ibm_db 5.6.1 → 5.7.0

data/test/cases/encryption/key_generator_test.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+
+class ActiveRecord::Encryption::KeyGeneratorTest < ActiveRecord::EncryptionTestCase
+  setup do
+    @generator = ActiveRecord::Encryption::KeyGenerator.new
+  end
+
+  test "generate_random_key generates random keys with the cipher key length by default" do
+    assert_not_equal @generator.generate_random_key, @generator.generate_random_key
+    assert_equal ActiveRecord::Encryption.cipher.key_length, @generator.generate_random_key.bytesize
+  end
+
+  test "generate_random_key generates random keys with a custom length" do
+    assert_not_equal @generator.generate_random_key(length: 10), @generator.generate_random_key(length: 10)
+    assert_equal 10, @generator.generate_random_key(length: 10).bytesize
+  end
+
+  test "generate_random_hex_key generates random hexadecimal keys with the cipher key length by default" do
+    assert_not_equal @generator.generate_random_hex_key, @generator.generate_random_hex_key
+    assert_equal ActiveRecord::Encryption.cipher.key_length, [ @generator.generate_random_hex_key ].pack("H*").bytesize
+  end
+
+  test "generate_random_hex_key generates random hexadecimal keys with a custom length" do
+    assert_not_equal @generator.generate_random_hex_key(length: 10), @generator.generate_random_hex_key(length: 10)
+    assert_equal 10, [ @generator.generate_random_hex_key(length: 10) ].pack("H*").bytesize
+  end
+
+  test "derive keys using the configured digest algorithm" do
+    assert_derive_key "some secret", digest_class: OpenSSL::Digest::SHA1
+    assert_derive_key "some secret", digest_class: OpenSSL::Digest::SHA256
+  end
+
+  test "derive_key derives a key with from the provided password with the cipher key length by default" do
+    assert_equal @generator.derive_key_from("some password"), @generator.derive_key_from("some password")
+    assert_not_equal @generator.derive_key_from("some password"), @generator.derive_key_from("some other password")
+    assert_equal ActiveRecord::Encryption.cipher.key_length, @generator.derive_key_from("some password").length
+  end
+
+  test "derive_key derives a key with a custom length" do
+    assert_equal @generator.derive_key_from("some password", length: 12), @generator.derive_key_from("some password", length: 12)
+    assert_not_equal @generator.derive_key_from("some password", length: 12), @generator.derive_key_from("some other password", length: 12)
+    assert_equal 12, @generator.derive_key_from("some password", length: 12).length
+  end
+
+  private
+    def assert_derive_key(secret, digest_class: OpenSSL::Digest::SHA256, length: 20)
+      expected_derived_key = ActiveSupport::KeyGenerator.new(secret, hash_digest_class: digest_class)
+                                                        .generate_key(ActiveRecord::Encryption.config.key_derivation_salt, length)
+      assert_equal length, expected_derived_key.length
+      ActiveRecord::Encryption.config.hash_digest_class = digest_class
+      assert_equal expected_derived_key, ActiveRecord::Encryption::KeyGenerator.new(hash_digest_class: digest_class).derive_key_from(secret, length: length)
+    end
+end

data/test/cases/encryption/key_provider_test.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+
+class ActiveRecord::Encryption::KeyProviderTest < ActiveRecord::EncryptionTestCase
+  setup do
+    @message ||= ActiveRecord::Encryption::Message.new(payload: "some secret")
+    @keys = build_keys(3)
+    @key_provider = ActiveRecord::Encryption::KeyProvider.new(@keys)
+  end
+
+  test "serves a single key for encrypting and decrypting" do
+    key = @keys.first
+    key_provider = ActiveRecord::Encryption::KeyProvider.new(key)
+
+    assert_equal key, key_provider.encryption_key
+    assert_equal [ key_provider.encryption_key ], key_provider.decryption_keys(@message)
+  end
+
+  test "serves the last key for encrypting" do
+    assert_equal @keys.last, @key_provider.encryption_key
+  end
+
+  test "when store_key_references is false, the encryption key contains a reference to the key itself" do
+    assert_nil @key_provider.encryption_key.public_tags.encrypted_data_key_id
+  end
+
+  test "when store_key_references is true, the encryption key contains a reference to the key itself" do
+    ActiveRecord::Encryption.config.store_key_references = true
+
+    assert_equal @keys.last.id, @key_provider.encryption_key.public_tags.encrypted_data_key_id
+  end
+
+  test "when the message does not contain any key reference, it returns all the keys" do
+    assert_equal @keys, @key_provider.decryption_keys(@message)
+  end
+
+  test "when the message to decrypt contains a reference to the key id, it will return an array only with that message" do
+    target_key = @keys[1]
+
+    @message.headers.encrypted_data_key_id = target_key.id
+
+    assert_equal [target_key], @key_provider.decryption_keys(@message)
+  end
+
+  test "work with multiple keys when config.store_key_references is false" do
+    ActiveRecord::Encryption.config.store_key_references = false
+
+    assert_encryptor_works_with @key_provider
+  end
+
+  test "work with multiple keys when config.store_key_references is true" do
+    ActiveRecord::Encryption.config.store_key_references = true
+
+    assert_encryptor_works_with @key_provider
+  end
+end

data/test/cases/encryption/key_test.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+
+class ActiveRecord::Encryption::KeyTest < ActiveRecord::EncryptionTestCase
+  test "A key can store a secret and public tags" do
+    key = ActiveRecord::Encryption::Key.new("the secret")
+    key.public_tags[:key] = "the key reference"
+
+    assert_equal "the secret", key.secret
+    assert_equal "the key reference", key.public_tags[:key]
+  end
+
+  test ".derive_from instantiates a key with its secret derived from the passed password" do
+    assert_equal ActiveRecord::Encryption.key_generator.derive_key_from("some password"), ActiveRecord::Encryption::Key.derive_from("some password").secret
+  end
+end

data/test/cases/encryption/message_pack_message_serializer_test.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+require "base64"
+require "active_record/encryption/message_pack_message_serializer"
+
+class ActiveRecord::Encryption::MessagePackMessageSerializerTest < ActiveRecord::EncryptionTestCase
+  setup do
+    @serializer = ActiveRecord::Encryption::MessagePackMessageSerializer.new
+  end
+
+  test "serializes messages" do
+    message = build_message
+    deserialized_message = serialize_and_deserialize(message)
+    assert_equal message, deserialized_message
+  end
+
+  test "serializes messages with nested messages in their headers" do
+    message = build_message
+    message.headers[:other_message] = ActiveRecord::Encryption::Message.new(payload: "some other secret payload", headers: { some_header: "some other value" })
+
+    deserialized_message = serialize_and_deserialize(message)
+    assert_equal message, deserialized_message
+  end
+
+  test "detects random data and raises a decryption error" do
+    assert_raises ActiveRecord::Encryption::Errors::Decryption do
+      @serializer.load "hey there"
+    end
+  end
+
+  test "detects random JSON hashes and raises a decryption error" do
+    assert_raises ActiveRecord::Encryption::Errors::Decryption do
+      @serializer.load JSON.dump({ some: "other data" })
+    end
+  end
+
+  test "raises a TypeError when trying to deserialize other data types" do
+    assert_raises TypeError do
+      @serializer.load(:it_can_only_deserialize_strings)
+    end
+  end
+
+  test "raises ForbiddenClass when trying to serialize other data types" do
+    assert_raises ActiveRecord::Encryption::Errors::ForbiddenClass do
+      @serializer.dump("it can only serialize messages!")
+    end
+  end
+
+  test "raises Decryption when trying to parse message with more than one nested message" do
+    message = build_message
+    message.headers[:other_message] = ActiveRecord::Encryption::Message.new(payload: "some other secret payload", headers: { some_header: "some other value" })
+    message.headers[:other_message].headers[:yet_another_message] = ActiveRecord::Encryption::Message.new(payload: "yet some other secret payload", headers: { some_header: "yet some other value" })
+
+    assert_raises ActiveRecord::Encryption::Errors::Decryption do
+      serialize_and_deserialize(message)
+    end
+  end
+
+  private
+    def build_message
+      payload = "some payload"
+      headers = { key_1: "1" }
+      ActiveRecord::Encryption::Message.new(payload: payload, headers: headers)
+    end
+
+    def serialize_and_deserialize(message, with: @serializer)
+      @serializer.load @serializer.dump(message)
+    end
+end

data/test/cases/encryption/message_serializer_test.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+require "base64"
+
+class ActiveRecord::Encryption::MessageSerializerTest < ActiveRecord::EncryptionTestCase
+  setup do
+    @serializer = ActiveRecord::Encryption::MessageSerializer.new
+  end
+
+  test "serializes messages" do
+    message = build_message
+    deserialized_message = serialize_and_deserialize(message)
+    assert_equal message, deserialized_message
+  end
+
+  test "serializes messages with nested messages in their headers" do
+    message = build_message
+    message.headers[:other_message] = ActiveRecord::Encryption::Message.new(payload: "some other secret payload", headers: { some_header: "some other value" })
+
+    deserialized_message = serialize_and_deserialize(message)
+    assert_equal message, deserialized_message
+  end
+
+  test "won't load classes from JSON" do
+    class_loading_payload = JSON.dump({ p: ::Base64.strict_encode64("Some payload"), json_class: "MessageSerializerTest::SomeClassThatWillNeverExist" })
+
+    assert_raises(ArgumentError) { JSON.load(class_loading_payload) }
+    assert_nothing_raised { @serializer.load(class_loading_payload) }
+  end
+
+  test "detects random JSON data and raises a decryption error" do
+    assert_raises ActiveRecord::Encryption::Errors::Decryption do
+      @serializer.load JSON.dump("hey there")
+    end
+  end
+
+  test "detects random JSON hashes and raises a decryption error" do
+    assert_raises ActiveRecord::Encryption::Errors::Decryption do
+      @serializer.load JSON.dump({ some: "other data" })
+    end
+  end
+
+  test "detects JSON hashes with a 'p' key that is not encoded in base64" do
+    assert_raises ActiveRecord::Encryption::Errors::Encoding do
+      @serializer.load JSON.dump({ p: "some data not encoded" })
+    end
+  end
+
+  test "raises a TypeError when trying to deserialize other data types" do
+    assert_raises TypeError do
+      @serializer.load(:it_can_only_deserialize_strings)
+    end
+  end
+
+  test "raises ForbiddenClass when trying to serialize other data types" do
+    assert_raises ActiveRecord::Encryption::Errors::ForbiddenClass do
+      @serializer.dump("it can only serialize messages!")
+    end
+  end
+
+  test "raises Decryption when trying to parse message with more than one nested message" do
+    message = build_message
+    message.headers[:other_message] = ActiveRecord::Encryption::Message.new(payload: "some other secret payload", headers: { some_header: "some other value" })
+    message.headers[:other_message].headers[:yet_another_message] = ActiveRecord::Encryption::Message.new(payload: "yet some other secret payload", headers: { some_header: "yet some other value" })
+
+    assert_raises ActiveRecord::Encryption::Errors::Decryption do
+      serialize_and_deserialize(message)
+    end
+  end
+
+  private
+    def build_message
+      payload = "some payload"
+      headers = { key_1: "1" }
+      ActiveRecord::Encryption::Message.new(payload: payload, headers: headers)
+    end
+
+    def serialize_and_deserialize(message, with: @serializer)
+      @serializer.load @serializer.dump(message)
+    end
+end

data/test/cases/encryption/message_test.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+
+class ActiveRecord::Encryption::MessageTest < ActiveRecord::EncryptionTestCase
+  test "add_header lets you add headers" do
+    message = ActiveRecord::Encryption::Message.new
+    message.headers[:header_1] = "value 1"
+
+    assert_equal "value 1", message.headers[:header_1]
+  end
+
+  test "add_headers lets you add multiple headers" do
+    message = ActiveRecord::Encryption::Message.new
+    message.headers.add(header_1: "value 1", header_2: "value 2")
+    assert_equal "value 1", message.headers[:header_1]
+    assert_equal "value 2", message.headers[:header_2]
+  end
+
+  test "headers can't be overridden" do
+    message = ActiveRecord::Encryption::Message.new
+    message.headers.add(header_1: "value 1")
+
+    assert_raises(ActiveRecord::Encryption::Errors::EncryptedContentIntegrity) do
+      message.headers.add(header_1: "value 1")
+    end
+
+    assert_raises(ActiveRecord::Encryption::Errors::EncryptedContentIntegrity) do
+      message.headers.add(header_1: "value 1")
+    end
+  end
+
+  test "validates that payloads are either nil or strings" do
+    assert_raises ActiveRecord::Encryption::Errors::ForbiddenClass do
+      ActiveRecord::Encryption::Message.new(payload: Date.new)
+      ActiveRecord::Encryption::Message.new(payload: [])
+    end
+
+    ActiveRecord::Encryption::Message.new
+    ActiveRecord::Encryption::Message.new(payload: "")
+    ActiveRecord::Encryption::Message.new(payload: "Some payload")
+  end
+end

