kinko 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 816a9f7595eccbf358a03ec748a0ee6ba723bc81f7292ae589bd3b1954605285
-  data.tar.gz: ce1314b805ed12a494f84c412e638db9448423fffcab89699aaadc876c2c1080
+  metadata.gz: 5d6413d3fb6b1ba4f284e00e196f4e16f8fda53530319167c38fd19b9013e61b
+  data.tar.gz: '0439b767ef534a75c26e7d447c329109f0e04d0a608b8a28ac3778268194855b'
 SHA512:
-  metadata.gz: c988acbeae16dea88a9c3a9151a5da080ea38f7e596d74d901a290231aca38e5d8c4b06dae22009e59022d7f9de3916a26f9e4a8a1894c2d5ef9acc0306ef4c1
-  data.tar.gz: 191ff65897bacae44081edd2a42c7abe15409ea45912fb0e2021a7343e5608be65a6f7f835607bc38a000751a0bc5c766011845f92354f026b157df70a02d0a6
+  metadata.gz: 770a82c50f7ec3e53b8e87220513579e045f5bb59d62d27011177900673efe34c3fe347ff75c9234dd7dea3b75dae7c14ff07fd633cf69d92e87f830443811d5
+  data.tar.gz: 6b27841c3c7a906fbf513db3b6304f8a979ac598612f106e9e2662d40355b51160c0d8ec12760e372205d2c2207da25b9a82d2de5a91ef0b797033bd8fb98fbe

data/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.0
+
+### Added
+
+- ROM adapter (`kinko/adapters/rom`): relation plugin (`use :kinko` with a
+  `kinko { encrypt ...; blind_index ... }` block) that encrypts on
+  `command(:create/:update)` and decrypts on read, plus
+  `blind_index_for(column, value)` for lookups. Also
+  `Kinko::Adapters::ROM::Types.encrypted` and `.blind_index` schema types and
+  module-level `encrypt` / `decrypt` / `blind_index` helpers for changeset-based
+  flows without the plugin.
+
+### Fixed
+
+- `Kinko::Adapters::ROM::Types.encrypted` now attaches decryption via
+  `meta(read:)` instead of a bidirectional constructor, so ROM's write path no
+  longer runs `Kinko::Cipher.decrypt` on incoming values.
+
 ## v0.1.0
 
 ### Added
@@ -22,10 +40,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `:strip`, `:downcase_strip`, and `:unicode` normalizers, plus any callable.
 - Sequel adapter (`kinko/adapters/sequel`): plugin adding `kinko_encrypt`,
   `kinko_blind_index`, and `blind_index_for(column, value)` to models.
-- ROM adapter (`kinko/adapters/rom`): `Kinko::Adapters::ROM::Types.encrypted`
-  and `.blind_index` schema types for read-side decryption, plus module-level
-  `encrypt` / `decrypt` / `blind_index` helpers for use in changesets and
-  repositories.
 - Active Record adapter (`kinko/adapters/active_record`): concern adding
   `encrypts`, `blind_indexed`, and `blind_index_for(column, value)` to models.
 - `Kinko::Error`, `Kinko::ConfigurationError`, `Kinko::InvalidEnvelope`, and

data/README.md

@@ -1,5 +1,6 @@
 # Kinko
 
+[![CI](https://codeberg.org/fluck/kinko/actions/workflows/ci.yml/badge.svg)](https://codeberg.org/fluck/kinko/actions?workflow=ci.yml)
 [![Version](https://img.shields.io/badge/dynamic/json?url=https%3A%2F%2Fcodeberg.org%2Fapi%2Fv1%2Frepos%2Ffluck%2Fkinko%2Ftags&query=%24%5B0%5D.name&label=version)](https://codeberg.org/fluck/kinko/tags)
 
 Encrypted columns for Ruby with versioned key rotation and optional blind
@@ -37,7 +38,7 @@ into one gem:
 ### [lockbox](https://github.com/ankane/lockbox)
 
 - Frameworks: Active Record, Mongoid
-- AES-GCM + XChaCha20-Poly1305
+- AES-256-GCM/XSalsa20
 - Actively maintained, richer ecosystem
 
 ### [Active Record Encryption](https://guides.rubyonrails.org/active_record_encryption.html)
@@ -90,8 +91,7 @@ string).
 
 > [!NOTE]
 > Keys can be anything you like. It could be `"v1"`, `"v2"`, etc. like in the
-> example above, but also something more self-documenting like `"202607"` for
-> example.
+> example above, but also something more self-documenting like `"202607"`.
 
 ### Encrypt and decrypt directly
 
@@ -191,46 +191,39 @@ one-time tokens).
 Both accept `normalize:` (any of the built-in strategies or a callable).
 `kinko_encrypt` also accepts `type:` for custom class deserialization on read.
 
-### ROM
-
-Reads via a dry-types constructor:
+### ROM (and Hanami)
 
 ```ruby
 require "kinko/adapters/rom"
 
 class Users < ROM::Relation[:sql]
-  schema(:users, infer: true) do
-    attribute :secret_ciphertext, Kinko::Adapters::ROM::Types.encrypted
-    attribute :email_blind_index, Kinko::Adapters::ROM::Types.blind_index
-  end
-end
-```
+  schema(:users, infer: true)
 
-Writes go through a changeset, since ROM's write path is intentionally
-decoupled from the schema:
+  use :kinko
 
-```ruby
-class UserChangeset < ROM::Changeset::Create
-  map do |tuple|
-    tuple.merge(
-      secret_ciphertext: Kinko::Cipher.encrypt(tuple[:secret]),
-      email_blind_index: Kinko::BlindIndex.compute(tuple[:email], normalize: :downcase_strip)
-    )
+  kinko do
+    encrypt     :email,         to: :email_ciphertext,
+                                index: :email_blind_index,
+                                normalize: :downcase_strip
+    blind_index :recovery_code, to: :recovery_blind_index,
+                                normalize: :downcase
   end
 end
-```
 
-Or directly from a repository:
+users.command(:create).call(email: "hi@moi.com", recovery_code: "abc123")
+users.first[:email_ciphertext] # => "hi@moi.com"
 
-```ruby
-class UserRepo < ROM::Repository[:users]
-  def by_email(email)
-    digest = Kinko::BlindIndex.compute(email, normalize: :downcase_strip)
-    users.where(email_blind_index: digest).one
-  end
-end
+digest = Users.blind_index_for(:email_blind_index, "HI@moi.com")
+users.where(email_blind_index: digest).one
 ```
 
+The plugin hooks `command(:create/:update)` and `each`. Bypassing those
+(e.g. `users.insert`) writes plaintext.
+
+For explicit changeset-based encryption without the plugin, use
+`Kinko::Adapters::ROM::Types.encrypted` for reads and `Kinko::Cipher` /
+`Kinko::BlindIndex` for writes.
+
 ### Active Record
 
 ```ruby

data/lib/kinko/adapters/rom/plugin.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require "rom"
+require "kinko"
+
+module Kinko
+  module Adapters
+    module ROM
+      module Plugin
+        class Config
+          Encrypted = Struct.new(:source, :to, :index, :normalize, :type, keyword_init: true)
+          Indexed   = Struct.new(:source, :to, :normalize, keyword_init: true)
+
+          attr_reader :encrypted, :indexed, :normalizers
+
+          def initialize
+            @encrypted = []
+            @indexed = []
+            @normalizers = {}
+          end
+
+          def encrypt(source, to:, index: nil, normalize: :none, type: nil)
+            @encrypted << Encrypted.new(source:, to:, index:, normalize:, type:)
+            @normalizers[index] = normalize if index
+          end
+
+          def blind_index(source, to:, normalize: :none)
+            @indexed << Indexed.new(source:, to:, normalize:)
+            @normalizers[to] = normalize
+          end
+
+          def encrypt_input(tuple)
+            result = tuple.to_h.dup
+            @encrypted.each { apply_encrypt(_1, result) if result.key?(_1.source) }
+            @indexed.each { apply_index(_1, result) if result.key?(_1.source) }
+            result
+          end
+
+          def decrypt_output(tuple)
+            result = tuple.to_h.dup
+            @encrypted.each { apply_decrypt(_1, result) if result.key?(_1.to) }
+            result
+          end
+
+          private
+
+          def apply_encrypt(entry, result)
+            if value = result.delete(entry.source)
+              result[entry.to] = Kinko::Cipher.encrypt(value)
+              return unless entry.index
+
+              result[entry.index] = Kinko::BlindIndex.compute(value, normalize: entry.normalize)
+            else
+              result[entry.to] = nil
+              result[entry.index] = nil if entry.index
+            end
+          end
+
+          def apply_index(entry, result)
+            if value = result.delete(entry.source)
+              result[entry.to] = Kinko::BlindIndex.compute(value, normalize: entry.normalize)
+            else
+              result[entry.to] = nil
+            end
+          end
+
+          def apply_decrypt(entry, result)
+            if envelope = result[entry.to]
+              result[entry.to] = Kinko::Cipher.decrypt(envelope, type: entry.type)
+            else
+              result[entry.to] = nil
+            end
+          end
+        end
+
+        module ClassMethods
+          def kinko(&block)
+            @kinko_config ||= Config.new
+            @kinko_config.instance_eval(&block) if block
+            @kinko_config
+          end
+
+          attr_reader :kinko_config
+
+          def blind_index_for(column, value)
+            registry = kinko_config&.normalizers || {}
+            normalize = registry.fetch(column) do
+              raise ArgumentError, "no blind index registered for #{column.inspect}"
+            end
+            Kinko::BlindIndex.compute(value, normalize:)
+          end
+        end
+
+        module InstanceMethods
+          def command(type, **)
+            cmd = super
+            config = self.class.kinko_config
+            return cmd unless config && %i[create update].include?(type)
+
+            base_input = cmd.input
+            cmd.with(input: ->(tuple) { base_input[config.encrypt_input(tuple)] })
+          end
+
+          def each(&block)
+            config = self.class.kinko_config
+            return super unless config && block_given?
+
+            super { block.call(config.decrypt_output(_1)) }
+          end
+        end
+
+        def self.apply(relation, **)
+          relation.extend(ClassMethods)
+          relation.include(InstanceMethods)
+        end
+      end
+    end
+  end
+end
+
+ROM.plugins do
+  register :kinko, Kinko::Adapters::ROM::Plugin, type: :relation
+end

data/lib/kinko/adapters/rom.rb

@@ -2,6 +2,7 @@
 
 require "dry/types"
 require "kinko"
+require "kinko/adapters/rom/plugin"
 
 module Kinko
   module Adapters
@@ -11,9 +12,8 @@ module Kinko
 
         def encrypted(type: nil, inner: nil)
           inner ||= type ? Dry::Types["any"].optional : Dry::Types["string"].optional
-          inner.constructor do |value|
-            value.nil? ? nil : Kinko::Cipher.decrypt(value, type:)
-          end
+          read = inner.constructor { _1.nil? ? nil : Kinko::Cipher.decrypt(_1, type:) }
+          inner.meta(read: read)
         end
 
         def blind_index(inner: Dry::Types["string"].optional) = inner

data/lib/kinko/cipher.rb

@@ -45,7 +45,9 @@ module Kinko
     private
 
     def new_cipher(mode, key)
-      OpenSSL::Cipher.new(ALGORITHM).public_send(mode).tap { _1.key = key }
+      cipher = OpenSSL::Cipher.new(ALGORITHM)
+      mode == :encrypt ? cipher.encrypt : cipher.decrypt
+      cipher.tap { _1.key = key }
     end
 
     def envelope(version, bytes)

data/lib/kinko/configuration.rb

@@ -4,13 +4,21 @@ module Kinko
   class Configuration
     KEY_BYTES = 32
 
-    attr_accessor :keys, :key_version
+    attr_reader :keys, :key_version
 
     def initialize
       @keys = {}
       @key_version = nil
     end
 
+    def keys=(mapping)
+      @keys = mapping.to_h { |version, key| [version.to_s, key] }
+    end
+
+    def key_version=(version)
+      @key_version = version&.to_s
+    end
+
     def current_key
       require!
       keys.fetch(key_version)

data/lib/kinko/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Kinko
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kinko
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Wout
@@ -54,6 +54,7 @@ files:
 - lib/kinko.rb
 - lib/kinko/adapters/active_record.rb
 - lib/kinko/adapters/rom.rb
+- lib/kinko/adapters/rom/plugin.rb
 - lib/kinko/adapters/sequel.rb
 - lib/kinko/blind_index.rb
 - lib/kinko/cipher.rb