familia 2.0.0.pre3 → 2.0.0.pre5

data/try/encryption/providers/xchacha20_poly1305_provider_try.rb

@@ -0,0 +1,169 @@
+# try/encryption/providers/xchacha20_poly1305_provider_try.rb
+
+require_relative '../../helpers/test_helpers'
+require 'base64'
+
+## XChaCha20Poly1305 provider availability check
+Familia::Encryption::Providers::XChaCha20Poly1305Provider.available?
+#=> true
+
+## XChaCha20Poly1305 provider initialization
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+[provider.algorithm, provider.nonce_size, provider.auth_tag_size]
+#=> ['xchacha20poly1305', 24, 16]
+
+## XChaCha20Poly1305 provider priority is highest
+Familia::Encryption::Providers::XChaCha20Poly1305Provider.priority
+#=> 100
+
+## XChaCha20Poly1305 nonce generation produces correct size
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+nonce = provider.generate_nonce
+nonce.bytesize
+#=> 24
+
+## XChaCha20Poly1305 key derivation with default personalization
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+master_key = Base64.strict_decode64(test_keys[:v1])
+context = 'test-context'
+derived_key = provider.derive_key(master_key, context)
+derived_key.bytesize
+#=> 32
+
+## XChaCha20Poly1305 key derivation with custom personalization
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+master_key = Base64.strict_decode64(test_keys[:v1])
+context = 'test-context'
+derived_key1 = provider.derive_key(master_key, context, personal: 'custom1')
+derived_key2 = provider.derive_key(master_key, context, personal: 'custom2')
+derived_key1 != derived_key2
+#=> true
+
+## XChaCha20Poly1305 key derivation rejects null bytes in personalization
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+master_key = Base64.strict_decode64(test_keys[:v1])
+context = 'test-context'
+provider.derive_key(master_key, context, personal: "bad\0personal")
+#=!> Familia::EncryptionError
+#==> error.message.include?('null bytes')
+
+## XChaCha20Poly1305 encryption produces expected structure
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test encryption data'
+result = provider.encrypt(plaintext, key)
+[result.has_key?(:nonce), result.has_key?(:ciphertext), result.has_key?(:auth_tag)]
+#=> [true, true, true]
+
+## XChaCha20Poly1305 encryption nonce is 24 bytes
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test encryption data'
+result = provider.encrypt(plaintext, key)
+result[:nonce].bytesize
+#=> 24
+
+## XChaCha20Poly1305 encryption auth tag is 16 bytes
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test encryption data'
+result = provider.encrypt(plaintext, key)
+result[:auth_tag].bytesize
+#=> 16
+
+## XChaCha20Poly1305 round-trip encryption/decryption
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'XChaCha20Poly1305 round-trip test'
+encrypted = provider.encrypt(plaintext, key)
+decrypted = provider.decrypt(encrypted[:ciphertext], key, encrypted[:nonce], encrypted[:auth_tag])
+decrypted
+#=> 'XChaCha20Poly1305 round-trip test'
+
+## XChaCha20Poly1305 encryption with AAD (Additional Authenticated Data)
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test with aad'
+aad = 'additional-authenticated-data'
+encrypted = provider.encrypt(plaintext, key, aad)
+decrypted = provider.decrypt(encrypted[:ciphertext], key, encrypted[:nonce], encrypted[:auth_tag], aad)
+decrypted
+#=> 'test with aad'
+
+## XChaCha20Poly1305 AAD tampering fails authentication
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test with aad'
+aad = 'original-aad'
+encrypted = provider.encrypt(plaintext, key, aad)
+provider.decrypt(encrypted[:ciphertext], key, encrypted[:nonce], encrypted[:auth_tag], 'tampered-aad')
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## XChaCha20Poly1305 nonce tampering fails authentication
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test nonce tampering'
+encrypted = provider.encrypt(plaintext, key)
+tampered_nonce = 'x' * 24  # Wrong nonce
+provider.decrypt(encrypted[:ciphertext], key, tampered_nonce, encrypted[:auth_tag])
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## XChaCha20Poly1305 auth tag tampering fails authentication
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test auth tag tampering'
+encrypted = provider.encrypt(plaintext, key)
+tampered_auth_tag = 'y' * 16  # Wrong auth tag
+provider.decrypt(encrypted[:ciphertext], key, encrypted[:nonce], tampered_auth_tag)
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## XChaCha20Poly1305 ciphertext tampering fails authentication
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test ciphertext tampering'
+encrypted = provider.encrypt(plaintext, key)
+tampered_ciphertext = encrypted[:ciphertext][0..-2] + 'X'  # Change last byte
+provider.decrypt(tampered_ciphertext, key, encrypted[:nonce], encrypted[:auth_tag])
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## XChaCha20Poly1305 key validation rejects nil key
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+provider.encrypt('test', nil)
+#=!> Familia::EncryptionError
+#==> error.message.include?('Key cannot be nil')
+
+## XChaCha20Poly1305 key validation requires 32-byte minimum
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+short_key = 'x' * 16  # Only 16 bytes
+provider.encrypt('test', short_key)
+#=!> Familia::EncryptionError
+#==> error.message.include?('Key must be at least 32 bytes')
+
+## XChaCha20Poly1305 secure_wipe clears key (best effort)
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+test_key = 'secret-key-data-to-be-wiped'
+original_length = test_key.length
+provider.secure_wipe(test_key)
+test_key.length
+#=> 0
+
+# TEARDOWN
+Thread.current[:familia_key_cache]&.clear if Thread.current[:familia_key_cache]

data/try/encryption/roundtrip_validation_try.rb

@@ -0,0 +1,28 @@
+# try/encryption/debug4_try.rb
+
+# - Tests full encryption/decryption round trips
+# - Validates that encrypted data can be successfully decrypted
+
+require 'base64'
+
+require_relative '../helpers/test_helpers'
+
+## Test successful encryption
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+result = Familia::Encryption.encrypt('test', context: 'test')
+result.class == String && result.length > 0
+#=> true
+
+## Test successful decryption
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+encrypted = Familia::Encryption.encrypt('test', context: 'test')
+decrypted = Familia::Encryption.decrypt(encrypted, context: 'test')
+decrypted
+#=> 'test'
+
+
+# TEARDOWN

data/try/encryption/secure_memory_handling_try.rb

@@ -0,0 +1,125 @@
+# try/encryption/secure_memory_handling_try.rb
+
+require_relative '../helpers/test_helpers'
+require_relative '../../lib/familia/encryption/providers/secure_xchacha20_poly1305_provider'
+require 'base64'
+
+# SETUP
+Familia.config.encryption_keys = {
+  v1: Base64.strict_encode64('a' * 32)
+}
+Familia.config.current_key_version = :v1
+
+## SecureXChaCha20Poly1305Provider is available when dependencies are loaded
+@provider_class = Familia::Encryption::Providers::SecureXChaCha20Poly1305Provider
+@provider_class.available?
+#=> true
+
+## Provider has higher priority than regular XChaCha20Poly1305Provider
+@provider_class.priority > Familia::Encryption::Providers::XChaCha20Poly1305Provider.priority
+#=> true
+
+## secure_wipe clears key data from memory
+provider = @provider_class.new
+key = 'sensitive_key_data_here_' * 2  # 50 bytes
+original_key = key.dup
+provider.secure_wipe(key)
+key.empty?
+#=> true
+
+## secure_wipe handles nil keys gracefully
+provider = @provider_class.new
+provider.secure_wipe(nil)
+# Should not raise error
+true
+#=> true
+
+## derive_key clears intermediate personalization data
+provider = @provider_class.new
+master_key = 'a' * 32
+context = 'TestModel:field:user123'
+
+# Create a test to verify personalization string gets cleared
+# (We can't directly test this but we verify the function works)
+derived_key = provider.derive_key(master_key, context, personal: 'test_personal')
+derived_key.bytesize
+#=> 32
+
+## encrypt operation clears key after use (demonstration)
+provider = @provider_class.new
+master_key = ('a' * 32).dup  # Make mutable copy
+derived_key = provider.derive_key(master_key, 'test_context')
+plaintext = 'sensitive data'
+
+# Key will be cleared after encryption
+encrypted_data = provider.encrypt(plaintext, derived_key)
+encrypted_data.key?(:ciphertext) && encrypted_data.key?(:nonce) && encrypted_data.key?(:auth_tag)
+#=> true
+
+## decrypt operation clears key after use (demonstration)
+provider = @provider_class.new
+master_key = 'a' * 32
+context = 'TestModel:field:user123'
+derived_key = provider.derive_key(master_key, context)
+plaintext = 'sensitive data'
+
+# Encrypt first
+encrypted_data = provider.encrypt(plaintext, derived_key.dup)
+
+# Create fresh key for decryption (since original was cleared)
+fresh_key = provider.derive_key(master_key, context)
+decrypted = provider.decrypt(
+  encrypted_data[:ciphertext],
+  fresh_key,
+  encrypted_data[:nonce],
+  encrypted_data[:auth_tag]
+)
+decrypted
+#=> "sensitive data"
+
+## Key derivation with null byte validation still works
+provider = @provider_class.new
+master_key = 'a' * 32
+context = 'TestModel:field:user123'
+personal_with_null = "app\0version"
+
+begin
+  provider.derive_key(master_key, context, personal: personal_with_null)
+  "should_not_reach_here"
+rescue Familia::EncryptionError => e
+  e.message
+end
+#=> "Personalization string must not contain null bytes"
+
+## Round-trip encryption/decryption works with secure provider
+provider = @provider_class.new
+master_key = 'a' * 32
+context = 'TestModel:field:user123'
+plaintext = 'sensitive data here'
+
+# Derive keys separately since they get cleared after use
+key_for_encrypt = provider.derive_key(master_key, context)
+key_for_decrypt = provider.derive_key(master_key, context)
+
+encrypted_data = provider.encrypt(plaintext, key_for_encrypt)
+decrypted = provider.decrypt(
+  encrypted_data[:ciphertext],
+  key_for_decrypt,
+  encrypted_data[:nonce],
+  encrypted_data[:auth_tag]
+)
+decrypted
+#=> "sensitive data here"
+
+## Generate nonce produces correct size
+provider = @provider_class.new
+nonce = provider.generate_nonce
+nonce.bytesize
+#=> 24
+
+## Provider algorithm identifier distinguishes it from regular provider
+@provider_class.const_get(:ALGORITHM)
+#=> "xchacha20poly1305-secure"
+
+# TEARDOWN
+Thread.current[:familia_key_cache]&.clear if Thread.current[:familia_key_cache]

data/try/features/encrypted_fields_core_try.rb

@@ -0,0 +1,117 @@
+# try/features/encrypted_fields_core_try.rb
+
+require_relative '../helpers/test_helpers'
+require 'base64'
+
+
+## Encrypted field methods are properly defined
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+
+  field :user_id
+  field :email
+  encrypted_field :ssn
+  encrypted_field :api_key, aad_fields: [:email]
+end
+
+user = SecureUser.new(user_id: 'test-user-001', email: 'test@example.com')
+user.respond_to?(:ssn) && user.respond_to?(:ssn=)
+#=> true
+
+## Setting encrypted field stores ciphertext internally
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser2 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :ssn
+end
+
+user = SecureUser2.new(user_id: 'test-user-002')
+user.ssn = '123-45-6789'
+stored_value = user.instance_variable_get(:@ssn)
+stored_value.is_a?(String) && stored_value.include?('algorithm')
+#=> true
+
+## Getter transparently decrypts the value
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUserDecrypt < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :ssn
+end
+
+user = SecureUserDecrypt.new(user_id: 'decrypt-test')
+user.ssn = '123-45-6789'
+user.ssn
+#=> '123-45-6789'## Setting nil stores nil internally and returns nil
+
+## repaired test
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser3 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :ssn
+end
+
+user = SecureUser3.new(user_id: 'test-user-003')
+user.ssn = nil
+result = user.instance_variable_get(:@ssn)
+user.ssn.nil? && result.nil?
+#=> true
+
+## Field type is correctly identified as encrypted
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser4 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :ssn
+end
+
+field_type = SecureUser4.field_types[:ssn]
+field_type.category
+#=> :encrypted
+
+## Field type is persistent
+SecureUser4.field_types[:ssn].persistent?
+#=> true
+
+## Encrypted field with AAD fields configured
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser5 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  field :email
+  encrypted_field :api_key, aad_fields: [:email]
+end
+
+user = SecureUser5.new(user_id: 'test-user-005', email: 'test@example.com')
+user.api_key = 'secret-key-123'
+user.api_key
+#=> 'secret-key-123'
+
+Thread.current[:familia_key_cache]&.clear if Thread.current[:familia_key_cache]

data/try/features/encrypted_fields_integration_try.rb

@@ -0,0 +1,220 @@
+# try/features/encrypted_fields_integration_try.rb
+
+# Test constants will be redefined in each test since variables don't persist
+
+require_relative '../helpers/test_helpers'
+require 'base64'
+
+
+class FullSecureModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  field :name                    # Regular field
+  field :email                   # Regular field for AAD
+  encrypted_field :password      # Encrypted without AAD
+  encrypted_field :api_token, aad_fields: [:email]  # Encrypted with AAD
+
+  list :activity_log            # Regular list
+  hashkey :metadata             # Regular hashkey
+end
+
+
+
+## Full model initialization with mixed field types works
+test_keys = { v1: Base64.strict_encode64('a' * 32), v2: Base64.strict_encode64('b' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v2
+
+model = FullSecureModel.new(
+  model_id: 'secure-123',
+  name: 'Test User',
+  email: 'test@secure.com'
+)
+[model.model_id, model.name, model.email]
+#=> ['secure-123', 'Test User', 'test@secure.com']
+
+## Setting encrypted fields works alongside regular fields
+test_keys = { v1: Base64.strict_encode64('a' * 32), v2: Base64.strict_encode64('b' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v2
+
+class FullSecureModel2 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  field :name
+  field :email
+  encrypted_field :password
+  encrypted_field :api_token, aad_fields: [:email]
+end
+
+model = FullSecureModel2.new(
+  model_id: 'secure-124',
+  name: 'Test User 2',
+  email: 'test2@secure.com'
+)
+model.password = 'secret-password-123'
+model.api_token = 'api-token-abc-xyz'
+[model.password, model.api_token]
+#=> ['secret-password-123', 'api-token-abc-xyz']## Serialization via to_h includes plaintext (as expected for normal usage)
+
+## repaired test
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class FullSecureModel3 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  encrypted_field :password
+end
+
+model = FullSecureModel3.new(model_id: 'secure-125')
+model.password = 'secret-password-123'
+hash_representation = model.to_h
+# to_h calls getters, so it includes decrypted values
+hash_representation.values.any? { |v| v.to_s.include?('secret-password-123') }
+#=> true
+
+## Instance variables contain encrypted data structure
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class FullSecureModel3b < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+  field :model_id
+  encrypted_field :password
+end
+
+model = FullSecureModel3b.new(model_id: 'secure-125b')
+model.password = 'secret-password-123'
+# Internal storage should be encrypted
+encrypted_password = model.instance_variable_get(:@password)
+encrypted_password.is_a?(String) && encrypted_password.include?('"algorithm":"xchacha20poly1305"')
+#=> true
+
+## Mixed data types work correctly with encrypted fields
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class FullSecureModel4 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  encrypted_field :password
+  list :activity_log
+  hashkey :metadata
+end
+
+model = FullSecureModel4.new(model_id: 'secure-126')
+model.password = 'secure-pass'
+model.activity_log << 'User logged in'
+model.metadata['last_login'] = Time.now.to_i.to_s
+
+[model.password, model.activity_log.size, model.metadata.has_key?('last_login')]
+#=> ['secure-pass', 1, true]
+
+## Provider-specific integration: XChaCha20Poly1305 encryption
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class XChaChaIntegrationModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  encrypted_field :secret_data
+end
+
+xchacha_model = XChaChaIntegrationModel.new(model_id: 'xchacha-test')
+xchacha_model.secret_data = 'xchacha20poly1305 integration test'
+
+# Verify XChaCha20Poly1305 is used by default
+encrypted_data = xchacha_model.instance_variable_get(:@secret_data)
+parsed_data = JSON.parse(encrypted_data, symbolize_names: true)
+parsed_data[:algorithm]
+#=> "xchacha20poly1305"
+
+# Verify decryption works
+xchacha_model = XChaChaIntegrationModel.new(model_id: 'xchacha-test')
+xchacha_model.secret_data = 'xchacha20poly1305 integration test'
+xchacha_model.secret_data
+#=> "xchacha20poly1305 integration test"
+
+
+# ALGORITHM PARAMETER FIX NEEDED:
+#
+# Problem: encrypted_field :secret_data, algorithm: 'aes-256-gcm'
+# is ignored - always uses default XChaCha20Poly1305
+#
+# Root cause: EncryptedFieldType.encrypt_value always calls
+# Familia::Encryption.encrypt() (default) instead of
+# Familia::Encryption.encrypt_with(@algorithm, ...) when algorithm specified
+#
+# Fix required in lib/familia/features/encrypted_fields/encrypted_field_type.rb:
+# 1. Add attr_reader :algorithm
+# 2. Add algorithm: nil parameter to initialize()
+# 3. Store @algorithm = algorithm
+# 4. Update encrypt_value() to use encrypt_with(@algorithm, ...) when @algorithm present
+#
+# This enables per-field algorithm selection while maintaining backward compatibility
+
+## TEST 8: Provider-specific integration: AES-GCM with forced algorithm
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class AESIntegrationModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  encrypted_field :secret_data, algorithm: 'aes-256-gcm' # Specify the algorithm
+end
+
+aes_encrypted = Familia::Encryption.encrypt_with(
+  'aes-256-gcm',
+  'aes-gcm integration test',
+  context: 'AESIntegrationModel:secret_data:aes-test',
+)
+
+aes_model = AESIntegrationModel.new(model_id: 'aes-test')
+
+# Manually encrypt with AES-GCM to test cross-algorithm compatibility
+aes_model.instance_variable_set(:@secret_data, aes_encrypted)
+
+# Verify AES-GCM algorithm is stored and decryption works
+parsed_aes_data = JSON.parse(aes_encrypted, symbolize_names: true)
+[parsed_aes_data[:algorithm], aes_model.secret_data]
+##=> ["aes-256-gcm", "aes-gcm integration test"]
+
+## TEST 9: Provider-specific integration: AES-GCM with forced algorithm
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class AESIntegrationModel2 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+  field :model_id
+  encrypted_field :secret_data, algorithm: 'aes-256-gcm' # Specify the algorithm
+end
+
+aes_model = AESIntegrationModel2.new(model_id: 'aes-test')
+aes_model.secret_data = 'aes-gcm integration test'  # Use setter, not manual encryption
+
+# Verify algorithm and decryption
+encrypted_data = aes_model.instance_variable_get(:@secret_data)
+parsed_data = JSON.parse(encrypted_data, symbolize_names: true)
+[parsed_data[:algorithm], aes_model.secret_data]
+##=> ["aes-256-gcm", "aes-gcm integration test"]