familia 2.0.0.pre4 → 2.0.0.pre6

data/try/encryption/providers/xchacha20_poly1305_provider_try.rb

@@ -0,0 +1,169 @@
+# try/encryption/providers/xchacha20_poly1305_provider_try.rb
+
+require_relative '../../helpers/test_helpers'
+require 'base64'
+
+## XChaCha20Poly1305 provider availability check
+Familia::Encryption::Providers::XChaCha20Poly1305Provider.available?
+#=> true
+
+## XChaCha20Poly1305 provider initialization
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+[provider.algorithm, provider.nonce_size, provider.auth_tag_size]
+#=> ['xchacha20poly1305', 24, 16]
+
+## XChaCha20Poly1305 provider priority is highest
+Familia::Encryption::Providers::XChaCha20Poly1305Provider.priority
+#=> 100
+
+## XChaCha20Poly1305 nonce generation produces correct size
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+nonce = provider.generate_nonce
+nonce.bytesize
+#=> 24
+
+## XChaCha20Poly1305 key derivation with default personalization
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+master_key = Base64.strict_decode64(test_keys[:v1])
+context = 'test-context'
+derived_key = provider.derive_key(master_key, context)
+derived_key.bytesize
+#=> 32
+
+## XChaCha20Poly1305 key derivation with custom personalization
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+master_key = Base64.strict_decode64(test_keys[:v1])
+context = 'test-context'
+derived_key1 = provider.derive_key(master_key, context, personal: 'custom1')
+derived_key2 = provider.derive_key(master_key, context, personal: 'custom2')
+derived_key1 != derived_key2
+#=> true
+
+## XChaCha20Poly1305 key derivation rejects null bytes in personalization
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+master_key = Base64.strict_decode64(test_keys[:v1])
+context = 'test-context'
+provider.derive_key(master_key, context, personal: "bad\0personal")
+#=!> Familia::EncryptionError
+#==> error.message.include?('null bytes')
+
+## XChaCha20Poly1305 encryption produces expected structure
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test encryption data'
+result = provider.encrypt(plaintext, key)
+[result.has_key?(:nonce), result.has_key?(:ciphertext), result.has_key?(:auth_tag)]
+#=> [true, true, true]
+
+## XChaCha20Poly1305 encryption nonce is 24 bytes
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test encryption data'
+result = provider.encrypt(plaintext, key)
+result[:nonce].bytesize
+#=> 24
+
+## XChaCha20Poly1305 encryption auth tag is 16 bytes
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test encryption data'
+result = provider.encrypt(plaintext, key)
+result[:auth_tag].bytesize
+#=> 16
+
+## XChaCha20Poly1305 round-trip encryption/decryption
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'XChaCha20Poly1305 round-trip test'
+encrypted = provider.encrypt(plaintext, key)
+decrypted = provider.decrypt(encrypted[:ciphertext], key, encrypted[:nonce], encrypted[:auth_tag])
+decrypted
+#=> 'XChaCha20Poly1305 round-trip test'
+
+## XChaCha20Poly1305 encryption with AAD (Additional Authenticated Data)
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test with aad'
+aad = 'additional-authenticated-data'
+encrypted = provider.encrypt(plaintext, key, aad)
+decrypted = provider.decrypt(encrypted[:ciphertext], key, encrypted[:nonce], encrypted[:auth_tag], aad)
+decrypted
+#=> 'test with aad'
+
+## XChaCha20Poly1305 AAD tampering fails authentication
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test with aad'
+aad = 'original-aad'
+encrypted = provider.encrypt(plaintext, key, aad)
+provider.decrypt(encrypted[:ciphertext], key, encrypted[:nonce], encrypted[:auth_tag], 'tampered-aad')
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## XChaCha20Poly1305 nonce tampering fails authentication
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test nonce tampering'
+encrypted = provider.encrypt(plaintext, key)
+tampered_nonce = 'x' * 24  # Wrong nonce
+provider.decrypt(encrypted[:ciphertext], key, tampered_nonce, encrypted[:auth_tag])
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## XChaCha20Poly1305 auth tag tampering fails authentication
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test auth tag tampering'
+encrypted = provider.encrypt(plaintext, key)
+tampered_auth_tag = 'y' * 16  # Wrong auth tag
+provider.decrypt(encrypted[:ciphertext], key, encrypted[:nonce], tampered_auth_tag)
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## XChaCha20Poly1305 ciphertext tampering fails authentication
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+key = Base64.strict_decode64(test_keys[:v1])
+plaintext = 'test ciphertext tampering'
+encrypted = provider.encrypt(plaintext, key)
+tampered_ciphertext = encrypted[:ciphertext][0..-2] + 'X'  # Change last byte
+provider.decrypt(tampered_ciphertext, key, encrypted[:nonce], encrypted[:auth_tag])
+#=!> Familia::EncryptionError
+#==> error.message.include?('Decryption failed')
+
+## XChaCha20Poly1305 key validation rejects nil key
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+provider.encrypt('test', nil)
+#=!> Familia::EncryptionError
+#==> error.message.include?('Key cannot be nil')
+
+## XChaCha20Poly1305 key validation requires 32-byte minimum
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+short_key = 'x' * 16  # Only 16 bytes
+provider.encrypt('test', short_key)
+#=!> Familia::EncryptionError
+#==> error.message.include?('Key must be at least 32 bytes')
+
+## XChaCha20Poly1305 secure_wipe clears key (best effort)
+provider = Familia::Encryption::Providers::XChaCha20Poly1305Provider.new
+test_key = 'secret-key-data-to-be-wiped'
+original_length = test_key.length
+provider.secure_wipe(test_key)
+test_key.length
+#=> 0
+
+# TEARDOWN
+Thread.current[:familia_key_cache]&.clear if Thread.current[:familia_key_cache]

data/try/encryption/roundtrip_validation_try.rb

@@ -0,0 +1,28 @@
+# try/encryption/debug4_try.rb
+
+# - Tests full encryption/decryption round trips
+# - Validates that encrypted data can be successfully decrypted
+
+require 'base64'
+
+require_relative '../helpers/test_helpers'
+
+## Test successful encryption
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+result = Familia::Encryption.encrypt('test', context: 'test')
+result.class == String && result.length > 0
+#=> true
+
+## Test successful decryption
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+encrypted = Familia::Encryption.encrypt('test', context: 'test')
+decrypted = Familia::Encryption.decrypt(encrypted, context: 'test')
+decrypted
+#=> 'test'
+
+
+# TEARDOWN

data/try/encryption/secure_memory_handling_try.rb

@@ -0,0 +1,125 @@
+# try/encryption/secure_memory_handling_try.rb
+
+require_relative '../helpers/test_helpers'
+require_relative '../../lib/familia/encryption/providers/secure_xchacha20_poly1305_provider'
+require 'base64'
+
+# SETUP
+Familia.config.encryption_keys = {
+  v1: Base64.strict_encode64('a' * 32)
+}
+Familia.config.current_key_version = :v1
+
+## SecureXChaCha20Poly1305Provider is available when dependencies are loaded
+@provider_class = Familia::Encryption::Providers::SecureXChaCha20Poly1305Provider
+@provider_class.available?
+#=> true
+
+## Provider has higher priority than regular XChaCha20Poly1305Provider
+@provider_class.priority > Familia::Encryption::Providers::XChaCha20Poly1305Provider.priority
+#=> true
+
+## secure_wipe clears key data from memory
+provider = @provider_class.new
+key = 'sensitive_key_data_here_' * 2  # 50 bytes
+original_key = key.dup
+provider.secure_wipe(key)
+key.empty?
+#=> true
+
+## secure_wipe handles nil keys gracefully
+provider = @provider_class.new
+provider.secure_wipe(nil)
+# Should not raise error
+true
+#=> true
+
+## derive_key clears intermediate personalization data
+provider = @provider_class.new
+master_key = 'a' * 32
+context = 'TestModel:field:user123'
+
+# Create a test to verify personalization string gets cleared
+# (We can't directly test this but we verify the function works)
+derived_key = provider.derive_key(master_key, context, personal: 'test_personal')
+derived_key.bytesize
+#=> 32
+
+## encrypt operation clears key after use (demonstration)
+provider = @provider_class.new
+master_key = ('a' * 32).dup  # Make mutable copy
+derived_key = provider.derive_key(master_key, 'test_context')
+plaintext = 'sensitive data'
+
+# Key will be cleared after encryption
+encrypted_data = provider.encrypt(plaintext, derived_key)
+encrypted_data.key?(:ciphertext) && encrypted_data.key?(:nonce) && encrypted_data.key?(:auth_tag)
+#=> true
+
+## decrypt operation clears key after use (demonstration)
+provider = @provider_class.new
+master_key = 'a' * 32
+context = 'TestModel:field:user123'
+derived_key = provider.derive_key(master_key, context)
+plaintext = 'sensitive data'
+
+# Encrypt first
+encrypted_data = provider.encrypt(plaintext, derived_key.dup)
+
+# Create fresh key for decryption (since original was cleared)
+fresh_key = provider.derive_key(master_key, context)
+decrypted = provider.decrypt(
+  encrypted_data[:ciphertext],
+  fresh_key,
+  encrypted_data[:nonce],
+  encrypted_data[:auth_tag]
+)
+decrypted
+#=> "sensitive data"
+
+## Key derivation with null byte validation still works
+provider = @provider_class.new
+master_key = 'a' * 32
+context = 'TestModel:field:user123'
+personal_with_null = "app\0version"
+
+begin
+  provider.derive_key(master_key, context, personal: personal_with_null)
+  "should_not_reach_here"
+rescue Familia::EncryptionError => e
+  e.message
+end
+#=> "Personalization string must not contain null bytes"
+
+## Round-trip encryption/decryption works with secure provider
+provider = @provider_class.new
+master_key = 'a' * 32
+context = 'TestModel:field:user123'
+plaintext = 'sensitive data here'
+
+# Derive keys separately since they get cleared after use
+key_for_encrypt = provider.derive_key(master_key, context)
+key_for_decrypt = provider.derive_key(master_key, context)
+
+encrypted_data = provider.encrypt(plaintext, key_for_encrypt)
+decrypted = provider.decrypt(
+  encrypted_data[:ciphertext],
+  key_for_decrypt,
+  encrypted_data[:nonce],
+  encrypted_data[:auth_tag]
+)
+decrypted
+#=> "sensitive data here"
+
+## Generate nonce produces correct size
+provider = @provider_class.new
+nonce = provider.generate_nonce
+nonce.bytesize
+#=> 24
+
+## Provider algorithm identifier distinguishes it from regular provider
+@provider_class.const_get(:ALGORITHM)
+#=> "xchacha20poly1305-secure"
+
+# TEARDOWN
+Thread.current[:familia_key_cache]&.clear if Thread.current[:familia_key_cache]

data/try/features/encrypted_fields_core_try.rb

@@ -0,0 +1,125 @@
+# try/features/encrypted_fields_core_try.rb
+
+require_relative '../helpers/test_helpers'
+require 'base64'
+
+
+## Encrypted field methods are properly defined
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+
+  field :user_id
+  field :email
+  encrypted_field :ssn
+  encrypted_field :api_key, aad_fields: [:email]
+end
+
+user = SecureUser.new(user_id: 'test-user-001', email: 'test@example.com')
+user.respond_to?(:ssn) && user.respond_to?(:ssn=)
+#=> true
+
+## Setting encrypted field stores ConcealedString (secure by default)
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser2 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :ssn
+end
+
+user = SecureUser2.new(user_id: 'test-user-002')
+user.ssn = '123-45-6789'
+stored_value = user.instance_variable_get(:@ssn)
+stored_value.class.name == "ConcealedString"
+#=> true
+
+## Getter returns ConcealedString (secure by default)
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUserDecrypt < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :ssn
+end
+
+@user = SecureUserDecrypt.new(user_id: 'decrypt-test')
+@user.ssn = '123-45-6789'
+@user.ssn.to_s
+#=> '[CONCEALED]'
+
+## Controlled decryption with reveal block
+@user.ssn.reveal { |decrypted| decrypted }
+#=> '123-45-6789'
+
+## repaired test
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser3 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :ssn
+end
+
+user = SecureUser3.new(user_id: 'test-user-003')
+user.ssn = nil
+result = user.instance_variable_get(:@ssn)
+user.ssn.nil? && result.nil?
+#=> true
+
+## Field type is correctly identified as encrypted
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser4 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  encrypted_field :ssn
+end
+
+field_type = SecureUser4.field_types[:ssn]
+field_type.category
+#=> :encrypted
+
+## Field type is persistent
+SecureUser4.field_types[:ssn].persistent?
+#=> true
+
+## Encrypted field with AAD fields configured (secure by default)
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class SecureUser5 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :user_id
+  field :user_id
+  field :email
+  encrypted_field :api_key, aad_fields: [:email]
+end
+
+@user2 = SecureUser5.new(user_id: 'test-user-005', email: 'test@example.com')
+@user2.api_key = 'secret-key-123'
+@user2.api_key.to_s
+#=> '[CONCEALED]'
+
+## AAD fields work with controlled decryption
+@user2.api_key.reveal { |decrypted| decrypted }
+#=> 'secret-key-123'
+
+Thread.current[:familia_key_cache]&.clear if Thread.current[:familia_key_cache]

data/try/features/encrypted_fields_integration_try.rb

@@ -0,0 +1,216 @@
+# try/features/encrypted_fields_integration_try.rb
+
+# Test constants will be redefined in each test since variables don't persist
+
+require_relative '../helpers/test_helpers'
+require 'base64'
+
+
+class FullSecureModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  field :name                    # Regular field
+  field :email                   # Regular field for AAD
+  encrypted_field :password      # Encrypted without AAD
+  encrypted_field :api_token, aad_fields: [:email]  # Encrypted with AAD
+
+  list :activity_log            # Regular list
+  hashkey :metadata             # Regular hashkey
+end
+
+# Create XChaCha model in setup for use across tests
+test_keys_xchacha = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys_xchacha
+Familia.config.current_key_version = :v1
+
+class XChaChaIntegrationModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  encrypted_field :secret_data
+end
+
+@xchacha_model = XChaChaIntegrationModel.new(model_id: 'xchacha-test')
+@xchacha_model.secret_data = 'xchacha20poly1305 integration test'
+
+
+
+## Full model initialization with mixed field types works
+test_keys = { v1: Base64.strict_encode64('a' * 32), v2: Base64.strict_encode64('b' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v2
+
+model = FullSecureModel.new(
+  model_id: 'secure-123',
+  name: 'Test User',
+  email: 'test@secure.com'
+)
+[model.model_id, model.name, model.email]
+#=> ['secure-123', 'Test User', 'test@secure.com']
+
+## Setting encrypted fields works alongside regular fields
+test_keys = { v1: Base64.strict_encode64('a' * 32), v2: Base64.strict_encode64('b' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v2
+
+class FullSecureModel2 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  field :name
+  field :email
+  encrypted_field :password
+  encrypted_field :api_token, aad_fields: [:email]
+end
+
+@model = FullSecureModel2.new(
+  model_id: 'secure-124',
+  name: 'Test User 2',
+  email: 'test2@secure.com'
+)
+@model.password = 'secret-password-123'
+@model.api_token = 'api-token-abc-xyz'
+[@model.password.to_s, @model.api_token.to_s]
+#=> ['[CONCEALED]', '[CONCEALED]']
+
+## Controlled access returns actual values
+[@model.password.reveal { |p| p }, @model.api_token.reveal { |t| t }]
+#=> ['secret-password-123', 'api-token-abc-xyz']
+
+## repaired test
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class FullSecureModel3 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  encrypted_field :password
+end
+
+@model3 = FullSecureModel3.new(model_id: 'secure-125')
+@model3.password = 'secret-password-123'
+hash_representation = @model3.to_h
+# With ConcealedString, to_h now excludes encrypted fields by default for security
+hash_representation.key?("password")
+#=> false
+
+## Instance variables contain encrypted data structure
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class FullSecureModel3b < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+  field :model_id
+  encrypted_field :password
+end
+
+@model3b = FullSecureModel3b.new(model_id: 'secure-125b')
+@model3b.password = 'secret-password-123'
+# Internal storage now uses ConcealedString for security
+concealed_password = @model3b.instance_variable_get(:@password)
+concealed_password.class.name == "ConcealedString"
+#=> true
+
+## Mixed data types work correctly with encrypted fields
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class FullSecureModel4 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  encrypted_field :password
+  list :activity_log
+  hashkey :metadata
+end
+
+@model4 = FullSecureModel4.new(model_id: 'secure-126')
+@model4.password = 'secure-pass'
+@model4.activity_log << 'User logged in'
+@model4.metadata['last_login'] = Time.now.to_i.to_s
+
+[@model4.password.to_s, @model4.activity_log.size, @model4.metadata.has_key?('last_login')]
+#=> ['[CONCEALED]', 1, true]
+
+## XChaCha20Poly1305 integration tests
+concealed_data = @xchacha_model.secret_data
+[
+  concealed_data.class.name == "ConcealedString",
+  @xchacha_model.secret_data.to_s,
+  @xchacha_model.secret_data.reveal { |decrypted| decrypted }
+]
+#=> [true, "[CONCEALED]", "xchacha20poly1305 integration test"]
+
+
+# ALGORITHM PARAMETER FIX NEEDED:
+#
+# Problem: encrypted_field :secret_data, algorithm: 'aes-256-gcm'
+# is ignored - always uses default XChaCha20Poly1305
+#
+# Root cause: EncryptedFieldType.encrypt_value always calls
+# Familia::Encryption.encrypt() (default) instead of
+# Familia::Encryption.encrypt_with(@algorithm, ...) when algorithm specified
+#
+# Fix required in lib/familia/features/encrypted_fields/encrypted_field_type.rb:
+# 1. Add attr_reader :algorithm
+# 2. Add algorithm: nil parameter to initialize()
+# 3. Store @algorithm = algorithm
+# 4. Update encrypt_value() to use encrypt_with(@algorithm, ...) when @algorithm present
+#
+# This enables per-field algorithm selection while maintaining backward compatibility
+
+## TEST 8: AES-GCM algorithm specification test (shows default provider takes precedence)
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class AESIntegrationModel < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+
+  field :model_id
+  encrypted_field :secret_data, algorithm: 'aes-256-gcm' # Specify the algorithm
+end
+
+@aes_model = AESIntegrationModel.new(model_id: 'aes-test')
+@aes_model.secret_data = 'aes-gcm integration test'
+
+# Test shows that algorithm parameter is currently ignored - XChaCha20Poly1305 is used by default
+concealed_data = @aes_model.secret_data
+encrypted_json = concealed_data.encrypted_value
+parsed_data = JSON.parse(encrypted_json, symbolize_names: true)
+[parsed_data[:algorithm], @aes_model.secret_data.reveal { |data| data }]
+#=> ["xchacha20poly1305", "aes-gcm integration test"]
+
+## TEST 9: Provider-specific integration: AES-GCM with forced algorithm
+test_keys = { v1: Base64.strict_encode64('a' * 32) }
+Familia.config.encryption_keys = test_keys
+Familia.config.current_key_version = :v1
+
+class AESIntegrationModel2 < Familia::Horreum
+  feature :encrypted_fields
+  identifier_field :model_id
+  field :model_id
+  encrypted_field :secret_data, algorithm: 'aes-256-gcm' # Specify the algorithm
+end
+
+@aes_model2 = AESIntegrationModel2.new(model_id: 'aes-test')
+@aes_model2.secret_data = 'aes-gcm integration test'  # Use setter, not manual encryption
+
+# Verify algorithm and decryption
+concealed_data = @aes_model2.secret_data
+encrypted_json = concealed_data.encrypted_value
+parsed_data = JSON.parse(encrypted_json, symbolize_names: true)
+[parsed_data[:algorithm], @aes_model2.secret_data.reveal { |data| data }]
+#=> ["xchacha20poly1305", "aes-gcm integration test"]