data/test/cases/encryption/null_encryptor_test.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+
+class ActiveRecord::Encryption::NullEncryptorTest < ActiveRecord::EncryptionTestCase
+  setup do
+    @encryptor = ActiveRecord::Encryption::NullEncryptor.new
+  end
+
+  test "encrypt returns the passed data" do
+    assert_equal "Some data", @encryptor.encrypt("Some data")
+  end
+
+  test "decrypt returns the passed data" do
+    assert_equal "Some data", @encryptor.decrypt("Some data")
+  end
+
+  test "encrypted? returns false" do
+    assert_not @encryptor.encrypted?("Some data")
+  end
+end

data/test/cases/encryption/properties_test.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+
+class ActiveRecord::EncryptionPropertiesTest < ActiveRecord::EncryptionTestCase
+  setup do
+    @properties = ActiveRecord::Encryption::Properties.new
+  end
+
+  test "behaves like a hash" do
+    @properties[:key_1] = "value 1"
+    @properties[:key_2] = "value 2"
+
+    assert_equal "value 1", @properties[:key_1]
+    assert_equal "value 2", @properties[:key_2]
+  end
+
+  test "defines custom accessors for some default properties" do
+    auth_tag = "some auth tag"
+
+    @properties.auth_tag = auth_tag
+    assert_equal auth_tag, @properties.auth_tag
+    assert_equal auth_tag, @properties[:at]
+  end
+
+  test "raises EncryptedContentIntegrity when trying to override properties" do
+    @properties[:key_1] = "value 1"
+
+    assert_raises ActiveRecord::Encryption::Errors::EncryptedContentIntegrity do
+      @properties[:key_1] = "value 1"
+    end
+  end
+
+  test "add will add all the properties passed" do
+    @properties.add(key_1: "value 1", key_2: "value 2")
+
+    assert_equal "value 1", @properties[:key_1]
+    assert_equal "value 2", @properties[:key_2]
+  end
+
+  test "validate allowed types on creation" do
+    example_of_valid_values.each do |value|
+      ActiveRecord::Encryption::Properties.new(some_value: value)
+    end
+
+    assert_raises ActiveRecord::Encryption::Errors::ForbiddenClass do
+      ActiveRecord::Encryption::Properties.new(my_class: MyClass.new)
+    end
+  end
+
+  test "validate allowed_types setting headers" do
+    example_of_valid_values.each.with_index do |value, index|
+      @properties["some_value_#{index}"] = value
+    end
+
+    assert_raises ActiveRecord::Encryption::Errors::ForbiddenClass do
+      @properties["some_value"] = MyClass.new
+    end
+  end
+
+  MyClass = Struct.new(:some_value)
+
+  class EncryptionMessageSubClass < ActiveRecord::Encryption::Message
+  end
+
+  def example_of_valid_values
+    ["a string", 123, 123.5, true, false, nil, :a_symbol, ActiveRecord::Encryption::Message.new, EncryptionMessageSubClass.new]
+  end
+end

data/test/cases/encryption/read_only_null_encryptor_test.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+
+class ActiveRecord::Encryption::ReadOnlyNullEncryptorTest < ActiveRecord::EncryptionTestCase
+  setup do
+    @encryptor = ActiveRecord::Encryption::ReadOnlyNullEncryptor.new
+  end
+
+  test "decrypt returns the encrypted message" do
+    assert_equal "some text", @encryptor.decrypt("some text")
+  end
+
+  test "encrypt raises an Encryption" do
+    assert_raises ActiveRecord::Encryption::Errors::Encryption do
+      @encryptor.encrypt("some text")
+    end
+  end
+end

data/test/cases/encryption/scheme_test.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+require "models/book"
+
+class ActiveRecord::Encryption::SchemeTest < ActiveRecord::EncryptionTestCase
+  test "validates config options when using encrypted attributes" do
+    assert_invalid_declaration deterministic: false, ignore_case: true
+    assert_invalid_declaration key: "1234", key_provider: ActiveRecord::Encryption::DerivedSecretKeyProvider.new("my secret")
+    assert_invalid_declaration compress: false, compressor: Zlib
+    assert_invalid_declaration compressor: Zlib, encryptor: ActiveRecord::Encryption::Encryptor.new
+
+    assert_valid_declaration deterministic: true
+    assert_valid_declaration key: "1234"
+    assert_valid_declaration key_provider: ActiveRecord::Encryption::DerivedSecretKeyProvider.new("my secret")
+  end
+
+  test "should create a encryptor well when compressor is given" do
+    MyCompressor = Class.new do
+      def self.deflate(data)
+        "deflated #{data}"
+      end
+
+      def self.inflate(data)
+        data.sub("deflated ", "")
+      end
+    end
+
+    type = declare_encrypts_with compressor: MyCompressor
+
+    assert_equal MyCompressor, type.scheme.to_h[:encryptor].compressor
+  end
+
+  test "should create a encryptor well when compress is false" do
+    type = declare_encrypts_with compress: false
+
+    assert_not type.scheme.to_h[:encryptor].compress?
+  end
+
+  private
+    def assert_invalid_declaration(**options)
+      assert_raises ActiveRecord::Encryption::Errors::Configuration do
+        declare_encrypts_with(options)
+      end
+    end
+
+    def assert_valid_declaration(**options)
+      assert_nothing_raised do
+        declare_encrypts_with(options)
+      end
+    end
+
+    def declare_encrypts_with(options)
+      Class.new(Book) do
+        encrypts :name, **options
+      end.type_for_attribute(:name)
+    end
+end

data/test/cases/encryption/unencrypted_attributes_test.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+require "models/post_encrypted"
+
+class ActiveRecord::Encryption::UnencryptedAttributesTest < ActiveRecord::EncryptionTestCase
+  test "when :support_unencrypted_data is off, it works with unencrypted attributes normally" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = true
+
+    post = ActiveRecord::Encryption.without_encryption { EncryptedPost.create!(title: "The Starfleet is here!", body: "take cover!") }
+    assert_not_encrypted_attribute(post, :title, "The Starfleet is here!")
+
+    # It will encrypt on saving
+    post.update! title: "Other title"
+    assert_encrypted_attribute(post.reload, :title, "Other title")
+  end
+
+  test "when :support_unencrypted_data is on, it won't work with unencrypted attributes" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = false
+
+    post = ActiveRecord::Encryption.without_encryption { EncryptedPost.create!(title: "The Starfleet is here!", body: "take cover!") }
+
+    assert_raises ActiveRecord::Encryption::Errors::Decryption do
+      post.title
+    end
+  end
+end

data/test/cases/encryption/uniqueness_validations_test.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "cases/encryption/helper"
+require "models/book_encrypted"
+require "models/author_encrypted"
+
+class ActiveRecord::Encryption::UniquenessValidationsTest < ActiveRecord::EncryptionTestCase
+  test "uniqueness validations work" do
+    EncryptedBookWithDowncaseName.create!(name: "dune")
+    assert_raises ActiveRecord::RecordInvalid do
+      EncryptedBookWithDowncaseName.create!(name: "dune")
+    end
+  end
+
+  test "uniqueness validations work when mixing encrypted an unencrypted data" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = true
+
+    UnencryptedBook.create! name: "dune"
+    assert_raises ActiveRecord::RecordInvalid do
+      EncryptedBookWithDowncaseName.create!(name: "DUNE")
+    end
+  end
+
+  test "uniqueness validations do not work when mixing encrypted an unencrypted data and unencrypted data is opted out per-attribute" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = true
+
+    UnencryptedBook.create! name: "dune"
+    assert_nothing_raised do
+      EncryptedBookWithUnencryptedDataOptedOut.create!(name: "dune")
+    end
+  end
+
+  test "uniqueness validations work when mixing encrypted an unencrypted data and unencrypted data is opted in per-attribute" do
+    ActiveRecord::Encryption.config.support_unencrypted_data = true
+
+    UnencryptedBook.create! name: "dune"
+    assert_raises ActiveRecord::RecordInvalid do
+      EncryptedBookWithUnencryptedDataOptedIn.create!(name: "dune")
+    end
+  end
+
+  test "uniqueness validations work when using old encryption schemes" do
+    ActiveRecord::Encryption.config.previous = [ { downcase: true, deterministic: true } ]
+
+    OldEncryptionBook = Class.new(UnencryptedBook) do
+      self.table_name = "encrypted_books"
+
+      validates :name, uniqueness: true
+      encrypts :name, deterministic: true, downcase: false
+    end
+
+    OldEncryptionBook.create! name: "dune"
+
+    assert_raises ActiveRecord::RecordInvalid do
+      OldEncryptionBook.create! name: "DUNE"
+    end
+  end
+
+  test "uniqueness validation does not revalidate the attribute with current encryption type" do
+    EncryptedBookWithUniquenessValidation.create!(name: "dune")
+    record = EncryptedBookWithUniquenessValidation.create(name: "dune")
+
+    assert_equal 1, record.errors.count
+  end
+end