rakefile

@@ -0,0 +1,40 @@
+# encoding: utf-8
+
+require 'rubygems'
+require 'bundler'
+begin
+  Bundler.setup(:default, :development)
+rescue Bundler::BundlerError => e
+  $stderr.puts e.message
+  $stderr.puts "Run `bundle install` to install missing gems"
+  exit e.status_code
+end
+require 'rake'
+
+require 'jeweler'
+Jeweler::Tasks.new do |gem|
+  # gem is a Gem::Specification... see http://docs.rubygems.org/read/chapter/20 for more options
+  gem.name = "aws-s3-cse"
+  gem.homepage = "http://github.com/tcnijmeijer/aws-s3-cse"
+  gem.license = "MIT"
+  gem.summary = "Provides a ruby implementation of the Client Side Encryption client for AWS-S3"
+  gem.description = "Provides a ruby implementation of the Client Side Encryption client for AWS-S3"
+  gem.email = "tom@nijmeijer.org"
+  gem.authors = ["Tom Nijmeijer"]
+  # dependencies defined in Gemfile
+end
+Jeweler::RubygemsDotOrgTasks.new
+
+require 'rspec/core/rake_task'
+RSpec::Core::RakeTask.new(:spec) do |spec|
+ spec.pattern      = './spec/**/*_spec.rb'
+end
+
+RSpec::Core::RakeTask.new(:rcov) do |rcov|
+ rcov.pattern    = "./spec/**/*_spec.rb"
+ rcov.rcov       = true
+ rcov.rspec_opts = "--format doc --color"
+ rcov.rcov_opts  = "-x gem,spec"
+end
+
+task :default => :spec

data/VERSION

@@ -0,0 +1 @@
+0.1.0

data/aws-s3-cse.gemspec

@@ -0,0 +1,75 @@
+# Generated by jeweler
+# DO NOT EDIT THIS FILE DIRECTLY
+# Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |s|
+  s.name = "aws-s3-cse"
+  s.version = "0.1.0"
+
+  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Tom Nijmeijer"]
+  s.date = "2012-04-27"
+  s.description = "Provides a ruby implementation of the Client Side Encryption client for AWS-S3"
+  s.email = "tom@nijmeijer.org"
+  s.extra_rdoc_files = [
+    "LICENSE.txt",
+    "README.rdoc"
+  ]
+  s.files = [
+    ".document",
+    "Gemfile",
+    "Gemfile.lock",
+    "LICENSE.txt",
+    "README.rdoc",
+    "Rakefile",
+    "VERSION",
+    "aws-s3-cse.gemspec",
+    "lib/aws-s3-cse.rb",
+    "lib/aws/s3/crypter.rb",
+    "lib/aws/s3/encrypted_client.rb",
+    "lib/aws/s3/encrypted_config.rb",
+    "lib/aws/s3/encryption_errors.rb",
+    "lib/aws/s3/model.rb",
+    "spec/aws/s3/crypter_spec.rb",
+    "spec/aws/s3/encrypted_client_spec.rb",
+    "spec/aws/s3/model_spec.rb",
+    "spec/spec_helper.rb"
+  ]
+  s.homepage = "http://github.com/tcnijmeijer/aws-s3-cse"
+  s.licenses = ["MIT"]
+  s.require_paths = ["lib"]
+  s.rubygems_version = "1.8.21"
+  s.summary = "Provides a ruby implementation of the Client Side Encryption client for AWS-S3"
+
+  if s.respond_to? :specification_version then
+    s.specification_version = 3
+
+    if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+      s.add_runtime_dependency(%q<aws-sdk>, [">= 0"])
+      s.add_runtime_dependency(%q<builder>, [">= 0"])
+      s.add_development_dependency(%q<jeweler>, ["~> 1.8.3"])
+      s.add_development_dependency(%q<rspec>, [">= 2.8.0"])
+      s.add_development_dependency(%q<rspec-mocks>, [">= 2.9.0"])
+      s.add_development_dependency(%q<rspec-spies>, [">= 2.1.0"])
+      s.add_development_dependency(%q<rcov>, ["= 0.9.9"])
+    else
+      s.add_dependency(%q<aws-sdk>, [">= 0"])
+      s.add_dependency(%q<builder>, [">= 0"])
+      s.add_dependency(%q<jeweler>, ["~> 1.8.3"])
+      s.add_dependency(%q<rspec>, [">= 2.8.0"])
+      s.add_dependency(%q<rspec-mocks>, [">= 2.9.0"])
+      s.add_dependency(%q<rspec-spies>, [">= 2.1.0"])
+      s.add_dependency(%q<rcov>, ["= 0.9.9"])
+    end
+  else
+    s.add_dependency(%q<aws-sdk>, [">= 0"])
+    s.add_dependency(%q<builder>, [">= 0"])
+    s.add_dependency(%q<jeweler>, ["~> 1.8.3"])
+    s.add_dependency(%q<rspec>, [">= 2.8.0"])
+    s.add_dependency(%q<rspec-mocks>, [">= 2.9.0"])
+    s.add_dependency(%q<rspec-spies>, [">= 2.1.0"])
+    s.add_dependency(%q<rcov>, ["= 0.9.9"])
+  end
+end
+

