blind_index 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 370f6b1f09b18d3031f83b76785b8604e7ea8efa553a74d205ca874505abf26d
-  data.tar.gz: dd69a591d88afec3cb63433e78cf9d443828b544fe47c965cfbaf65965c4047e
+  metadata.gz: 3a2f034adc1842667c23445f308df57c7f799d802190d570985037955eedab8d
+  data.tar.gz: 7461ef87a66f92771aa4101624e5a025f4a3548a16b8c32b997371629542ee7a
 SHA512:
-  metadata.gz: b3e1e1c4a05f421a65039197e8e7ce4db8057d06529c7b01ba69395c207b77ef3bfbf3b8c5bcc208818d96a6dd78c0d1ddfd42e0ceb525e348c390647014b400
-  data.tar.gz: 017240cd3b9c125c5a9d455085825bee6f985dff4db129e0adb54dd032ef5d74281267f2fd39b74f38b4043c04798a87c3e1d79e71d29ce3c093ee95fd3d0060
+  metadata.gz: 343a9b809e3109bbc66bbbc842840837383c22c1707cb2a143949989b55f5230db3b7c8563f78db03b1edf54a2606f94bc0a68ec4891acfe25d571fef6ac3a1c
+  data.tar.gz: 37083bfe331da9a1c7861009907a43e35a71d16db4c0cd1101af1033d1d023c305c4d47aee0e4ec17952c3ebc12c3d2fbda6cc48d284a231acd777fcfffa6cda

data/.travis.yml

@@ -4,6 +4,7 @@ gemfile:
   - Gemfile
   - test/gemfiles/activerecord51.gemfile
   - test/gemfiles/activerecord50.gemfile
+  - test/gemfiles/activerecord42.gemfile
 sudo: false
 before_install: gem install bundler
 script: bundle exec rake test

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.2.0
+
+- Added support for ActiveRecord 4.2
+- Improved validation support when multiple blind indexes
+- Fixed `nil` handling
+
 ## 0.1.1
 
 - Added support for ActiveRecord 5.2

data/README.md

@@ -8,7 +8,7 @@ Designed for use with [attr_encrypted](https://github.com/attr-encrypted/attr_en
 
 ## How It Works
 
-This project uses [this approach](https://www.sitepoint.com/how-to-search-on-securely-encrypted-database-fields/) by Scott Arciszewski. To summarize, we compute a keyed hash of the sensitive data and store it in a column. To query, we apply the keyed hash function (PBKDF2-HMAC-SHA256) to the value we’re searching and then perform a database search. This results in performant queries for equality operations, while keeping the data secure from those without the key.
+We use [this approach](https://www.sitepoint.com/how-to-search-on-securely-encrypted-database-fields/) by Scott Arciszewski. To summarize, we compute a keyed hash of the sensitive data and store it in a column. To query, we apply the keyed hash function (PBKDF2-HMAC-SHA256) to the value we’re searching and then perform a database search. This results in performant queries for equality operations, while keeping the data secure from those without the key.
 
 ## Getting Started
 
@@ -23,31 +23,30 @@ Add columns for the encrypted data and the blind index
 
 ```ruby
 # encrypted data
-add_column :users, :encrypted_email, :text
-add_column :users, :encrypted_email_iv, :text
+add_column :users, :encrypted_email, :string
+add_column :users, :encrypted_email_iv, :string
 
 # blind index
-add_column :users, :encrypted_email_bidx, :text
+add_column :users, :encrypted_email_bidx, :string
 add_index :users, :encrypted_email_bidx
 ```
 
-Generate one key for encryption and one key for hashing and set them in your environment ([dotenv](https://github.com/bkeepers/dotenv) is great for this). For development, you can use these:
-
-```sh
-EMAIL_ENCRYPTION_KEY=00000000000000000000000000000000
-EMAIL_BLIND_INDEX_KEY=99999999999999999999999999999999
-```
-
 And add to your model
 
 ```ruby
 class User < ApplicationRecord
   attr_encrypted :email, key: ENV["EMAIL_ENCRYPTION_KEY"]
-
   blind_index :email, key: ENV["EMAIL_BLIND_INDEX_KEY"]
 end
 ```
 
+We use environment variables to store the keys ([dotenv](https://github.com/bkeepers/dotenv) is great for this). *Do not commit them to source control.* Generate one key for encryption and one key for hashing. For development, you can use these:
+
+```sh
+EMAIL_ENCRYPTION_KEY=00000000000000000000000000000000
+EMAIL_BLIND_INDEX_KEY=99999999999999999999999999999999
+```
+
 And query away
 
 ```ruby
@@ -81,7 +80,7 @@ end
 You may want multiple blind indexes for an attribute. To do this, add another column:
 
