familia 2.0.0.pre3 → 2.0.0.pre5

data/try/features/encryption_fields/context_isolation_try.rb

@@ -0,0 +1,120 @@
+# try/features/encryption_fields/context_isolation_try.rb
+
+require 'base64'
+
+require_relative '../../helpers/test_helpers'
+
+# Setup encryption keys for testing
+test_keys = {
+  v1: Base64.strict_encode64('a' * 32),
+  v2: Base64.strict_encode64('b' * 32)
+}
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class IsolationUser < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :secret
+end
+
+# Different models with same field name have isolated contexts
+class ModelA < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :id
+  field :id
+  encrypted_field :api_key
+end
+
+class ModelB < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :id
+  field :id
+  encrypted_field :api_key
+end
+
+## Different user IDs produce different ciphertexts for same plaintext
+@user1 = IsolationUser.new(user_id: 'alice')
+@user2 = IsolationUser.new(user_id: 'bob')
+
+@user1.secret = 'shared-secret'
+@user2.secret = 'shared-secret'
+
+@cipher1 = @user1.instance_variable_get(:@secret)
+@cipher2 = @user2.instance_variable_get(:@secret)
+
+@cipher1 != @cipher2
+#=> true
+
+## Same plaintext decrypts correctly for both users
+@user1.secret
+#=> 'shared-secret'
+
+## Same plaintext decrypts correctly for both users
+@user2.secret
+#=> 'shared-secret'
+
+## Different model classes have isolated encryption contexts
+@model_a = ModelA.new(id: 'same-id')
+@model_b = ModelB.new(id: 'same-id')
+
+@model_a.api_key = 'secret-key'
+@model_b.api_key = 'secret-key'
+
+@cipher_a = @model_a.instance_variable_get(:@api_key)
+@cipher_b = @model_b.instance_variable_get(:@api_key)
+
+@cipher_a != @cipher_b
+#=> true
+
+## Model A can decrypt its own data
+@model_a.api_key
+#=> 'secret-key'
+
+## Model B can decrypt its own data
+@model_b.api_key
+#=> 'secret-key'
+
+## Cross-model decryption fails due to context mismatch
+@model_a.instance_variable_set(:@api_key, @cipher_b)
+begin
+  @model_a.api_key
+  false
+rescue Familia::EncryptionError
+  true
+end
+#=> true
+
+## Different field names in same model create different contexts
+class MultiFieldModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :id
+  field :id
+  encrypted_field :field_one
+  encrypted_field :field_two
+end
+
+@multi = MultiFieldModel.new(id: 'test')
+@multi.field_one = 'same-value'
+@multi.field_two = 'same-value'
+
+@cipher_field1 = @multi.instance_variable_get(:@field_one)
+@cipher_field2 = @multi.instance_variable_get(:@field_two)
+
+@cipher_field1 != @cipher_field2
+#=> true
+
+## Cross-field decryption fails due to field context isolation
+@multi.instance_variable_set(:@field_one, @cipher_field2)
+begin
+  @multi.field_one
+  false
+rescue Familia::EncryptionError
+  true
+end
+#=> true
+
+# Cleanup
+Familia.config.encryption_keys = nil
+Familia.config.current_key_version = nil

data/try/features/encryption_fields/error_conditions_try.rb

@@ -0,0 +1,116 @@
+# try/features/encryption_fields/error_conditions_try.rb
+
+require 'base64'
+
+require_relative '../../helpers/test_helpers'
+
+# Setup encryption keys for error testing
+@test_keys = {
+  v1: Base64.strict_encode64('a' * 32),
+  v2: Base64.strict_encode64('b' * 32)
+}
+Familia.config.encryption_keys = @test_keys
+Familia.config.current_key_version = :v1
+
+class ErrorTest < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :id
+  field :id
+  encrypted_field :secret
+end
+
+## Malformed JSON raises appropriate error
+@model = ErrorTest.new(id: 'err-1')
+@model.instance_variable_set(:@secret, 'not-json{]')
+@model.secret
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## Tampered auth tag fails decryption
+@model.secret = 'valid-secret'
+@valid_cipher = @model.instance_variable_get(:@secret)
+@tampered = JSON.parse(@valid_cipher)
+@tampered['auth_tag'] = Base64.strict_encode64('tampered' * 4)
+@model.instance_variable_set(:@secret, @tampered.to_json)
+
+@model.secret
+#=!> Familia::EncryptionError
+#==> error.message.include?('Invalid encrypted data')
+
+## Missing encryption config raises on validation
+@original_keys = Familia.config.encryption_keys
+Familia.config.encryption_keys = nil
+Familia::Encryption.validate_configuration!
+Familia.config.encryption_keys = @original_keys
+#=!> Familia::EncryptionError
+#==> error.message.include?('No encryption keys configured')
+
+## Invalid Base64 in stored data causes decryption failure
+# Reset keys for this test since they were cleared in previous test
+Familia.config.encryption_keys = @test_keys
+@model.instance_variable_set(:@secret, '{"algorithm":"aes-256-gcm","nonce":"!!!invalid!!!","ciphertext":"test","auth_tag":"test","key_version":"v1"}')
+@model.secret
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## Derivation counter still increments on decryption errors
+Familia::Encryption.reset_derivation_count!
+# Ensure keys are available for this test
+Familia.config.encryption_keys = @test_keys
+@error_model = ErrorTest.new(id: 'err-counter')
+# Set valid JSON but with invalid base64 data to trigger decrypt failure after parsing
+@error_model.instance_variable_set(:@secret, '{"algorithm":"aes-256-gcm","nonce":"dGVzdA==","ciphertext":"invalid-base64!!!","auth_tag":"dGVzdA==","key_version":"v1"}')
+begin
+  @error_model.secret
+rescue
+end
+# Derivation attempted even if decrypt fails
+Familia::Encryption.derivation_count.value
+#=> 1
+
+## Unsupported algorithm in encrypted data
+# Ensure keys are available for this test
+Familia.config.encryption_keys = @test_keys
+@model.secret = 'test-data'
+@cipher_data = JSON.parse(@model.instance_variable_get(:@secret))
+@cipher_data['algorithm'] = 'unsupported-algorithm'
+@model.instance_variable_set(:@secret, @cipher_data.to_json)
+
+@model.secret
+#=!> Familia::EncryptionError
+#==> error.message.include?('Unsupported algorithm')
+
+## Missing current key version causes validation error
+@original_version = Familia.config.current_key_version
+Familia.config.current_key_version = nil
+Familia::Encryption.validate_configuration!
+Familia.config.current_key_version = @original_version
+#=!> Familia::EncryptionError
+#==> error.message.include?('No current key version set')
+
+## Invalid key version in encrypted data
+# Ensure keys are available for this test
+Familia.config.encryption_keys = @test_keys
+Familia.config.current_key_version = :v1
+@model.secret = 'test-data'
+@cipher_with_bad_version = JSON.parse(@model.instance_variable_get(:@secret))
+@cipher_with_bad_version['key_version'] = 'nonexistent'
+@model.instance_variable_set(:@secret, @cipher_with_bad_version.to_json)
+@model.secret
+#=!> Familia::EncryptionError
+#==> error.message.include?('No key for version: nonexistent')
+
+## Empty string and nil values don't trigger encryption errors
+@empty_model = ErrorTest.new(id: 'empty-test')
+@empty_model.secret = ''
+@empty_model.secret
+#=> nil
+
+## Nil assignment and retrieval
+@empty_model.secret = nil
+@empty_model.secret
+#=> nil
+
+# Cleanup
+Familia.config.encryption_keys = nil
+Familia.config.current_key_version = nil

data/try/features/encryption_fields/fresh_key_derivation_try.rb

@@ -0,0 +1,122 @@
+# try/features/encryption_fields/fresh_key_derivation_try.rb
+
+require 'base64'
+
+require_relative '../../helpers/test_helpers'
+
+test_keys = {
+  v1: Base64.strict_encode64('a' * 32),
+  v2: Base64.strict_encode64('b' * 32)
+}
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class FreshKeyDerivationTest < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :test_field
+end
+
+## Single encrypt operation increments counter
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-encrypt-1')
+model.test_field = 'test-value'
+Familia::Encryption.derivation_count.value
+#=> 1
+
+## Single decrypt operation increments counter again
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-decrypt-1')
+model.test_field = 'test-value'  # encrypt (1 derivation)
+retrieved = model.test_field     # decrypt (2 derivations)
+[retrieved, Familia::Encryption.derivation_count.value]
+#=> ['test-value', 2]
+
+## Multiple encrypt operations accumulate derivation calls
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-encrypt-multi')
+3.times { |i| model.test_field = "value-#{i}" }
+Familia::Encryption.derivation_count.value
+#=> 3
+
+## Multiple decrypt operations call derivation each time
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-decrypt-multi')
+model.test_field = 'initial-value'
+3.times { model.test_field }
+Familia::Encryption.derivation_count.value
+#=> 4
+
+## Mixed encrypt/decrypt operations accumulate calls
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-mixed')
+2.times { |i| model.test_field = "mixed-#{i}" }  # 2 encryptions
+2.times { model.test_field }                     # 2 decryptions
+Familia::Encryption.derivation_count.value
+#=> 4
+
+## Write-read pairs trigger derivation for each operation
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-pairs')
+results = []
+5.times do |i|
+  model.test_field = "pair-#{i}"  # encrypt
+  results << model.test_field     # decrypt
+end
+[results.length, Familia::Encryption.derivation_count.value]
+#=> [5, 10]
+
+## Different field values trigger fresh derivation each time
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-different-values')
+model.test_field = 'first'
+first_count = Familia::Encryption.derivation_count.value
+model.test_field = 'second'
+second_count = Familia::Encryption.derivation_count.value
+model.test_field = 'third'
+third_count = Familia::Encryption.derivation_count.value
+[first_count, second_count, third_count]
+#=> [1, 2, 3]
+
+## Verify no caching occurs across operations
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-no-cache')
+values = ['alpha', 'beta', 'gamma']
+operation_pairs = values.map do |val|
+  model.test_field = val        # encrypt
+  retrieved = model.test_field  # decrypt
+  [val, retrieved]
+end
+all_match = operation_pairs.all? { |pair| pair[0] == pair[1] }
+[all_match, Familia::Encryption.derivation_count.value]
+#=> [true, 6]
+
+## Empty string handling doesn't trigger derivation
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-empty')
+model.test_field = ''
+empty_result = model.test_field
+[empty_result, Familia::Encryption.derivation_count.value]
+#=> [nil, 0]
+
+## Nil values don't trigger derivation
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-nil')
+model.test_field = nil
+nil_result = model.test_field
+[nil_result, Familia::Encryption.derivation_count.value]
+#=> [nil, 0]
+
+## Key version rotation increments derivation count
+Familia::Encryption.reset_derivation_count!
+model = FreshKeyDerivationTest.new(user_id: 'test-rotation')
+model.test_field = 'original'  # v1 encrypt
+Familia.config.current_key_version = :v2
+model.test_field = 'updated'   # v2 encrypt
+retrieved = model.test_field   # v2 decrypt
+Familia::Encryption.derivation_count.value
+#=> 3
+
+Familia.config.encryption_keys = nil
+Familia.config.current_key_version = nil

data/try/features/encryption_fields/fresh_key_try.rb

@@ -0,0 +1,163 @@
+require_relative '../../helpers/test_helpers'
+require 'base64'
+
+# Setup encryption configuration
+@test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = @test_keys
+Familia.config.current_key_version = :v1
+
+class BasicEncryptedModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :secret_data
+end
+
+class MultiInstanceModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :data
+end
+
+class NonceTestModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :repeatable_data
+end
+
+class TimingTestModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :timed_data
+end
+
+class MultiFieldModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :field_a
+  encrypted_field :field_b
+end
+
+class AADTestModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  field :context_field
+  encrypted_field :aad_protected, aad_fields: [:context_field]
+end
+
+class NilTestModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :optional_data
+end
+
+class PersistenceTestModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :persistent_data
+end
+
+## Basic encrypted field functionality works
+model = BasicEncryptedModel.new(user_id: 'test-basic')
+model.secret_data = 'confidential'
+model.secret_data
+#=> 'confidential'
+
+## Different instances derive keys independently
+model1 = MultiInstanceModel.new(user_id: 'user-1')
+model2 = MultiInstanceModel.new(user_id: 'user-2')
+model1.data = 'secret-1'
+model2.data = 'secret-2'
+[model1.data, model2.data]
+#=> ['secret-1', 'secret-2']
+
+## Same value encrypted multiple times produces different ciphertext
+model = NonceTestModel.new(user_id: 'nonce-test')
+model.repeatable_data = 'same-value'
+first_internal = model.instance_variable_get(:@repeatable_data)
+model.repeatable_data = 'same-value'
+second_internal = model.instance_variable_get(:@repeatable_data)
+first_internal != second_internal
+#=> true
+
+## Decrypted values remain the same despite different internal storage
+model = NonceTestModel.new(user_id: 'nonce-test-2')
+model.repeatable_data = 'same-value'
+model.repeatable_data
+#=> 'same-value'
+
+## Fresh derivation verification through timing side-channel
+@model = TimingTestModel.new(user_id: 'timing-test')
+times = []
+10.times do |i|
+  start_time = Time.now
+  @model.timed_data = "test-value-#{i}"
+  @model.timed_data
+  times << (Time.now - start_time)
+end
+min_time = times.min
+max_time = times.max
+variance_ratio = max_time / min_time
+variance_ratio < 3.0
+#=> true
+
+## No cross-contamination between different field contexts
+model = MultiFieldModel.new(user_id: 'multi-field')
+model.field_a = 'value-a'
+model.field_b = 'value-b'
+internal_a = model.instance_variable_get(:@field_a)
+internal_b = model.instance_variable_get(:@field_b)
+internal_a != internal_b
+#=> true
+
+## Decrypted values are correct for multiple fields
+model = MultiFieldModel.new(user_id: 'multi-field-2')
+model.field_a = 'value-a'
+model.field_b = 'value-b'
+[model.field_a, model.field_b]
+#=> ['value-a', 'value-b']
+
+## AAD fields affect derivation context
+model1 = AADTestModel.new(user_id: 'aad-test-1', context_field: 'context-a')
+model2 = AADTestModel.new(user_id: 'aad-test-2', context_field: 'context-b')
+model1.aad_protected = 'protected-data'
+model2.aad_protected = 'protected-data'
+internal1 = model1.instance_variable_get(:@aad_protected)
+internal2 = model2.instance_variable_get(:@aad_protected)
+internal1 != internal2
+#=> true
+
+## AAD protected fields decrypt correctly
+model1 = AADTestModel.new(user_id: 'aad-test-3', context_field: 'context-a')
+model2 = AADTestModel.new(user_id: 'aad-test-4', context_field: 'context-b')
+model1.aad_protected = 'protected-data'
+model2.aad_protected = 'protected-data'
+[model1.aad_protected, model2.aad_protected]
+#=> ['protected-data', 'protected-data']
+
+## Memory efficiency - nil values not encrypted
+model = NilTestModel.new(user_id: 'nil-test')
+model.optional_data = nil
+model.instance_variable_get(:@optional_data)
+#=> nil
+
+## Empty string should be encrypted differently than nil
+model = NilTestModel.new(user_id: 'nil-test-2')
+model.optional_data = ''
+internal_empty = model.instance_variable_get(:@optional_data)
+internal_empty.nil?
+#=> true
+
+## Consistent behavior across Ruby restart simulation
+model = PersistenceTestModel.new(user_id: 'persistence-test')
+model.persistent_data = 'data-to-persist'
+Thread.current[:familia_request_cache] = nil if Thread.current[:familia_request_cache]
+model.persistent_data
+#=> 'data-to-persist'

data/try/features/encryption_fields/key_rotation_try.rb

@@ -0,0 +1,117 @@
+# try/features/encryption_fields/key_rotation_try.rb
+
+require 'base64'
+
+require_relative '../../helpers/test_helpers'
+
+# Setup multiple key versions for rotation testing
+@test_keys = {
+  v1: Base64.strict_encode64('a' * 32),
+  v2: Base64.strict_encode64('b' * 32),
+  v3: Base64.strict_encode64('c' * 32)
+}
+
+class RotationTest < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :id
+  field :id
+  encrypted_field :secret
+end
+
+# Data encrypted with v1 can still be decrypted after rotation to v2
+Familia.config.encryption_keys = { v1: @test_keys[:v1] }
+Familia.config.current_key_version = :v1
+
+@model = RotationTest.new(id: 'rot-1')
+@model.secret = 'original-secret'
+@v1_ciphertext = @model.instance_variable_get(:@secret)
+
+# Rotate to v2 with both keys available
+Familia.config.encryption_keys = { v1: @test_keys[:v1], v2: @test_keys[:v2] }
+Familia.config.current_key_version = :v2
+
+## Manually set the old ciphertext and try to decrypt
+@model.instance_variable_set(:@secret, @v1_ciphertext)
+@model.secret
+#=> 'original-secret'
+
+## New data encrypts with current key version (v2)
+@model.secret = 'updated-secret'
+@v2_ciphertext = @model.instance_variable_get(:@secret)
+@parsed_v2 = JSON.parse(@v2_ciphertext, symbolize_names: true)
+@parsed_v2[:key_version]
+#=> "v2"
+
+## Missing historical key causes decryption failure
+Familia.config.encryption_keys = { v3: @test_keys[:v3] }
+Familia.config.current_key_version = :v3
+@model.instance_variable_set(:@secret, @v1_ciphertext)
+begin
+  @model.secret
+  false
+rescue Familia::EncryptionError => e
+  e.message.include?('No key for version: v1')
+end
+#=> true
+
+## Derivation counter increments during key rotation operations
+Familia::Encryption.reset_derivation_count!
+Familia.config.encryption_keys = @test_keys
+Familia.config.current_key_version = :v1
+#=> :v1
+
+## Derivation counter increments
+@rotation_model = RotationTest.new(id: 'rot-counter')
+@rotation_model.secret = 'test1'  # v1 encrypt
+Familia::Encryption.derivation_count.value
+#=> 1
+
+## Key rotation to v2 for new encryption
+Familia.config.current_key_version = :v2
+@rotation_model.secret = 'test2'  # v2 encrypt
+Familia::Encryption.derivation_count.value
+#=> 2
+
+## Decryption with v2 key
+@retrieved = @rotation_model.secret  # v2 decrypt
+Familia::Encryption.derivation_count.value
+#=> 3
+
+## Key rotation to v3 for new encryption
+Familia.config.current_key_version = :v3
+@rotation_model.secret = 'test3'  # v3 encrypt
+Familia::Encryption.derivation_count.value
+#=> 4
+
+## Multiple key versions coexist for backward compatibility
+Familia.config.encryption_keys = { v1: @test_keys[:v1], v2: @test_keys[:v2], v3: @test_keys[:v3] }
+Familia.config.current_key_version = :v2
+
+@multi_model = RotationTest.new(id: 'multi-key')
+
+# Create data with v1
+Familia.config.current_key_version = :v1
+@multi_model.secret = 'v1-data'
+@v1_data = @multi_model.instance_variable_get(:@secret)
+
+# Create data with v3
+Familia.config.current_key_version = :v3
+@multi_model.secret = 'v3-data'
+@v3_data = @multi_model.instance_variable_get(:@secret)
+
+# Switch back to v2 as current
+Familia.config.current_key_version = :v2
+
+# Can still decrypt v1 data
+@multi_model.instance_variable_set(:@secret, @v1_data)
+@multi_model.secret
+#=> 'v1-data'
+
+## Can still decrypt v3 data with v2 as current key
+@multi_model.instance_variable_set(:@secret, @v3_data)
+@multi_model.secret
+#=> 'v3-data'
+
+# Cleanup
+Familia.config.encryption_keys = nil
+Familia.config.current_key_version = nil

data/try/features/encryption_fields/memory_security_try.rb

@@ -0,0 +1,37 @@
+# try/features/encryption_fields/memory_security_try.rb
+
+require 'base64'
+require_relative '../../helpers/test_helpers'
+
+test_keys = {
+  v1: Base64.strict_encode64('a' * 32),
+}
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+## Keys are wiped from memory after use
+# Note: This is difficult to test directly, but we can verify
+# the secure_wipe method is called
+
+class WipeTest < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :id
+  field :id
+  encrypted_field :secret
+end
+
+# Monkey-patch to track wipe calls
+wipe_calls = 0
+original_wipe = Familia::Encryption.singleton_method(:secure_wipe)
+Familia::Encryption.define_singleton_method(:secure_wipe) do |key|
+  wipe_calls += 1
+  original_wipe.call(key)
+end
+
+model = WipeTest.new(id: 'wipe-1')
+model.secret = 'test'
+model.secret
+
+# Should wipe master key after each derivation (2 operations = 2 wipes)
+wipe_calls >= 2
+#=> true

data/try/features/encryption_fields/missing_current_key_version_try.rb

@@ -0,0 +1,23 @@
+# try/features/encryption_fields/missing_current_key_version_try.rb
+
+require 'base64'
+
+require_relative '../../helpers/test_helpers'
+
+# This tryouts file is based on the premise that there is no current key
+# version set. This is a global setting so if other tryouts rely on
+# having it, they will fail unless they set it for themselves.
+Familia.config.current_key_version = nil
+
+class NoCurrentKeyVersionTest < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :test_field
+end
+
+## Attempt to encrypt will raise an encryption error
+model_student = NoCurrentKeyVersionTest.new(user_id: 'derivation-test')
+model_student.test_field = 'test-value'
+#=!> Familia::EncryptionError
+#=!> error.message.include?('Key version cannot be nil')