data/lib/aws-s3-cse.rb

@@ -0,0 +1,7 @@
+require 'aws/s3'
+
+require 'aws/s3/model'
+require 'aws/s3/encryption_errors'
+require 'aws/s3/encrypted_config'
+require 'aws/s3/encrypted_client'
+require 'aws/s3/crypter'

data/lib/aws/s3/crypter.rb

@@ -0,0 +1,35 @@
+require 'openssl'
+
+module AWS
+  class S3
+    class Crypter
+      attr_reader :cipher
+
+      def initialize(cipher_name = 'aes-256-cbc')
+        @cipher = OpenSSL::Cipher::Cipher.new(cipher_name)
+      end
+
+      def encrypt_data(data)
+        cipher.encrypt
+
+        key   = cipher.random_key
+        iv    = cipher.random_iv
+        edata = cipher.update(data)
+        edata << cipher.final
+
+        [edata, key, iv]
+      end
+
+      def decrypt_data(edata, key, iv)
+        cipher.decrypt
+
+        cipher.key = key
+        cipher.iv  = iv
+
+        data = cipher.update(edata)
+        data << cipher.final
+        data.to_s
+      end
+    end
+  end
+end

data/lib/aws/s3/encrypted_client.rb

@@ -0,0 +1,73 @@
+require 'stringio'
+
+module AWS
+  class S3
+    class EncryptedClient < Client
+      attr_reader :private_encryption_key
+      attr_reader :public_encryption_key
+
+      HEADER_META = "x-amz-meta"
+      HEADER_KEY  = "x-amz-key"
+      HEADER_IV   = "x-amz-iv"
+
+      def initialize(options = {})
+        config = (options[:config] || AWS.config).with(options)
+        @private_encryption_key = config.s3_private_key
+        @public_encryption_key  = config.s3_public_key
+        raise "missing public and/or private key" unless private_encryption_key && public_encryption_key
+        super
+      end
+
+      def put_object(options = {})
+        if block_given?
+          buffer = StringIO.new
+          yield buffer
+          options[:data] = buffer.string
+        end
+
+        edata, key, iv = crypter.encrypt_data(options[:data])
+        key = @private_encryption_key.private_encrypt(key)
+
+        options[:metadata]           ||= {}
+        options[:metadata][HEADER_KEY] = URI.encode(Base64.encode64(key))
+        options[:metadata][HEADER_IV]  = URI.encode(Base64.encode64(iv))
+        options[:data]                 = edata
+        super
+      end
+
+      def get_object(options = {})
+        response = super
+
+        ekey = response.http_response.headers["#{HEADER_META}-#{HEADER_KEY}"]
+        iv   = response.http_response.headers["#{HEADER_META}-#{HEADER_IV}"]
+
+        if ekey && iv
+          ekey  = Base64.decode64(URI.decode(ekey))
+          iv    = Base64.decode64(URI.decode(iv))
+          edata = response.data
+
+          begin
+            key = @public_encryption_key.public_decrypt(ekey)
+          rescue Exception => e
+            raise Errors::DecryptionError.new(@public_encryption_key, ekey, e)
+          end
+
+          data  = crypter.decrypt_data(edata, key, iv)
+          Core::MetaUtils.extend_method(response, :data) { data }
+        else
+          raise Errors::UnencryptedData.new(response.http_request, response.http_response)
+        end
+
+        response
+      end
+
+      def crypter=(crypter)
+        @crypter = crypter
+      end
+
+      def crypter
+        @crypter ||= Crypter.new
+      end
+    end
+  end
+end

data/lib/aws/s3/encrypted_config.rb

@@ -0,0 +1,31 @@
+AWS::Core::Configuration.module_eval do
+
+  add_option :s3_client_side_encryption, nil
+  add_option :s3_private_key, nil
+  add_option :s3_public_key, nil
+
+  needs = [
+    :signer, 
+    :http_handler, 
+    :s3_endpoint,
+    :s3_port,
+    :s3_private_key,
+    :s3_public_key,
+    :max_retries,
+    :stub_requests?,
+    :proxy_uri,
+    :use_ssl?,
+    :ssl_verify_peer?,
+    :ssl_ca_file,
+    :user_agent_prefix,
+    :logger,
+    :log_formatter,
+    :log_level,
+  ]
+
+  create_block = lambda do |config| 
+    AWS::S3::EncryptedClient.new(:config => config)
+  end
+
+  add_option_with_needs :s3_encrypted_client, needs, &create_block
+end

data/lib/aws/s3/encryption_errors.rb

@@ -0,0 +1,30 @@
+module AWS
+  class S3
+    module Errors
+
+      class UnencryptedData < AWS::Errors::Base
+        include AWS::Errors::ClientError
+
+        def code; "UnencryptedData"; end
+
+        def initialize(req, resp)
+          super(req, resp, "UnencryptedData")
+        end
+      end
+
+      class DecryptionError < StandardError
+        attr_reader :public_key
+        attr_reader :env_key
+        attr_reader :original
+
+        def initialize(public_key, env_key, original)
+          @public_key = public_key
+          @env_key    = env_key
+          @original   = original
+          super("Could not decrypt envelope key using the given public key")
+        end
+      end
+
+    end
+  end
+end

data/lib/aws/s3/model.rb

@@ -0,0 +1,73 @@
+module AWS
+  class S3
+    module Model
+      def client
+        if @config.s3_client_side_encryption
+          @config.send(:s3_encrypted_client)
+        else
+          @config.send(:s3_client)
+        end
+      end
+    end
+
+    class Bucket
+      include S3::Model
+    end
+
+    class BucketCollection
+      include S3::Model
+    end
+
+    class MultipartUpload
+      include S3::Model
+    end
+
+    class MultipartUploadCollection
+      include S3::Model
+    end
+
+    class ObjectCollection
+      include S3::Model
+    end
+
+    class ObjectMetadata
+      include S3::Model
+    end
+
+    class ObjectUploadCollection
+      include S3::Model
+    end
+
+    class ObjectVersion
+      include S3::Model
+    end
+
+    class ObjectVersionCollection
+      include S3::Model
+    end
+
+    class PresignedPost
+      include S3::Model
+    end
+
+    class S3Object
+      include S3::Model
+    end
+
+    class Tree::ChildCollection
+      include S3::Model
+    end
+
+    module Tree::Parent
+      include S3::Model
+    end
+
+    class UploadedPart
+      include S3::Model
+    end
+
+    class UploadedPartCollection
+      include S3::Model
+    end
+  end
+end

data/spec/aws/s3/crypter_spec.rb

@@ -0,0 +1,70 @@
+require 'spec_helper'
+
+module AWS
+  class S3
+
+    describe Crypter do
+      let(:crypter) { Crypter.new }
+      let(:cipher) { crypter.cipher }
+
+      context "#encrypt_data" do
+        before :all do
+          RSpec::Mocks.setup(cipher)
+          cipher.stub!(:random_key).and_return("random_key")
+          cipher.stub!(:random_iv).and_return("random_iv")
+          cipher.stub!(:update).and_return("edat")
+          cipher.stub!(:final).and_return("a")
+          @result = crypter.encrypt_data("data")
+        end
+
+        it "should generate a random key" do
+          cipher.should have_received(:random_key)
+        end
+
+        it "should generate a random iv" do
+          cipher.should have_received(:random_iv)
+        end
+
+        it "should encrypt the data" do
+          cipher.should have_received(:update).with("data")
+          cipher.should have_received(:final)
+        end
+
+        it "should return the encrypted data, key and iv" do
+          @result[0].should == "edata"
+          @result[1].should == "random_key"
+          @result[2].should == "random_iv"
+        end
+      end
+
+      context "#decrypt_data" do
+        before :all do
+          RSpec::Mocks.setup(cipher)
+          cipher.stub!(:key=)
+          cipher.stub!(:iv=)
+          cipher.stub!(:update).and_return("dat")
+          cipher.stub!(:final).and_return("a")
+          @result = crypter.decrypt_data("edata", "random_key", "random_iv")
+        end
+
+        it "should set the key" do
+          cipher.should have_received(:key=).with("random_key")
+        end
+
+        it "should set the iv" do
+          cipher.should have_received(:iv=).with("random_iv")
+        end
+
+        it "should decrypt the data" do
+          cipher.should have_received(:update).with("edata")
+          cipher.should have_received(:final)
+        end
+
+        it "should return the unencrypted data" do
+          @result.should == "data"
+        end
+      end
+    end
+
+  end
+end

