eyaml 0.4.2 → 0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3db8844c2bbddc8461708c26243e51830e6caabb0863b51a255dcef05f762842
-  data.tar.gz: bc1103be88e0418663ce58bfc7f4b497466a9fe98a08b5ddddafae76d18667ce
+  metadata.gz: 00bde71da67e58726c900ee6a7136634ae077bec36610404aeb2ed79f6879408
+  data.tar.gz: 43c9ccc56469095c1c3f3e9fec7ef3d0f81506e0779729cac3f868131f96d72d
 SHA512:
-  metadata.gz: 5b6f9ebcae7c5a2b7920abb7ec5e75e06c1ac2e51eff9b8ea7f61a00305c80e06b60bcc3219a5b94700a6d4af6ba6915f92c646573d00a4fb1a43732aa331ec1
-  data.tar.gz: 4d6359cad8b3514dd4fdc8ecfe9ccfed07bd9e18a5d5bd6033633696111754e522001a18cc8c9746da0f065ee14bc8a2f6a7b009bd2bd7926293e2b658a9ccdc
+  metadata.gz: bc297dd8373669826b9573d81657656a29dfcd57bfad2d549c7c3b6e8e79087b8c5035083bdb99f53ef5579fb0b384b60f8c6c72f6ccdfce9a103beab36a2e9a
+  data.tar.gz: 277e8b83fafa73c21e3136684d648fc0b6ebff29c7656e25d26594490da18635af4ae84bf6db06895c8372180816f056f746303a27642463886a599ed5165eda

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    eyaml (0.4.0)
+    eyaml (0.4.3)
       rbnacl (~> 7.1)
       thor (~> 1.1)
 

data/README.md

@@ -169,6 +169,22 @@ If you're using the new Apple M1, you need to ensure that you're using a `ffi` t
 gem "ffi", github: "cheddar-me/ffi", branch: "apple-m1", submodules: true
 ```
 
+### Underscored vs de-underscored keys
+
+Keys that start with an underscore are treated as-is and are assumed unencrypted in the secrets/credentials files.
+To make our lives a little easier in calling them in the application they are callable without the underscore. So a `_secret` can be called with
+
+```ruby
+Rails.application.credentials.secret
+```
+and
+```ruby
+Rails.application.credentials._secret
+```
+
+To prevent conflicts with having the same name underscored and not, we don't allow that and the gem will raise an exception.
+This makes sense since we believe it could be a security hazard to have an encrypted key also unencrypted. The best solution is to give either a different name to make the intention clear.
+
 ## Development
 
 To get started, make sure you have a working version of Ruby locally. Then clone the repo, and run `bin/setup` (this will install `libsodium` if you're on a Mac and setup bundler). Running `bundle exec rake` or `bundle exec rake spec` will run the test suite.

data/lib/eyaml/encryption_manager.rb

@@ -87,7 +87,6 @@ module EYAML
         if value.is_a?(Hash)
           next [key, traverse(value, &block)]
         end
-        # TODO(es): Add tests for keys with an underscore prefix not doing a nested skip
         if key.start_with?("_")
           next [key, value]
         end

data/lib/eyaml/railtie.rb

@@ -35,8 +35,9 @@ module EYAML
           # for a public/private key in the key directory (either $EJSON_KEYDIR, if set, or /opt/ejson/keys)
           cipherdata = YAML.load_file(file)
           secrets = EYAML.decrypt(cipherdata, private_key: ENV[PRIVATE_KEY_ENV_VAR])
+            .except("_public_key")
+          secrets = EYAML::Util.with_deep_deundescored_keys(secrets)
             .deep_symbolize_keys
-            .except(:_public_key)
 
           break Rails.application.send(secrets_or_credentials).deep_merge!(secrets)
         end

data/lib/eyaml/util.rb

@@ -6,6 +6,26 @@ module EYAML
       def pretty_yaml(some_hash)
         some_hash.to_yaml.delete_prefix("---\n")
       end
+
+      # This will look for any keys that starts with an underscore and duplicates that key-value pair
+      # but without the starting underscore.
+      # So {_a: "abab"} will become {_a: "abab", a: "abab"}
+      # This so we can easilly access our unencrypted secrets without having to add an underscore
+      def with_deep_deundescored_keys(hash)
+        hash.each_with_object({}) do |(key, value), total|
+          value = with_deep_deundescored_keys(value) if value.is_a?(Hash)
+
+          if key.start_with?("_")
+            deunderscored_key = key[1..]
+            # We don't want to have an underscored and de-underscored key with the same name, so raise. This could be a security issue
+            raise KeyError, "De-underscored key '#{key[1..]}' already exists." if total.key?(deunderscored_key)
+
+            total[deunderscored_key] = value unless total.key?(deunderscored_key)
+          end
+
+          total[key] = value
+        end
+      end
     end
   end
 end

data/lib/eyaml/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module EYAML
-  VERSION = "0.4.2"
+  VERSION = "0.4.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: eyaml
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.4.3
 platform: ruby
 authors:
 - Emil Stolarsky
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-06-11 00:00:00.000000000 Z
+date: 2024-07-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor