kms_rails 0.0.7 → 0.0.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 50c4a8fae51504007b10aea9578510462d5f7f76
-  data.tar.gz: 5971526c22870da12221eb826288e25faf5bbe9d
+  metadata.gz: ae0381169d042f13aa2ca831dd25119dacd0c997
+  data.tar.gz: 3712b105091faaa86de705e9b3f650ad6499e42f
 SHA512:
-  metadata.gz: 238577ab4e0907ab2058cca53c889035712ebeb7f66db77f93d589704a3c5d5a26362532a94303e396da49bbf8fce099c51c356216b4ee1c10f955a25ad934f0
-  data.tar.gz: a5f006982114e6c15240f6a623403a5e2fe926c011f50c9820839b87c3fe70522a394bd5769132b972ce2ebe37b51032131f00c06e25ec34e016952fad9afcd7
+  metadata.gz: c82db1ac70270f44ca500ccdf2ca6cbcc1951264acd8a1084881868fbaf5c1153b26e0a1cab3ad25bacaa0250ac16c49b50b118aa438ca6956f6d70446e671af
+  data.tar.gz: 1c7eb6c7afaa2241dde30efd65a43526ff396f00679a316ed3a31572db72dd55d3d2ce617616b69812770e5c3ed831e182c57622ec419d388ccbb9eb0a88b674

data/README.md

@@ -78,9 +78,13 @@ Encryption is done when the job is seralized into the data store and is stored a
 
 The encryption is automatically reversed when the job is deserialized.
 
+### Data Serialization
+
+Like kms_attr above, by default your encrypted kms_args values are converted to and from strings. Similarly, you can set `msgpack: true` to enable msgpack serialization and deserialization for arguments instead.
+
 ### Already encrypted parameters
 
-You also have the option of passing the value from your ActiveRecord encrypted field directly into the ActiveJob. If you do this, the value will not be encrypted twice. However, if you do this, you must ensure that the encryption key ID is the same for both the ActiveRecord attribute and ActiveJob parameter.
+You also have the option of passing the value from your ActiveRecord encrypted field directly into the ActiveJob. If you do this, the value will not be encrypted twice. However, if you do this, you must ensure that the encryption key ID is the same for both the ActiveRecord attribute and ActiveJob parameter. It is also wise to use the same `msgpack: ` configuration options for both instances to ensure it is correctly decoded.
 
 For instance, if you want to enqueue an encrypted value into a job on a node that cannot decrypt that value, you could do something like this;
 

data/lib/kms_rails/active_job.rb

@@ -1,3 +1,4 @@
+require 'msgpack'
 require 'active_job'
 require 'kms_rails/core'
 
@@ -10,12 +11,12 @@ module KmsRails
     end
     
     module ClassMethods
-      def kms_arg(field_number, key_id:, context_key: nil, context_value: nil)
-        kms_args([field_number], key_id: key_id, context_key: context_key, context_value: context_value)
+      def kms_arg(field_number, key_id:, msgpack: false, context_key: nil, context_value: nil)
+        kms_args([field_number], key_id: key_id, msgpack: msgpack, context_key: context_key, context_value: context_value)
       end
 
-      def kms_args(field_numbers, key_id:, context_key: nil, context_value: nil)
-        enc = Core.new(key_id: key_id, context_key: context_key, context_value: context_value)
+      def kms_args(field_numbers, key_id:, msgpack: false, context_key: nil, context_value: nil)
+        enc = Core.new(key_id: key_id, context_key: context_key, msgpack: msgpack, context_value: context_value)
 
         define_method 'serialize_arguments' do |args|
           args = args.dup

data/lib/kms_rails/active_record.rb

@@ -17,7 +17,7 @@ module KmsRails
         raise RuntimeError, "Field '#{real_field}' must exist to store encrypted data" unless self.column_names.include?(real_field)
         raise RuntimeError, "Field '#{field}' must not be a real column, '#{real_field}' is the real column" if self.column_names.include?(field)
         
-        enc = Core.new(key_id: key_id, context_key: context_key, context_value: context_value)
+        enc = Core.new(key_id: key_id, msgpack: msgpack, context_key: context_key, context_value: context_value)
 
         define_method "#{field}=" do |data|
           if data.nil? # Just set to nil if nil
@@ -27,8 +27,6 @@ module KmsRails
           end
 
           set_retained(field, data) if retain
-          data = data.to_msgpack if msgpack
-
           encrypted_data = enc.encrypt(data)
           data = nil
           
@@ -47,7 +45,6 @@ module KmsRails
             plaintext
           else
             plaintext = enc.decrypt(hash)
-            plaintext = MessagePack.unpack(plaintext) if msgpack
             set_retained(field, plaintext) if retain
             plaintext
           end

data/lib/kms_rails/core.rb

@@ -1,5 +1,6 @@
 require 'base64'
 require 'openssl'
+require 'msgpack'
 require 'aws-sdk'
 require 'kms_rails/configuration'
 
@@ -7,16 +8,18 @@ module KmsRails
   class Core
     attr_reader :context_key, :context_value
 
-    def initialize(key_id:, context_key: nil, context_value: nil)
+    def initialize(key_id:, msgpack: false, context_key: nil, context_value: nil)
       @base_key_id = key_id
       @context_key = context_key
       @context_value = context_value
+      @msgpack = msgpack
     end
 
     def encrypt(data)
       return nil if data.nil?
 
       data_key = aws_generate_data_key(key_id)
+      data = data.to_msgpack if @msgpack
       encrypted = encrypt_attr(data, data_key.plaintext)
 
       self.class.shred_string(data_key.plaintext)
@@ -36,11 +39,15 @@ module KmsRails
 
     def decrypt(data_obj)
       return nil if data_obj.nil?
-      decrypt_attr(
+
+      decrypted = decrypt_attr(
         data_obj['blob'], 
         aws_decrypt_key(data_obj['key']),
         data_obj['iv']
       )
+      
+      decrypted = MessagePack.unpack(decrypted) if @msgpack
+      decrypted
     end
     
     def decrypt64(data_obj)

data/lib/kms_rails/version.rb

@@ -1,3 +1,3 @@
 module KmsRails
-  VERSION = "0.0.7"
+  VERSION = "0.0.8"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kms_rails
 version: !ruby/object:Gem::Version
-  version: 0.0.7
+  version: 0.0.8
 platform: ruby
 authors:
 - Ash Tyndall
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-12-20 00:00:00.000000000 Z
+date: 2016-12-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord