hypershield 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 1b167b3edd07f94a46e64afb6bca7f78f84af7cf722335ce5a518a78e8fa5258
+  data.tar.gz: dbc93219926d4d02b719fae8592ad5ffba3240240b7db58562f1a05f1d6427f2
+SHA512:
+  metadata.gz: 0c92349ce9da647caec2ee487d815136340c25f1b42190b2589c0173b610ed7865648421db72a5a950aee9b87dbd421fcc02d0d248d945db9b9202507b425cdc
+  data.tar.gz: 3da557fabb3e16e852f8a1762d82de60078e10a6863b340fdef76c3708f3e979555aff123623fc3c566088a8d9de8d7addd1c7ce4ebb21446cb548050ce39246

data/.gitignore

@@ -0,0 +1,9 @@
+/.bundle/
+/.yardoc
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+Gemfile.lock

data/CHANGELOG.md

@@ -0,0 +1,3 @@
+## 0.1.0
+
+- First release

data/Gemfile

@@ -0,0 +1,6 @@
+source "https://rubygems.org"
+
+git_source(:github) {|repo_name| "https://github.com/#{repo_name}" }
+
+# Specify your gem's dependencies in hypershield.gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2018 Andrew
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,118 @@
+# Hypershield
+
+:zap: Shield sensitive data in Postgres and MySQL
+
+Great for business intelligence tools like [Blazer](https://github.com/ankane/blazer)
+
+## How It Works
+
+Hypershield creates *shielded views* (in the `hypershield` schema by default) that hide sensitive tables and columns. By default, it hides columns with:
+
+- `encrypted`
+- `password`
+- `token`
+- `secret`
+
+Give database users access to these views instead of the original tables. You can set the `search_path` so queries don’t need to be schema-qualified. The advantage of this approach over column-level privileges is you can use `SELECT *`.
+
+## Database Setup
+
+### Postgres
+
+Create a new schema in your database
+
+```sql
+CREATE SCHEMA hypershield;
+```
+
+Grant privileges
+
+```sql
+GRANT USAGE ON SCHEMA hypershield TO myuser;
+
+-- replace migrations with the user who manages your schema
+ALTER DEFAULT PRIVILEGES FOR ROLE migrations IN SCHEMA hypershield
+    GRANT SELECT ON TABLES TO myuser;
+
+-- keep public in search path for functions
+ALTER ROLE myuser SET search_path TO hypershield, public;
+```
+
+And connect as the user and make sure there’s no access the original tables
+
+```sql
+SELECT * FROM public.users LIMIT 1;
+```
+
+### MySQL
+
+Create a new schema in your database
+
+```sql
+CREATE SCHEMA hypershield;
+```
+
+Grant privileges
+
+```sql
+GRANT SELECT, SHOW VIEW ON hypershield.* TO myuser;
+FLUSH PRIVILEGES;
+```
+
+And connect as the user and make sure there’s no access the original tables
+
+```sql
+SELECT * FROM mydb.users LIMIT 1;
+```
+
+## Installation
+
+Add this line to your application’s Gemfile:
+
+```ruby
+gem 'hypershield', group: :production
+```
+
+Refresh the schema
+
+```sh
+rake hypershield:refresh
+```
+
+And query away on your shielded views
+
+```sql
+SELECT * FROM users LIMIT 1;
+```
+
+When you run database migrations, the schema is automatically refreshed.
+
+## Configuration
+
+Specify the schema to use and columns to show and hide
+
+```ruby
+Hypershield.schemas = {
+  hypershield: {
+    hide: %w(encrypted password token secret),
+    show: %w(ahoy_visits.visit_token)
+  }
+}
+```
+
+## TODO
+
+- Create CLI
+
+## History
+
+View the [changelog](CHANGELOG.md)
+
+## Contributing
+
+Everyone is encouraged to help improve this project. Here are a few ways you can help:
+
+- [Report bugs](https://github.com/ankane/hypershield/issues)
+- Fix bugs and [submit pull requests](https://github.com/ankane/hypershield/pulls)
+- Write, clarify, or fix documentation
+- Suggest or add new features

data/Rakefile

@@ -0,0 +1,10 @@
+require "bundler/gem_tasks"
+require "rake/testtask"
+
+Rake::TestTask.new(:test) do |t|
+  t.libs << "test"
+  t.libs << "lib"
+  t.test_files = FileList["test/**/*_test.rb"]
+end
+
+task default: :test

data/hypershield.gemspec

@@ -0,0 +1,28 @@
+
+lib = File.expand_path("../lib", __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require "hypershield/version"
+
+Gem::Specification.new do |spec|
+  spec.name          = "hypershield"
+  spec.version       = Hypershield::VERSION
+  spec.authors       = ["Andrew Kane"]
+  spec.email         = ["andrew@chartkick.com"]
+
+  spec.summary       = "Shield sensitive data in Postgres and MySQL"
+  spec.homepage      = "https://github.com/ankane/hypershield"
+  spec.license       = "MIT"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject do |f|
+    f.match(%r{^(test|spec|features)/})
+  end
+  spec.bindir        = "exe"
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  spec.add_dependency "activerecord"
+
+  spec.add_development_dependency "bundler"
+  spec.add_development_dependency "minitest"
+  spec.add_development_dependency "rake"
+end

data/lib/hypershield.rb

@@ -0,0 +1,139 @@
+require "active_support"
+
+require "hypershield/migration"
+require "hypershield/railtie" if defined?(Rails)
+require "hypershield/version"
+
+module Hypershield
+  class << self
+    attr_accessor :schemas
+  end
+  self.schemas = {
+    hypershield: {
+      hide: %w(encrypted password token secret),
+      show: []
+    }
+  }
+
+  class << self
+    def drop_view(view)
+      schemas.each do |schema, _|
+        execute("DROP VIEW IF EXISTS #{quote_ident(schema)}.#{quote_ident(view)}")
+      end
+    end
+
+    def refresh
+      if adapter_name =~ /sqlite/i
+        raise "Adapter not supported: #{adapter_name}"
+      end
+
+      quiet_logging do
+        statements = []
+
+        schemas.each do |schema, config|
+          hide = config[:hide].to_a
+          show = config[:show].to_a
+
+          tables.sort_by { |k, _| k }.each do |table, columns|
+            next if table == "pg_stat_statements"
+
+            statements << "DROP VIEW IF EXISTS #{quote_ident(schema)}.#{quote_ident(table)} CASCADE"
+
+            columns.reject! do |column|
+              hide.any? { |m| "#{table}.#{column}".include?(m) } &&
+                !show.any? { |m| "#{table}.#{column}".include?(m) }
+            end
+
+            if columns.any?
+              statements << "CREATE VIEW #{quote_ident(schema)}.#{quote_ident(table)} AS SELECT #{columns.map { |c| quote_ident(c) }.join(", ")} FROM #{quote_ident(table)}"
+            end
+          end
+        end
+
+        if statements.any?
+          connection.transaction do
+            if mysql?
+              statements.each do |statement|
+                execute(statement)
+              end
+            else
+              execute(statements.join(";\n"))
+            end
+          end
+        end
+      end
+    end
+
+    private
+
+    def quiet_logging
+      if ActiveRecord::Base.logger
+        previous_level = ActiveRecord::Base.logger.level
+        begin
+          ActiveRecord::Base.logger.level = Logger::INFO
+          yield
+        ensure
+          ActiveRecord::Base.logger.level = previous_level
+        end
+      else
+        yield
+      end
+    end
+
+    def connection
+      ActiveRecord::Base.connection
+    end
+
+    def adapter_name
+      connection.adapter_name
+    end
+
+    def mysql?
+      adapter_name =~ /mysql/i
+    end
+
+    def tables
+      # TODO make schema configurable
+      schema =
+        if mysql?
+          "database()"
+        else
+          "'public'"
+        end
+
+      query = <<-SQL
+        SELECT
+          table_name,
+          column_name,
+          ordinal_position,
+          data_type
+        FROM
+          information_schema.columns
+        WHERE
+          table_schema = #{schema}
+      SQL
+
+      Hash[
+        select_all(query)
+          .group_by { |c| c["table_name"] }
+          .map { |t, cs| [t, cs.sort_by { |c| c["ordinal_position"].to_i }.map { |c| c["column_name"] }] }
+      ]
+    end
+
+    def select_all(sql)
+      connection.select_all(sql).to_a
+    end
+
+    def execute(sql)
+      connection.execute(sql)
+    end
+
+    def quote_ident(ident)
+      connection.quote_table_name(ident.to_s)
+    end
+  end
+end
+
+ActiveSupport.on_load(:active_record) do
+  ActiveRecord::Migration.prepend(Hypershield::Migration)
+end

data/lib/hypershield/migration.rb

@@ -0,0 +1,14 @@
+module Hypershield
+  module Migration
+    def method_missing(method, *args)
+      if [
+        :change_column, :drop_table, :remove_column, :remove_columns,
+        :remove_timestamps, :rename_column, :rename_table
+      ].include?(method)
+        Hypershield.drop_view(args[0])
+      end
+
+      super
+    end
+  end
+end

data/lib/hypershield/railtie.rb

@@ -0,0 +1,21 @@
+module Hypershield
+  class Railtie < Rails::Railtie
+    rake_tasks do
+      namespace :hypershield do
+        task refresh: :environment do
+          $stderr.puts "[hypershield] Refreshing schemas"
+          Hypershield.refresh
+          $stderr.puts "[hypershield] Success!"
+        end
+      end
+
+      Rake::Task["db:migrate"].enhance do
+        Rake::Task["hypershield:refresh"].invoke
+      end
+
+      Rake::Task["db:rollback"].enhance do
+        Rake::Task["hypershield:refresh"].invoke
+      end
+    end
+  end
+end

data/lib/hypershield/version.rb

@@ -0,0 +1,3 @@
+module Hypershield
+  VERSION = "0.1.0"
+end

metadata

@@ -0,0 +1,111 @@
+--- !ruby/object:Gem::Specification
+name: hypershield
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Andrew Kane
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2018-04-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activerecord
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: 
+email:
+- andrew@chartkick.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- CHANGELOG.md
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- hypershield.gemspec
+- lib/hypershield.rb
+- lib/hypershield/migration.rb
+- lib/hypershield/railtie.rb
+- lib/hypershield/version.rb
+homepage: https://github.com/ankane/hypershield
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.7.6
+signing_key: 
+specification_version: 4
+summary: Shield sensitive data in Postgres and MySQL
+test_files: []