data/spec/aws/s3/encrypted_client_spec.rb

@@ -0,0 +1,209 @@
+require 'spec_helper'
+
+module AWS
+  class S3
+
+    describe EncryptedClient do
+      describe "getting one" do
+        let(:credentials) do
+          { :access_key_id => "access key id",
+            :secret_access_key => "secret access key" }
+        end
+
+        let(:rsa_key) { OpenSSL::PKey::RSA.generate(1024) }
+
+        it "accepts the assymetric key via a hash" do
+          client = EncryptedClient.new(credentials.merge(:s3_private_key => rsa_key, :s3_public_key => rsa_key))
+
+          client.public_encryption_key.should  == rsa_key
+          client.private_encryption_key.should == rsa_key
+        end
+
+        it "accepts the assymetric key as part of a config" do
+          config = AWS.config.with(credentials).with(:s3_private_key => rsa_key, :s3_public_key => rsa_key)
+          client = EncryptedClient.new(:config => config)
+
+          client.public_encryption_key.should  == rsa_key
+          client.private_encryption_key.should == rsa_key
+        end
+
+        it "accepts the assymetric key as part of the default AWS.config" do
+          AWS.config(:s3_private_key => rsa_key, :s3_public_key => rsa_key)
+          client = EncryptedClient.new(credentials)
+
+          client.public_encryption_key.should  == rsa_key
+          client.private_encryption_key.should == rsa_key
+
+          AWS.config(:s3_private_key => nil, :s3_public_key => nil)
+        end
+
+        it "requires an assymetric key" do
+          lambda do
+            EncryptedClient.new(credentials)
+          end.should raise_error(/missing public and\/or private key/)
+        end
+
+        it 'should be accessible from the configuration' do
+          config = AWS.config.with(:access_key_id => 'foo', :secret_access_key => 'bar',
+                                   :s3_private_key => rsa_key, :s3_public_key => rsa_key)
+          config.s3_encrypted_client.should be_a(S3::EncryptedClient)
+        end
+      end
+
+      context '#put_object' do
+        let :rsa_key do
+          key = OpenSSL::PKey::RSA.generate(1024)
+          key.stub(:private_encrypt).and_return("EKEY")
+          key
+        end
+
+        let :credentials do
+          { :access_key_id => "access key id", :secret_access_key => "secret access key" }
+        end
+
+        let :opts do
+          {:bucket_name => 'foo', :key => 'some/key', :data => 'HELLO'}
+        end
+
+        let :crypter do
+          crypter = Crypter.new
+          crypter.stub(:encrypt_data).and_return(["HARRO", "KEY", "VECTOR"])
+          crypter
+        end
+
+        let :client do
+          client = EncryptedClient.new(credentials.merge(:s3_private_key => rsa_key, :s3_public_key => rsa_key))
+          client.crypter = crypter
+          client
+        end
+
+        before :all do
+
+          class Client
+            def super_calls
+              @super_calls ||= []
+            end
+
+            def put_object opts
+              self.super_calls << [:put_object, opts]
+            end
+          end
+
+          client.put_object(:data => "HELLO", :key => "file", :bucket_name => "bucket")
+        end
+
+        it "should encrypt the data using a Crypter" do
+          crypter.should have_received(:encrypt_data).with("HELLO")
+        end
+
+        it "should encrypt the envelope key using the private encryption key" do
+          rsa_key.should have_received(:private_encrypt).with("KEY")
+        end
+
+        it "should call super" do
+          client.super_calls.size.should == 1
+          client.super_calls.first.first.should == :put_object
+        end
+
+        it "should call super with encrypted data" do
+          args = client.super_calls.first.last
+          args[:data].should == "HARRO"
+        end
+
+        it "should call super with the encrypted envelope key as metadata" do
+          args = client.super_calls.first.last
+          args[:metadata]["x-amz-key"].should == URI.encode(Base64.encode64("EKEY"))
+        end
+
+        it "should call super with the initialization vector as metadata" do
+          args = client.super_calls.first.last
+          args[:metadata]["x-amz-iv"].should == URI.encode(Base64.encode64("VECTOR"))
+        end
+      end
+
+      context '#get_object' do
+        let :rsa_key do
+          key = OpenSSL::PKey::RSA.generate(1024)
+          key.stub(:public_decrypt).and_return("KEY")
+          key
+        end
+
+        let :credentials do
+          { :access_key_id => "access key id", :secret_access_key => "secret access key" }
+        end
+
+        let :crypter do
+          crypter = Crypter.new
+          crypter.stub(:decrypt_data).and_return("HELLO")
+          crypter
+        end
+
+        let :client do
+          client = EncryptedClient.new(credentials.merge(:s3_private_key => rsa_key, :s3_public_key => rsa_key))
+          client.crypter = crypter
+          client
+        end
+
+        before :all do
+
+          class Client
+            def super_calls
+              @super_calls ||= []
+            end
+
+            def get_object opts
+              self.super_calls << [:get_object, opts]
+
+              if opts[:key] == "file"
+                resp = AWS::Core::Http::Response.new
+                resp.body = "HARRO"
+                resp.headers['x-amz-meta-x-amz-key'] = URI.encode(Base64.encode64('EKEY'))
+                resp.headers['x-amz-meta-x-amz-iv']  = URI.encode(Base64.encode64('VECTOR'))
+                resp = AWS::Core::Response.new(nil, resp)
+                Core::MetaUtils.extend_method(resp, :data) { resp.http_response.body }
+              else
+                resp = AWS::Core::Http::Response.new
+                resp.body = "HELLO"
+                resp = AWS::Core::Response.new(nil, resp)
+                Core::MetaUtils.extend_method(resp, :data) { resp.http_response.body }
+              end
+
+              resp
+            end
+          end
+
+          @response = client.get_object(:key => "file", :bucket_name => "bucket")
+        end
+
+        it "should call super" do
+          client.super_calls.size.should == 1
+          client.super_calls.first.first.should == :get_object
+        end
+
+        it "should decrypt the envelope key using the private encryption key" do
+          rsa_key.should have_received(:public_decrypt).with("EKEY")
+        end
+
+        it "should decrypt the data using a Crypter" do
+          crypter.should have_received(:decrypt_data).with("HARRO", "KEY", "VECTOR")
+        end
+
+        it "should return the unencrypted data" do
+          @response.data.should == "HELLO"
+        end
+
+        it "should raise an error if the resource is unencrypted" do
+          lambda { client.get_object(:key => "other_file", :bucket_name => "bucket") }.
+            should raise_error(Errors::UnencryptedData)
+        end
+
+        it "should handle an error when decryption the envelope key" do
+          rsa_key.stub(:public_decrypt).and_raise(OpenSSL::PKey::RSAError.new)
+          lambda { client.get_object(:key => "file", :bucket_name => "bucket") }.
+            should raise_error(Errors::DecryptionError)
+        end
+      end
+    end
+    
+  end
+end

data/spec/aws/s3/model_spec.rb

@@ -0,0 +1,91 @@
+require 'spec_helper'
+
+module AWS
+  class S3
+    shared_examples_for "an S3 model" do |*args|
+      let(:rsa_key) { OpenSSL::PKey::RSA.generate(1024) }
+
+      let(:config) do
+        AWS.config(:access_key_id => "access key id", :secret_access_key => "secret access key",
+                   :s3_private_key => rsa_key, :s3_public_key => rsa_key)
+      end
+
+      let(:instance) do
+        options = args.last.is_a?(Hash) ? args.pop : {} 
+        options[:config] = config
+        args << options
+        described_class.new(*args)
+      end
+
+      it "should include the S3::Model module" do
+        described_class.should include(S3::Model)
+      end
+
+      it "returns a normal S3::Client in client side encryption is off" do
+        AWS.config(:s3_client_side_encryption => false)
+        instance.client.class.should == S3::Client
+      end
+
+      it "returns a S3::EncryptedClient in client side encryption is on" do
+        AWS.config(:s3_client_side_encryption => true)
+        instance.client.class.should == S3::EncryptedClient
+      end
+    end
+
+    describe Bucket do
+      it_should_behave_like "an S3 model", 'foo'
+    end
+
+    describe BucketCollection do
+      it_should_behave_like "an S3 model"
+    end
+
+    describe MultipartUpload do
+      it_should_behave_like "an S3 model", Object.new, "123"
+    end
+
+    describe MultipartUploadCollection do
+      it_should_behave_like "an S3 model", Object.new
+    end
+
+    describe ObjectCollection do
+      it_should_behave_like "an S3 model", Object.new
+    end
+
+    describe ObjectMetadata do
+      it_should_behave_like "an S3 model", Object.new
+    end
+
+    describe ObjectUploadCollection do
+      it_should_behave_like "an S3 model", S3Object.new(Bucket.new('bu'), 'foo')
+    end
+
+    describe ObjectVersion do
+      it_should_behave_like "an S3 model", Object.new, 'version_id'
+    end
+
+    describe ObjectVersionCollection do
+      it_should_behave_like "an S3 model", Object.new
+    end
+
+    describe PresignedPost do
+      it_should_behave_like "an S3 model", Object.new
+    end
+
+    describe S3Object do
+      it_should_behave_like "an S3 model", Object.new, 'foo'
+    end
+
+    describe Tree::ChildCollection do
+      it_should_behave_like "an S3 model", Object.new, []
+    end
+
+    describe UploadedPart do
+      it_should_behave_like "an S3 model", Object.new, 1
+    end
+
+    describe UploadedPartCollection do
+      it_should_behave_like "an S3 model", Object.new
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,8 @@
+$: << File.join(File.dirname(File.dirname(__FILE__)), "lib")
+
+require 'rspec'
+require 'rspec/mocks'
+require 'rspec-spies'
+require 'aws-s3-cse'
+
+AWS.eager_autoload!

metadata

@@ -0,0 +1,181 @@
+--- !ruby/object:Gem::Specification
+name: aws-s3-cse
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+  prerelease: 
+platform: ruby
+authors:
+- Tom Nijmeijer
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2012-04-27 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: aws-sdk
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: builder
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: jeweler
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.8.3
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.8.3
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 2.8.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 2.8.0
+- !ruby/object:Gem::Dependency
+  name: rspec-mocks
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 2.9.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 2.9.0
+- !ruby/object:Gem::Dependency
+  name: rspec-spies
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 2.1.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 2.1.0
+- !ruby/object:Gem::Dependency
+  name: rcov
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.9.9
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.9.9
+description: Provides a ruby implementation of the Client Side Encryption client for
+  AWS-S3
+email: tom@nijmeijer.org
+executables: []
+extensions: []
+extra_rdoc_files:
+- LICENSE.txt
+- README.rdoc
+files:
+- .document
+- Gemfile
+- Gemfile.lock
+- LICENSE.txt
+- README.rdoc
+- Rakefile
+- VERSION
+- aws-s3-cse.gemspec
+- lib/aws-s3-cse.rb
+- lib/aws/s3/crypter.rb
+- lib/aws/s3/encrypted_client.rb
+- lib/aws/s3/encrypted_config.rb
+- lib/aws/s3/encryption_errors.rb
+- lib/aws/s3/model.rb
+- spec/aws/s3/crypter_spec.rb
+- spec/aws/s3/encrypted_client_spec.rb
+- spec/aws/s3/model_spec.rb
+- spec/spec_helper.rb
+homepage: http://github.com/tcnijmeijer/aws-s3-cse
+licenses:
+- MIT
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+      segments:
+      - 0
+      hash: -2608648413502752359
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.21
+signing_key: 
+specification_version: 3
+summary: Provides a ruby implementation of the Client Side Encryption client for AWS-S3
+test_files: []