ez_logs_agent 0.1.4 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3edfe639cbf53d13c7b902ae2795687878c6898affaac8cd1b2d4610d9e357ae
-  data.tar.gz: ceef7660ed54a8693e8090d03acae9bdc524b4c6993c810f2fda5507a0e691e3
+  metadata.gz: b2d2badd73cb46e12e78d54928f6b2cec5f4a39a93f22f6ecbef5b4767ed200a
+  data.tar.gz: c654639d447550d6c2e59a99c072a60126b8502cf749a5be65988f6bc80649ae
 SHA512:
-  metadata.gz: db1c93abdea22ac379936498fee9c9d873f676741e704267898890ad83324dd0f2b26cc0e0c12a0713f6e8ed4b1e0f7535baab8650b17b088c666a45947a18b8
-  data.tar.gz: 50d06b7f6035e01032f4d6066ed9477304851d7273ad25c352719c66be5e6f1ba0f641aad8e8710df754f4bed6b8e205524ae424037af16756af7f9f8297778b
+  metadata.gz: 703b6dba6216a3f34db5ce0038fda0e19e0a2cd0aa6de07cea95bcb974bdb3856488dc92601376ac7070d18920032b8e8ea941c998d2dc7835e903fa14d72c94
+  data.tar.gz: 4c44195f6539f48933c7949b936f988738657d44728dc6406cf43b270958b05a107f5cec5ac6b8de3b7265c5ff2dbbf07fe276c99dea1f1f1662a1f61eabd05a

data/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.1.5] — 2026-05-17 — security release
+
+### Security
+- `DatabaseCapturer` no longer captures columns the host app declared
+  `encrypts :foo` on. Rails 7+ decrypts attributes in memory before
+  `saved_changes` fires, so without this guard the plaintext of every
+  encrypted column was landing on the wire and in the EZLogs UI on
+  every create / update. The new policy is declarative: at capture
+  time we read `record.class.encrypted_attributes` (Rails 7+) and drop
+  every name in that set, regardless of column name. If the host app
+  encrypted it, we never capture it. Upgrade is strongly recommended
+  for any deployment whose models use `encrypts`. Customers running
+  0.1.4 or earlier should also scrub historical events for the
+  affected column names — the data leaked in the past will stay in
+  the event store until masked.
+- `SENSITIVE_PATTERNS` (the secondary name-based denylist) now also
+  matches `private_key`, `public_key`, `signing_key`, `pem`, `cipher`,
+  `nonce`, `salt`, `digest`, `signature`, `hmac`. Belt-and-suspenders
+  for columns that carry sensitive material but weren't declared
+  `encrypts` (legacy code, manual hashing, externally-generated
+  material).
+
 ## [0.1.4] — 2026-05-17
 
 ### Fixed

data/lib/ez_logs_agent/capturers/database_capturer.rb

@@ -60,7 +60,16 @@ module EzLogsAgent
       # Previously we filtered them out, but this loses important context.
       # FOREIGN_KEY_PATTERN = /_id\z/  # Removed January 2026
 
-      # Patterns for sensitive data to ignore
+      # Patterns for sensitive data to ignore.
+      #
+      # The first source of truth is `record.class.encrypted_attributes`
+      # (Rails 7+ `encrypts :foo` declaration) — see encrypted_attribute?.
+      # If the host app encrypted it, we never capture it.
+      #
+      # This list is the secondary defense: column names that frequently
+      # carry sensitive material even when the host app didn't declare
+      # `encrypts` (legacy code, manual hashing, externally-generated
+      # material). Matching is substring + case-insensitive.
       SENSITIVE_PATTERNS = %w[
         password
         token
@@ -70,6 +79,16 @@ module EzLogsAgent
         ssn
         social_security
         encrypted
+        private_key
+        public_key
+        signing_key
+        pem
+        cipher
+        nonce
+        salt
+        digest
+        signature
+        hmac
       ].freeze
 
 
@@ -276,8 +295,9 @@ module EzLogsAgent
           changes = model.saved_changes
           return nil if changes.nil? || changes.empty?
 
-          # Find meaningful changes
-          meaningful_changes = filter_meaningful_changes(changes)
+          # Find meaningful changes (excludes encrypted columns + sensitive
+          # name patterns — see meaningful_attribute? / encrypted_attribute?)
+          meaningful_changes = filter_meaningful_changes(changes, model)
           return nil if meaningful_changes.empty?
 
           # Build context with all meaningful changes
@@ -305,7 +325,7 @@ module EzLogsAgent
 
           # Filter to meaningful, non-nil scalar attributes
           meaningful_attrs = attributes.select do |attribute, value|
-            meaningful_attribute?(attribute) &&
+            meaningful_attribute?(attribute, model) &&
               scalar?(value) &&
               !value.nil?
           end
@@ -324,20 +344,27 @@ module EzLogsAgent
         # Filters changes to only meaningful business attributes
         #
         # @param changes [Hash] The saved_changes hash
+        # @param model [ActiveRecord::Base] The model instance (used to
+        #   consult `record.class.encrypted_attributes` so columns declared
+        #   `encrypts :foo` are never captured, regardless of their name).
         # @return [Array<Array>] Array of [attribute, [from, to]] pairs
-        def filter_meaningful_changes(changes)
+        def filter_meaningful_changes(changes, model)
           changes.select do |attribute, (from, to)|
-            meaningful_attribute?(attribute) &&
+            meaningful_attribute?(attribute, model) &&
               scalar_values?(from, to) &&
               values_actually_changed?(from, to)
           end.to_a
         end
 
-        # Checks if an attribute is meaningful (not technical/ignored)
+        # Checks if an attribute is meaningful (not technical/ignored).
         #
         # @param attribute [String] The attribute name
+        # @param model [ActiveRecord::Base, nil] The model instance — when
+        #   supplied, columns declared `encrypts :foo` on the model class
+        #   are dropped regardless of name. Authoritative drop: if the host
+        #   app encrypted the column, we never capture it.
         # @return [Boolean]
-        def meaningful_attribute?(attribute)
+        def meaningful_attribute?(attribute, model = nil)
           attr_str = attribute.to_s
 
           # Skip explicitly ignored attributes
@@ -347,13 +374,41 @@ module EzLogsAgent
           # relationship changes (e.g., assigned_to_id changing from user A to user B)
           # Previously filtered via FOREIGN_KEY_PATTERN - removed January 2026
 
-          # Skip sensitive data
+          # Authoritative: drop anything the host app declared `encrypts` on.
+          # Rails decrypts at the attribute layer before saved_changes fires,
+          # so without this check the plaintext would land on the wire.
+          return false if model && encrypted_attribute?(attr_str, model)
+
+          # Skip name-pattern-sensitive data (legacy / non-encrypts paths).
           return false if sensitive_attribute?(attr_str)
 
           true
         end
 
-        # Checks if attribute name contains sensitive patterns
+        # Checks whether the host app declared `encrypts :<attribute>` on
+        # this model's class. Available since Rails 7.0 via
+        # ActiveRecord::Encryption::EncryptableRecord#encrypted_attributes.
+        #
+        # Safe across host Rails versions: returns false if the API isn't
+        # present (older Rails, non-AR records).
+        #
+        # @param attribute [String] The attribute name (already to_s'd)
+        # @param model [ActiveRecord::Base] The model instance
+        # @return [Boolean]
+        def encrypted_attribute?(attribute, model)
+          klass = model.class
+          return false unless klass.respond_to?(:encrypted_attributes)
+
+          encrypted = klass.encrypted_attributes
+          return false if encrypted.nil? || encrypted.empty?
+
+          encrypted.map(&:to_s).include?(attribute)
+        rescue StandardError
+          false
+        end
+
+        # Checks if attribute name contains sensitive patterns.
+        # Secondary check — see SENSITIVE_PATTERNS comment.
         #
         # @param attribute [String] The attribute name
         # @return [Boolean]

data/lib/ez_logs_agent/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module EzLogsAgent
-  VERSION = "0.1.4"
+  VERSION = "0.1.5"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ez_logs_agent
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.5
 platform: ruby
 authors:
 - dezsirazvan
 bindir: bin
 cert_chain: []
-date: 2026-05-16 00:00:00.000000000 Z
+date: 2026-05-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: request_store