 ```ruby
-add_column :users, :encrypted_email_ci_bidx, :text
+add_column :users, :encrypted_email_ci_bidx, :string
 add_index :users, :encrypted_email_ci_bidx
 ```
 
@@ -119,7 +118,6 @@ If you don’t need to store the original value (for instance, when just checkin
 ```ruby
 class User < ApplicationRecord
   attribute :email
-
   blind_index :email, ...
 end
 ```
@@ -136,3 +134,12 @@ Everyone is encouraged to help improve this project. Here are a few ways you can
 - Fix bugs and [submit pull requests](https://github.com/ankane/blind_index/pulls)
 - Write, clarify, or fix documentation
 - Suggest or add new features
+
+To get started with development and testing:
+
+```sh
+git clone https://github.com/ankane/blind_index.git
+cd blind_index
+bundle install
+rake test
+```

data/blind_index.gemspec

@@ -20,7 +20,7 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_dependency "activesupport", ">= 5"
+  spec.add_dependency "activesupport", ">= 4.2"
 
   spec.add_development_dependency "bundler"
   spec.add_development_dependency "rake"

data/lib/blind_index/extensions.rb

@@ -1,5 +1,6 @@
 module BlindIndex
   module Extensions
+    # ActiveRecord 5.0+
     module TableMetadata
       def resolve_column_aliases(hash)
         new_hash = super
@@ -22,6 +23,31 @@ module BlindIndex
       end
     end
 
+    # ActiveRecord 4.2
+    module PredicateBuilder
+      def resolve_column_aliases(klass, hash)
+        new_hash = super
+        if has_blind_indexes?(klass)
+          hash.each do |key, _|
+            if (bi = klass.blind_indexes[key])
+              new_hash[bi[:bidx_attribute]] = BlindIndex.generate_bidx(new_hash.delete(key), bi)
+            end
+          end
+        end
+        new_hash
+      end
+
+      @@blind_index_cache = {}
+
+      # memoize for performance
+      def has_blind_indexes?(klass)
+        if @@blind_index_cache[klass].nil?
+          @@blind_index_cache[klass] = klass.respond_to?(:blind_indexes)
+        end
+        @@blind_index_cache[klass]
+      end
+    end
+
     module UniquenessValidator
       if ActiveRecord::VERSION::STRING >= "5.2"
         def build_relation(klass, attribute, value)

data/lib/blind_index/model.rb

@@ -13,7 +13,7 @@ module BlindIndex
         class << self
           def blind_indexes
             @blind_indexes ||= {}
-          end unless respond_to?(:blind_indexes)
+          end unless method_defined?(:blind_indexes)
         end
 
         raise BlindIndex::Error, "Duplicate blind index: #{name}" if blind_indexes[name]
@@ -33,6 +33,19 @@ module BlindIndex
         if callback
           before_validation method_name, if: -> { changes.key?(attribute.to_s) }
         end
+
+        # use include so user can override
+        include InstanceMethods if blind_indexes.size == 1
+      end
+    end
+  end
+
+  module InstanceMethods
+    def read_attribute_for_validation(key)
+      if (bi = self.class.blind_indexes[key])
+        send(bi[:attribute])
+      else
+        super
       end
     end
   end

data/lib/blind_index/version.rb

@@ -1,3 +1,3 @@
 module BlindIndex
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end

data/lib/blind_index.rb

@@ -16,19 +16,26 @@ module BlindIndex
     # apply expression
     value = expression.call(value) if expression
 
-    # generate hash
-    digest = OpenSSL::Digest::SHA256.new
-    value = OpenSSL::PKCS5.pbkdf2_hmac(value.to_s, key, iterations, digest.digest_length, digest)
-
-    # encode
-    [value].pack("m")
+    unless value.nil?
+      # generate hash
+      digest = OpenSSL::Digest::SHA256.new
+      value = OpenSSL::PKCS5.pbkdf2_hmac(value.to_s, key, iterations, digest.digest_length, digest)
+
+      # encode
+      [value].pack("m")
+    end
   end
 end
 
 ActiveSupport.on_load(:active_record) do
   require "blind_index/extensions"
   extend BlindIndex::Model
-  ActiveRecord::TableMetadata.prepend(BlindIndex::Extensions::TableMetadata)
+
+  if defined?(ActiveRecord::TableMetadata)
+    ActiveRecord::TableMetadata.prepend(BlindIndex::Extensions::TableMetadata)
+  else
+    ActiveRecord::PredicateBuilder.singleton_class.prepend(BlindIndex::Extensions::PredicateBuilder)
+  end
 
   unless ActiveRecord::VERSION::STRING.start_with?("5.1.")
     ActiveRecord::Validations::UniquenessValidator.prepend(BlindIndex::Extensions::UniquenessValidator)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: blind_index
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Andrew Kane
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2018-04-10 00:00:00.000000000 Z
+date: 2018-05-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5'
+        version: '4.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5'
+        version: '4.2'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement