ibm_db 5.6.1 → 5.7.0

data/test/cases/encryption/encryption_schemes_test.rb

@@ -0,0 +1,240 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+require "models/author_encrypted"
+
+class ActiveRecord::Encryption::EncryptionSchemesTest < ActiveRecord::EncryptionTestCase
+  test "can decrypt encrypted_value encrypted with a different encryption scheme" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+
+    author = create_author_with_name_encrypted_with_previous_scheme
+    assert_equal "dhh", author.reload.name
+    assert author.encrypted_attribute? :name
+  end
+
+  test "when defining previous encryption schemes, you still get Decryption errors when using invalid clear values" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+
+    author = ActiveRecord::Encryption.without_encryption { EncryptedAuthor.create!(name: "unencrypted author") }
+
+    assert_raises ActiveRecord::Encryption::Errors::Decryption do
+      author.reload.name
+    end
+  end
+
+  test "use a custom encryptor" do
+    author = EncryptedAuthor1.create name: "1"
+    assert_equal "1", author.name
+    assert author.encrypted_attribute? :name
+  end
+
+  test "support previous contexts" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = true
+
+    author = EncryptedAuthor2.create name: "2"
+    assert_equal "2", author.name
+    assert_equal author, EncryptedAuthor2.find_by_name("2")
+    assert author.encrypted_attribute? :name
+
+    Author.find(author.id).update! name: "1"
+    assert_equal "1", author.reload.name
+    assert_equal author, EncryptedAuthor2.find_by_name("1")
+    assert_not author.encrypted_attribute? :name
+  end
+
+  test "use global previous schemes to decrypt data encrypted with previous schemes" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+    encrypted_author_class = declare_class_with_global_previous_encryption_schemes({ encryptor: TestEncryptor.new("0" => "1") }, { encryptor: TestEncryptor.new("1" => "2") })
+
+    assert_equal 2, encrypted_author_class.type_for_attribute(:name).previous_types.count
+    previous_type_1, previous_type_2 = encrypted_author_class.type_for_attribute(:name).previous_types
+
+    author = ActiveRecord::Encryption.without_encryption do
+      encrypted_author_class.create name: previous_type_1.serialize("1")
+    end
+    assert_equal "0", author.reload.name
+
+    author = ActiveRecord::Encryption.without_encryption do
+      encrypted_author_class.create name: previous_type_2.serialize("2")
+    end
+    assert_equal "1", author.reload.name
+  end
+
+  test "use global previous schemes to decrypt data encrypted with previous schemes with unencrypted data" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = true
+    encrypted_author_class = declare_class_with_global_previous_encryption_schemes({ encryptor: TestEncryptor.new("0" => "1") }, { encryptor: TestEncryptor.new("1" => "2") })
+
+    assert_equal 3, encrypted_author_class.type_for_attribute(:name).previous_types.count
+    previous_type_1, previous_type_2 = encrypted_author_class.type_for_attribute(:name).previous_types
+
+    author = ActiveRecord::Encryption.without_encryption do
+      encrypted_author_class.create name: previous_type_1.serialize("1")
+    end
+    assert_equal "0", author.reload.name
+
+    author = ActiveRecord::Encryption.without_encryption do
+      encrypted_author_class.create name: previous_type_2.serialize("2")
+    end
+    assert_equal "1", author.reload.name
+  end
+
+  test "returns ciphertext all the previous schemes fail to decrypt and support for unencrypted data is on" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = true
+    encrypted_author_class = declare_class_with_global_previous_encryption_schemes({ encryptor: TestEncryptor.new("0" => "1") }, { encryptor: TestEncryptor.new("1" => "2") })
+
+    author = ActiveRecord::Encryption.without_encryption do
+      encrypted_author_class.create name: "some ciphertext"
+    end
+
+    assert_equal "some ciphertext", author.reload.name
+  end
+
+  test "raise decryption error when all the previous schemes fail to decrypt" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+    encrypted_author_class = declare_class_with_global_previous_encryption_schemes({ encryptor: TestEncryptor.new("0" => "1") }, { encryptor: TestEncryptor.new("1" => "2") })
+
+    author = ActiveRecord::Encryption.without_encryption do
+      encrypted_author_class.create name: "some invalid ciphertext"
+    end
+
+    assert_raise ActiveRecord::Encryption::Errors::Decryption do
+      author.reload.name
+    end
+  end
+
+  test "deterministic encryption is fixed by default: it will always use the oldest scheme to encrypt data" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+    ActiveRecord::Encryption.config.deterministic_key = "12345"
+    ActiveRecord::Encryption.config.previous = [{ downcase: true, deterministic: true }, { downcase: false, deterministic: true }]
+
+    encrypted_author_class = Class.new(Author) do
+      self.table_name = "authors"
+
+      encrypts :name, deterministic: true, downcase: false
+    end
+
+    author = encrypted_author_class.create!(name: "STEPHEN KING")
+    assert_equal "stephen king", author.name
+  end
+
+  test "don't use global previous schemes with a different deterministic nature" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+    ActiveRecord::Encryption.config.deterministic_key = "12345"
+    ActiveRecord::Encryption.config.previous = [{ downcase: true, deterministic: false }, { downcase: false, deterministic: true }]
+
+    encrypted_author_class = Class.new(Author) do
+      self.table_name = "authors"
+
+      encrypts :name, deterministic: true, downcase: false
+    end
+
+    author = encrypted_author_class.create!(name: "STEPHEN KING")
+    assert_equal "STEPHEN KING", author.name
+  end
+
+  test "deterministic encryption will use the newest encryption scheme to encrypt data when setting it to { fixed: false }" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+    ActiveRecord::Encryption.config.deterministic_key = "12345"
+    ActiveRecord::Encryption.config.previous = [{ downcase: true, deterministic: true }, { downcase: false, deterministic: true }]
+
+    encrypted_author_class = Class.new(Author) do
+      self.table_name = "authors"
+
+      encrypts :name, deterministic: { fixed: false }, downcase: false
+    end
+
+    author = encrypted_author_class.create!(name: "STEPHEN KING")
+    assert_equal "STEPHEN KING", author.name
+  end
+
+  test "use global previous schemes when performing queries" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+    ActiveRecord::Encryption.config.deterministic_key = "12345"
+    ActiveRecord::Encryption.config.previous = [{ downcase: true, deterministic: true }, { downcase: false, deterministic: true }]
+
+    encrypted_author_class = Class.new(Author) do
+      self.table_name = "authors"
+
+      encrypts :name, deterministic: true, downcase: false
+    end
+
+    author = encrypted_author_class.create!(name: "STEPHEN KING")
+    assert_equal author, encrypted_author_class.find_by_name("STEPHEN KING")
+    assert_equal author, encrypted_author_class.find_by_name("stephen king")
+  end
+
+  test "don't use global previous schemes with a different deterministic nature when performing queries" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+    ActiveRecord::Encryption.config.deterministic_key = "12345"
+    ActiveRecord::Encryption.config.previous = [{ downcase: true, deterministic: false }, { downcase: false, deterministic: true }]
+
+    encrypted_author_class = Class.new(Author) do
+      self.table_name = "authors"
+
+      encrypts :name, deterministic: true, downcase: false
+    end
+
+    author = encrypted_author_class.create!(name: "STEPHEN KING")
+    assert_equal author, encrypted_author_class.find_by_name("STEPHEN KING")
+    assert_nil encrypted_author_class.find_by_name("stephen king")
+  end
+
+  private
+    class TestEncryptor
+      def initialize(ciphertexts_by_clear_value)
+        @ciphertexts_by_clear_value = ciphertexts_by_clear_value
+      end
+
+      def encrypt(clear_text, key_provider: nil, cipher_options: {})
+        @ciphertexts_by_clear_value[clear_text] || clear_text
+      end
+
+      def decrypt(encrypted_text, key_provider: nil, cipher_options: {})
+        @ciphertexts_by_clear_value.each { |clear_value, encrypted_value| return clear_value if encrypted_value == encrypted_text }
+        raise ActiveRecord::Encryption::Errors::Decryption, "Couldn't find a match for #{encrypted_text} (#{@ciphertexts_by_clear_value.inspect})"
+      end
+
+      def encrypted?(text)
+        decrypt(text)
+      rescue ActiveRecord::Encryption::Errors::Decryption
+        false
+      end
+
+      def binary?
+        false
+      end
+    end
+
+    class EncryptedAuthor1 < Author
+      self.table_name = "authors"
+
+      encrypts :name, encryptor: TestEncryptor.new("1" => "2")
+    end
+
+    class EncryptedAuthor2 < Author
+      self.table_name = "authors"
+
+      encrypts :name, encryptor: TestEncryptor.new("2" => "3"), previous: { encryptor: TestEncryptor.new("1" => "2") }
+    end
+
+    def create_author_with_name_encrypted_with_previous_scheme
+      author = EncryptedAuthor.create!(name: "david")
+      old_type = EncryptedAuthor.type_for_attribute(:name).previous_types.first
+      value_encrypted_with_old_type = old_type.serialize("dhh")
+      ActiveRecord::Encryption.without_encryption do
+        author.update!(name: value_encrypted_with_old_type)
+      end
+      author
+    end
+
+    def declare_class_with_global_previous_encryption_schemes(*previous_schemes)
+      ActiveRecord::Encryption.config.previous = previous_schemes
+
+      # We want to evaluate .encrypts *after* tweaking the config property
+      Class.new(Author) do
+        self.table_name = "authors"
+
+        encrypts :name
+      end.tap { |klass| klass.type_for_attribute(:name) }
+    end
+end

data/test/cases/encryption/encryptor_test.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+
+class ActiveRecord::Encryption::EncryptorTest < ActiveRecord::EncryptionTestCase
+  setup do
+    @secret_key = "This is my secret 256 bits key!!"
+    @encryptor = ActiveRecord::Encryption::Encryptor.new
+  end
+
+  test "encrypt and decrypt a string" do
+    assert_encrypt_text("my secret text")
+  end
+
+  test "trying to decrypt something else than a string will raise a Decryption error" do
+    assert_raises(ActiveRecord::Encryption::Errors::Decryption) do
+      @encryptor.decrypt(:it_can_only_decrypt_strings)
+    end
+  end
+
+  test "decrypt an invalid string will raise a Decryption error" do
+    assert_raises(ActiveRecord::Encryption::Errors::Decryption) do
+      @encryptor.decrypt("some test that does not make sense")
+    end
+  end
+
+  test "decrypt an encrypted text with an invalid key will raise a Decryption error" do
+    assert_raises(ActiveRecord::Encryption::Errors::Decryption) do
+      encrypted_text = @encryptor.encrypt("Some text to encrypt")
+      @encryptor.decrypt(encrypted_text, key_provider: ActiveRecord::Encryption::DerivedSecretKeyProvider.new("some invalid key"))
+    end
+  end
+
+  test "if an encryption error happens when encrypting an encrypted text it should raise" do
+    assert_raises(ActiveRecord::Encryption::Errors::Encryption) do
+      key_provider_that_raises_an_encryption_error = ActiveRecord::Encryption::DerivedSecretKeyProvider.new("some key")
+      key_provider_that_raises_an_encryption_error.stub :encryption_key, -> { raise ActiveRecord::Encryption::Errors::Encryption } do
+        @encryptor.encrypt("Some text to encrypt", key_provider: key_provider_that_raises_an_encryption_error)
+      end
+    end
+  end
+
+  test "content is compressed" do
+    content = SecureRandom.hex(5.kilobytes)
+    cipher_text = @encryptor.encrypt(content)
+
+    assert_encrypt_text content
+    assert cipher_text.bytesize < content.bytesize
+  end
+
+  test "content is not compressed, when disabled" do
+    @encryptor = ActiveRecord::Encryption::Encryptor.new(compress: false)
+    content = SecureRandom.hex(5.kilobytes)
+    cipher_text = @encryptor.encrypt(content)
+
+    assert_encrypt_text content
+    assert cipher_text.bytesize > content.bytesize
+  end
+
+  test "trying to encrypt custom classes raises a ForbiddenClass exception" do
+    assert_raises ActiveRecord::Encryption::Errors::ForbiddenClass do
+      @encryptor.encrypt(Struct.new(:name).new("Jorge"))
+    end
+  end
+
+  test "store custom metadata with the encrypted data, accessible by the key provider" do
+    key = ActiveRecord::Encryption::Key.new(@secret_key)
+    key.public_tags[:key] = "my tag"
+    key_provider = ActiveRecord::Encryption::KeyProvider.new(key)
+    encryptor = ActiveRecord::Encryption::Encryptor.new
+
+    key_provider.stub :decryption_keys, ->(message) { [key] } do
+      decrypted_text = encryptor.decrypt encryptor.encrypt("some text", key_provider: key_provider), key_provider: key_provider
+      assert decrypted_text
+    end
+  end
+
+  test "encrypted? returns whether the passed text is encrypted" do
+    assert @encryptor.encrypted?(@encryptor.encrypt("clean text"))
+    assert_not @encryptor.encrypted?("clean text")
+  end
+
+  test "decrypt respects encoding even when compression is used" do
+    text = "The Starfleet is here #{'OMG! ' * 50}!".dup.force_encoding(Encoding::ISO_8859_1)
+    encrypted_text = @encryptor.encrypt(text)
+    decrypted_text = @encryptor.decrypt(encrypted_text)
+
+    assert_equal Encoding::ISO_8859_1, decrypted_text.encoding
+  end
+
+  test "accept a custom compressor" do
+    compressor = Module.new do
+      def self.deflate(data)
+        "compressed #{data}"
+      end
+
+      def self.inflate(data)
+        data.sub(/\Acompressed /, "")
+      end
+    end
+    @encryptor = ActiveRecord::Encryption::Encryptor.new(compressor: compressor)
+    content = SecureRandom.hex(5.kilobytes)
+
+    assert_encrypt_text content
+  end
+
+  private
+    def assert_encrypt_text(clean_text)
+      encrypted_text = @encryptor.encrypt(clean_text)
+      assert_not_equal encrypted_text, clean_text
+      assert_equal clean_text, @encryptor.decrypt(encrypted_text)
+    end
+end

data/test/cases/encryption/envelope_encryption_key_provider_test.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+
+class ActiveRecord::Encryption::EnvelopeEncryptionKeyProviderTest < ActiveRecord::EncryptionTestCase
+  setup do
+    @key_provider = ActiveRecord::Encryption::EnvelopeEncryptionKeyProvider.new
+  end
+
+  test "encryption_key returns random encryption keys" do
+    keys = 5.times.collect { @key_provider.encryption_key }
+    assert_equal 5, keys.group_by(&:secret).length
+  end
+
+  test "generate_random_encryption_key generates keys of 32 bytes" do
+    assert_equal 32, @key_provider.encryption_key.secret.bytesize
+  end
+
+  test "generated random keys carry their secret encrypted with the primary key" do
+    key = @key_provider.encryption_key
+    encrypted_secret = key.public_tags.encrypted_data_key
+    assert_equal key.secret, ActiveRecord::Encryption.cipher.decrypt(encrypted_secret, key: @key_provider.active_primary_key.secret)
+  end
+
+  test "decryption_key_for returns the decryption key for a message that was encrypted with a generated encryption key" do
+    key = @key_provider.encryption_key
+    encrypted_encoded_message = ActiveRecord::Encryption.encryptor.encrypt("some message", key_provider: ActiveRecord::Encryption::KeyProvider.new(key))
+    encrypted_message = ActiveRecord::Encryption.message_serializer.load encrypted_encoded_message
+    assert_equal key.secret, @key_provider.decryption_keys(encrypted_message).first.secret
+  end
+
+  test "work with multiple keys when config.store_key_references is false" do
+    ActiveRecord::Encryption.config.primary_key = ["key 1", "key 2"]
+
+    assert_encryptor_works_with @key_provider
+  end
+
+  test "work with multiple keys when config.store_key_references is true" do
+    ActiveRecord::Encryption.config.primary_key = ["key 1", "key 2"]
+    ActiveRecord::Encryption.config.store_key_references = true
+
+    assert_encryptor_works_with @key_provider
+  end
+
+  private
+    def assert_multiple_primary_keys
+      assert Rails.application.credentials.dig(:active_record_encryption, :primary_key).length > 1
+    end
+end

data/test/cases/encryption/extended_deterministic_queries_test.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+require "models/book_encrypted"
+
+class ActiveRecord::Encryption::ExtendedDeterministicQueriesTest < ActiveRecord::EncryptionTestCase
+  setup do
+    ActiveRecord::Encryption.config.support_unencrypted_data = true
+  end
+
+  test "Finds records when data is unencrypted" do
+    UnencryptedBook.create!(name: "Dune")
+    assert EncryptedBook.find_by(name: "Dune") # core
+    assert EncryptedBook.where("id > 0").find_by(name: "Dune") # relation
+  end
+
+  test "Finds records when data is encrypted" do
+    EncryptedBook.create!(name: "Dune")
+    assert EncryptedBook.find_by(name: "Dune") # core
+    assert EncryptedBook.where("id > 0").find_by(name: "Dune") # relation
+  end
+
+  test "Works well with downcased attributes" do
+    EncryptedBookWithDowncaseName.create! name: "Dune"
+    assert EncryptedBookWithDowncaseName.find_by(name: "DUNE")
+  end
+
+  test "Works well with string attribute names" do
+    UnencryptedBook.create! "name" => "Dune"
+    assert EncryptedBook.find_by("name" => "Dune")
+  end
+
+  test "find_or_create_by works" do
+    EncryptedBook.find_or_create_by!(name: "Dune")
+    assert EncryptedBook.find_by(name: "Dune")
+
+    EncryptedBook.find_or_create_by!(name: "Dune")
+    assert EncryptedBook.find_by(name: "Dune")
+  end
+
+  test "does not mutate arguments" do
+    props = { name: "Dune" }
+
+    assert_equal "Dune", EncryptedBook.find_or_initialize_by(props).name
+    assert_equal "Dune", props[:name]
+  end
+
+  test "where(...).first_or_create works" do
+    EncryptedBook.where(name: "Dune").first_or_create
+    assert EncryptedBook.exists?(name: "Dune")
+  end
+
+  test "exists?(...) works" do
+    EncryptedBook.create! name: "Dune"
+    assert EncryptedBook.exists?(name: "Dune")
+  end
+
+  test "If support_unencrypted_data is opted out at the attribute level, cannot find unencrypted data" do
+    UnencryptedBook.create! name: "Dune"
+    assert_nil EncryptedBookWithUnencryptedDataOptedOut.find_by(name: "Dune") # core
+    assert_nil EncryptedBookWithUnencryptedDataOptedOut.where("id > 0").find_by(name: "Dune") # relation
+  end
+
+  test "If support_unencrypted_data is opted out at the attribute level, can find encrypted data" do
+    EncryptedBook.create! name: "Dune"
+    assert EncryptedBookWithUnencryptedDataOptedOut.find_by(name: "Dune") # core
+    assert EncryptedBookWithUnencryptedDataOptedOut.where("id > 0").find_by(name: "Dune") # relation
+  end
+
+  test "If support_unencrypted_data is opted in at the attribute level, can find unencrypted data" do
+    UnencryptedBook.create! name: "Dune"
+    assert EncryptedBookWithUnencryptedDataOptedIn.find_by(name: "Dune") # core
+    assert EncryptedBookWithUnencryptedDataOptedIn.where("id > 0").find_by(name: "Dune") # relation
+  end
+
+  test "If support_unencrypted_data is opted in at the attribute level, can find encrypted data" do
+    EncryptedBook.create! name: "Dune"
+    assert EncryptedBookWithUnencryptedDataOptedIn.find_by(name: "Dune") # core
+    assert EncryptedBookWithUnencryptedDataOptedIn.where("id > 0").find_by(name: "Dune") # relation
+  end
+end

data/test/cases/encryption/helper.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+require "cases/helper"
+
+class ActiveRecord::Fixture
+  prepend ActiveRecord::Encryption::EncryptedFixtures
+end
+
+module ActiveRecord::Encryption
+  module EncryptionHelpers
+    def assert_ciphertext_decrypts_to(model, attribute_name, ciphertext)
+      assert_not_equal model.public_send(attribute_name), ciphertext
+      assert_not_equal model.read_attribute(attribute_name), ciphertext
+      cleartext = model.type_for_attribute(attribute_name).deserialize(ciphertext)
+      assert_equal model.read_attribute(attribute_name), cleartext
+    end
+
+    def assert_encrypted_attribute(model, attribute_name, expected_value)
+      assert_ciphertext_decrypts_to model, attribute_name, model.read_attribute_before_type_cast(attribute_name)
+      assert_equal expected_value, model.public_send(attribute_name)
+      unless model.new_record?
+        model.reload
+        assert_ciphertext_decrypts_to model, attribute_name, model.read_attribute_before_type_cast(attribute_name)
+        assert_equal expected_value, model.public_send(attribute_name)
+      end
+    end
+
+    def assert_invalid_key_cant_read_attribute(model, attribute_name)
+      if model.type_for_attribute(attribute_name).key_provider.respond_to?(:keys=)
+        assert_invalid_key_cant_read_attribute_with_custom_key_provider(model, attribute_name)
+      else
+        assert_invalid_key_cant_read_attribute_with_default_key_provider(model, attribute_name)
+      end
+    end
+
+    def assert_not_encrypted_attribute(model, attribute_name, expected_value)
+      assert_equal expected_value, model.send(attribute_name)
+      assert_equal expected_value, model.read_attribute_before_type_cast(attribute_name)
+    end
+
+    def assert_encrypted_record(model)
+      encrypted_attributes = model.class.encrypted_attributes.find_all { |attribute_name| model.send(attribute_name).present? }
+      assert_not encrypted_attributes.empty?, "The model has no encrypted attributes with content to check (they are all blank)"
+
+      encrypted_attributes.each do |attribute_name|
+        assert_encrypted_attribute model, attribute_name, model.send(attribute_name)
+      end
+    end
+
+    def assert_encryptor_works_with(key_provider)
+      encryptor = ActiveRecord::Encryption::Encryptor.new
+
+      encrypted_message = encryptor.encrypt("some text", key_provider: key_provider)
+      assert_equal "some text", encryptor.decrypt(encrypted_message, key_provider: key_provider)
+    end
+
+    private
+      def build_keys(count = 3)
+        count.times.collect do |index|
+          password = "some secret #{index}"
+          secret = ActiveRecord::Encryption.key_generator.derive_key_from(password)
+          ActiveRecord::Encryption::Key.new(secret)
+        end
+      end
+
+      def with_key_provider(key_provider, &block)
+        ActiveRecord::Encryption.with_encryption_context key_provider: key_provider, &block
+      end
+
+      def with_envelope_encryption(&block)
+        @envelope_encryption_key_provider ||= ActiveRecord::Encryption::EnvelopeEncryptionKeyProvider.new
+        with_key_provider @envelope_encryption_key_provider, &block
+      end
+
+      def create_unencrypted_book_ignoring_case(name:)
+        book = ActiveRecord::Encryption.without_encryption do
+          EncryptedBookThatIgnoresCase.create!(name: name)
+        end
+
+        # Skip type casting to simulate an upcase value. Not supported in AR without using private apis
+        EncryptedBookThatIgnoresCase.lease_connection.execute <<~SQL
+          UPDATE encrypted_books SET name = '#{name}' WHERE id = #{book.id};
+        SQL
+
+        book.reload
+      end
+
+      def assert_invalid_key_cant_read_attribute_with_default_key_provider(model, attribute_name)
+        model.reload
+
+        ActiveRecord::Encryption.with_encryption_context key_provider: ActiveRecord::Encryption::DerivedSecretKeyProvider.new("a different 256 bits key for now") do
+          assert_raises ActiveRecord::Encryption::Errors::Decryption do
+            model.public_send(attribute_name)
+          end
+        end
+      end
+
+      def assert_invalid_key_cant_read_attribute_with_custom_key_provider(model, attribute_name)
+        attribute_type = model.type_for_attribute(attribute_name)
+
+        model.reload
+
+        original_keys = attribute_type.key_provider.keys
+        attribute_type.key_provider.keys = [ ActiveRecord::Encryption::Key.derive_from("other custom attribute secret") ]
+
+        assert_raises ActiveRecord::Encryption::Errors::Decryption do
+          model.public_send(attribute_name)
+        end
+      ensure
+        attribute_type.key_provider.keys = original_keys
+      end
+  end
+end
+
+# We eager load encrypted attribute types as they are declared, so that they pick up the
+# default encryption setup for tests. Because we load those lazily when used, this prevents
+# side effects where some tests modify encryption config settings affecting others.
+#
+# Notice that we clear the declaration listeners when each test start, so this will only affect
+# the classes loaded before tests starts, not those declared during tests.
+ActiveRecord::Encryption.on_encrypted_attribute_declared do |klass, attribute_name|
+  klass.type_for_attribute(attribute_name)
+end
+
+class ActiveRecord::EncryptionTestCase < ActiveRecord::TestCase
+  include ActiveRecord::Encryption::EncryptionHelpers
+
+  ENCRYPTION_PROPERTIES_TO_RESET = {
+    config: %i[ primary_key deterministic_key key_derivation_salt store_key_references hash_digest_class
+      key_derivation_salt support_unencrypted_data encrypt_fixtures
+      forced_encoding_for_deterministic_encryption ],
+    context: %i[ key_provider ]
+  }
+
+  setup do
+    ENCRYPTION_PROPERTIES_TO_RESET.each do |key, properties|
+      properties.each do |property|
+        instance_variable_set "@_original_encryption_#{key}_#{property}", ActiveRecord::Encryption.public_send(key).public_send(property)
+      end
+    end
+    ActiveRecord::Encryption.config.previous_schemes.clear
+    ActiveRecord::Encryption.encrypted_attribute_declaration_listeners&.clear
+  end
+
+  teardown do
+    ENCRYPTION_PROPERTIES_TO_RESET.each do |key, properties|
+      properties.each do |property|
+        ActiveRecord::Encryption.public_send(key).public_send("#{property}=", instance_variable_get("@_original_encryption_#{key}_#{property}"))
+      end
+    end
+  end
+end