encrypted_parameter_filter 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: a32b0531f743768cb2dab3bd93637454be0f4ad273500130b10304c778819af7
+  data.tar.gz: 11731582354150b5d25a203a67ca6a482850df270648fbf291f57aa1e86affcd
+SHA512:
+  metadata.gz: e5ed6b21e1a805615ff5c45b48daa9ca13fa761232dd06a6ac7187127a17e77fadf356f1bc02bd1def394e1cbf5a3952fec0a5fd52ee9f0e7313b3f612c70aed
+  data.tar.gz: 22ee119d587ab266c73f585a4b36817a5062339a879ffb55334d3bceb63ec8e9b72df8af0de6867d5a244c6a0b9d2072051947250d849ef795a76f7bf7e9a579

data/lib/encrypted_parameter_filter/encrypted_params.rb

@@ -0,0 +1,63 @@
+class EncryptedParams
+  ENCRYPTED = "[ENCRYPTED]"
+
+  def self.filter(*parameters_to_encrypt)
+    new(parameters_to_encrypt).to_proc_array
+  end
+
+  def initialize(parameters_to_encrypt)
+    @parameters_to_encrypt = stringify_nested_array(parameters_to_encrypt)
+    key_generator = ActiveSupport::KeyGenerator.new(
+      Rails.application.secret_key_base,
+      iterations: 1000,
+      hash_digest_class: OpenSSL::Digest::SHA1
+    )
+    salt = "encrypted_params:encryption".dup.force_encoding("UTF-8")
+    secret = key_generator.generate_key(salt, 32)
+    @encryptor = ActiveSupport::MessageEncryptor.new(secret, cipher: "aes-256-gcm")
+  end
+
+  def to_proc_array
+    Array(Proc.new { |key, value, original_params| filter(key, value, original_params) })
+  end
+
+  def encrypt(value)
+    encrypted_value = @encryptor.encrypt_and_sign(value)
+    ENCRYPTED + encrypted_value
+  end
+
+  def decrypt(encrypted_value)
+    encrypted_value = encrypted_value.gsub(ENCRYPTED, "")
+    @encryptor.decrypt_and_verify(encrypted_value)
+  end
+
+  private
+
+  def filter(key, value, original_params)
+    @parameters_to_encrypt.each do |param|
+      if param.to_s == key.to_s
+        value.replace(encrypt(value.to_s))
+      elsif param.is_a?(Array) && param.last.to_s == key
+        original_value = param.reduce(original_params) { |acc, key| acc[key] || break }
+        if original_value == value
+          value.replace(encrypt(value.to_s))
+        end
+      end
+    end
+  end
+
+  def stringify_nested_array(array)
+    array.map do |item|
+      case item
+      when Array
+        stringify_nested_array(item)
+      when Hash
+        item.transform_keys { |k| k.is_a?(Symbol) ? k.to_s : k }
+      when Symbol
+        item.to_s
+      else
+        item
+      end
+    end
+  end
+end

data/lib/encrypted_parameter_filter/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module EncryptedParameterFilter
+  VERSION = "0.1.0"
+end

data/lib/encrypted_parameter_filter.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module EncryptedParameterFilter
+  require "encrypted_parameter_filter/encrypted_params"
+end

metadata

@@ -0,0 +1,111 @@
+--- !ruby/object:Gem::Specification
+name: encrypted_parameter_filter
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Joe Hunt
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2025-07-07 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.0.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '7.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 7.0.0
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.16'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.16'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rails-omakase
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+description: Request parameters can't be encrypted by default in ActiveSupport::Parameter
+  filter. This gem allows you to encrypt parameters in logs.
+email:
+- josephbhunt@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/encrypted_parameter_filter.rb
+- lib/encrypted_parameter_filter/encrypted_params.rb
+- lib/encrypted_parameter_filter/version.rb
+homepage: https://github.com/josephbhunt/
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/josephbhunt/
+  source_code_uri: https://example.com
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.0.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.19
+signing_key:
+specification_version: 4
+summary: Encrypt parameters in Rails logs
+test_files: []