kms_rails 0.0.7 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 50c4a8fae51504007b10aea9578510462d5f7f76
-  data.tar.gz: 5971526c22870da12221eb826288e25faf5bbe9d
+SHA256:
+  metadata.gz: 0d44686b36dbb45a7fc0555c8376b39135cf40ee834c3382fadd88c274dda6a0
+  data.tar.gz: 8902378d8c6915ecc383057b54a2ca6f72fa7b7ff8f43d74f990c48170ed9c89
 SHA512:
-  metadata.gz: 238577ab4e0907ab2058cca53c889035712ebeb7f66db77f93d589704a3c5d5a26362532a94303e396da49bbf8fce099c51c356216b4ee1c10f955a25ad934f0
-  data.tar.gz: a5f006982114e6c15240f6a623403a5e2fe926c011f50c9820839b87c3fe70522a394bd5769132b972ce2ebe37b51032131f00c06e25ec34e016952fad9afcd7
+  metadata.gz: cfe253f5456a8271240090c2cd631c1d27050e62388d005534114286f5969e575c08c49644d26ee0ed104c97b73c6f9ee08cf58f315a0bbb54f7aaca59f7a244
+  data.tar.gz: febb5eab0f7a4c80168d38fcc70be634fbcb472d3b85b080017e94d9622b4719e5b2f7df15ddb19790c7517c45844e168bb2a79459a8bce93aa8f86e26472d86

data/.codeclimate.yml

@@ -1,9 +1,9 @@
 ---
 engines:
   brakeman:
-    enabled: true
+    enabled: false
   bundler-audit:
-    enabled: true
+    enabled: false
   duplication:
     enabled: true
     config:

data/.travis.yml

@@ -1,15 +1,18 @@
+env:
+  global:
+    - CC_TEST_REPORTER_ID=156fab7dad33afa6dd4b24ab5721a01e5bbb41c3f07c380195695102b7363e0a
+
 language: ruby
 rvm:
-  - 2.1.0
-  - 2.2.0
-  - 2.3.0
-  
-addons:
-  code_climate:
-    repo_token: 156fab7dad33afa6dd4b24ab5721a01e5bbb41c3f07c380195695102b7363e0a
+  - 2.5
+  - 2.6
+  - 2.7
 
-script: bundle exec rspec spec
-before_install:
- - gem update bundler
-after_success:
-  - bundle exec codeclimate-test-reporter
+before_script:
+  - curl -L https://codeclimate.com/downloads/test-reporter/test-reporter-latest-linux-amd64 > ./cc-test-reporter
+  - chmod +x ./cc-test-reporter
+  - ./cc-test-reporter before-build
+script:
+  - bundle exec rspec spec
+after_script:
+  - ./cc-test-reporter after-build --exit-code $TRAVIS_TEST_RESULT

data/README.md

@@ -1,7 +1,7 @@
 [![Build Status](https://travis-ci.org/appbot/kms_rails.svg)](https://travis-ci.org/appbot/kms_rails)
 [![Code Climate](https://codeclimate.com/github/appbot/kms_rails/badges/gpa.svg)](https://codeclimate.com/github/appbot/kms_rails) [![Test Coverage](https://codeclimate.com/github/appbot/kms_rails/badges/coverage.svg)](https://codeclimate.com/github/appbot/kms_rails/coverage)
 
-#kms_rails
+# kms_rails
 
 kms_rails (based on [kms_attrs](https://github.com/justinoue/kms_attrs)) is a gem for easily adding Amazon Web Services KMS encryption to your ActiveRecord model attributes and ActiveJob arguments. It uses the GenerateDataKey method to perform "envelope" encryption locally with an OpenSSL AES-256-CBC cipher.
 
@@ -78,9 +78,13 @@ Encryption is done when the job is seralized into the data store and is stored a
 
 The encryption is automatically reversed when the job is deserialized.
 
+### Data Serialization
+
+Like kms_attr above, by default your encrypted kms_args values are converted to and from strings. Similarly, you can set `msgpack: true` to enable msgpack serialization and deserialization for arguments instead.
+
 ### Already encrypted parameters
 
-You also have the option of passing the value from your ActiveRecord encrypted field directly into the ActiveJob. If you do this, the value will not be encrypted twice. However, if you do this, you must ensure that the encryption key ID is the same for both the ActiveRecord attribute and ActiveJob parameter.
+You also have the option of passing the value from your ActiveRecord encrypted field directly into the ActiveJob. If you do this, the value will not be encrypted twice. However, if you do this, you must ensure that the encryption key ID is the same for both the ActiveRecord attribute and ActiveJob parameter. It is also wise to use the same `msgpack: ` configuration options for both instances to ensure it is correctly decoded.
 
 For instance, if you want to enqueue an encrypted value into a job on a node that cannot decrypt that value, you could do something like this;
 
@@ -91,7 +95,7 @@ MyImportantJob.perform_later(value)
 
 In this instance, `value` will not be decrypted, nor encrypted twice.
 
-##Additional Options
+## Additional Options
 You can add encryption contexts as strings or procs to kms_attr and kms_arg/args. Default is none.
 ```ruby
 kms_attr :my_attribute, key_id: 'my-aws-kms-key-id',
@@ -101,7 +105,7 @@ kms_attr :my_attribute, key_id: 'my-aws-kms-key-id',
   context_key: Proc.new { }, context_value: Proc.new { }
 ```
 
-##Aws Configuration
+## Aws Configuration
 This gem expects some standard Aws SDK configuration. The Aws client is initiated with no credentials. This should then load credentials either from ENV['AWS_ACCESS_KEY_ID'], ENV['AWS_SECRET_ACCESS_KEY'], `Aws` object, or an IAM role on an EC2 instance.
 
 You can configure your region in a Rails initializer with;
@@ -113,7 +117,7 @@ or by using the documented AWS environmental variables.
 
 ## Test Mode
 
-A basic fake implementation of `Aws::KMS::Client` has been written, allowing kms_rails functionality to be used in test environments without making any web requests. The fake implementation emulates the functionality of the two API calls kms_rails issues to AWS and performs fake encryption (the key is 'encrypted' by reversing it). At this time, the fake implementation does not support contexts.
+A basic fake implementation of `Aws::KMS::Client` has been written, allowing kms_rails functionality to be used in test environments without making any web requests. The fake implementation emulates the functionality of the two API calls kms_rails issues to AWS and performs fake encryption (the key is 'encrypted' by reversing it).
 
 You can enable it in your Rails initializers with the following
 ```ruby
@@ -141,7 +145,7 @@ Directly specifying a key_id as a UUID or with the `alias/` prefix explicitly de
 ## Other stuff
 
 ### Notes
-This gem has been developed against Ruby 2.3.1, Rails 4.2, and AWS SDK v2. Credit where credit is due, strongbox by spikex was used as an inspiration and guide when creating this. https://github.com/spikex/strongbox
+This gem has been developed against Ruby 2.3.1, Rails 4.2, and AWS SDK v3. Credit where credit is due, strongbox by spikex was used as an inspiration and guide when creating this. https://github.com/spikex/strongbox
 
 ### Disclaimer
 No claims are made about enhanced security when using this gem.

data/kms_rails.gemspec

@@ -4,35 +4,34 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'kms_rails/version'
 
 Gem::Specification.new do |spec|
-  spec.name          = "kms_rails"
+  spec.name          = 'kms_rails'
   spec.version       = KmsRails::VERSION
-  spec.authors       = ["Ash Tyndall", "Justin Ouellette"]
-  spec.email         = ["ash@appbot.co"]
+  spec.authors       = ['Ash Tyndall', 'Justin Ouellette']
+  spec.email         = ['ash@appbot.co']
 
   spec.summary       = %q{AWS KMS encryption for ActiveRecord & ActiveJob.}
   spec.description   = %q{Quickly add KMS encryption and decryption to your ActiveRecord model attributes and ActiveJob parameters. Improves upon kms_attrs with ActiveJob support, more efficient binary serialization and a test suite.}
-  spec.homepage      = "https://github.com/appbot/kms_rails"
-  spec.license       = "GPLv3"
+  spec.homepage      = 'https://github.com/appbot/kms_rails'
+  spec.license       = 'GPLv3'
 
   spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
-  spec.bindir        = "exe"
+  spec.bindir        = 'exe'
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
-  spec.required_ruby_version = '>= 2.1'
+  spec.require_paths = ['lib']
+  spec.required_ruby_version = '>= 2.5'
 
-  spec.add_runtime_dependency "activerecord", "~> 4"
-  spec.add_runtime_dependency "activejob", "~> 4"
-  spec.add_runtime_dependency "aws-sdk", "~> 2"
-  spec.add_runtime_dependency "msgpack"
+  spec.add_runtime_dependency 'activerecord', '>= 4'
+  spec.add_runtime_dependency 'activejob', '>= 4'
+  spec.add_runtime_dependency 'aws-sdk-kms', '~> 1'
+  spec.add_runtime_dependency 'msgpack'
 
-  spec.add_development_dependency "bundler", "~> 1.12"
-  spec.add_development_dependency "rake", "~> 10.0"
-  spec.add_development_dependency "rspec"
-  spec.add_development_dependency "rspec-mocks"
-  spec.add_development_dependency "simplecov"
-  spec.add_development_dependency "codeclimate-test-reporter"
-  spec.add_development_dependency "with_model"
-  spec.add_development_dependency "byebug"
-  spec.add_development_dependency "sqlite3"
-  spec.add_development_dependency "database_cleaner"
+  spec.add_development_dependency 'bundler'
+  spec.add_development_dependency 'rake', '>= 12.3.3'
+  spec.add_development_dependency 'rspec'
+  spec.add_development_dependency 'rspec-mocks'
+  spec.add_development_dependency 'simplecov'
+  spec.add_development_dependency 'with_model'
+  spec.add_development_dependency 'byebug'
+  spec.add_development_dependency 'sqlite3'
+  spec.add_development_dependency 'database_cleaner'
 end

data/lib/kms_rails/active_job.rb

@@ -1,3 +1,4 @@
+require 'msgpack'
 require 'active_job'
 require 'kms_rails/core'
 
@@ -10,12 +11,12 @@ module KmsRails
     end
     
     module ClassMethods
-      def kms_arg(field_number, key_id:, context_key: nil, context_value: nil)
-        kms_args([field_number], key_id: key_id, context_key: context_key, context_value: context_value)
+      def kms_arg(field_number, key_id:, msgpack: false, context_key: nil, context_value: nil)
+        kms_args([field_number], key_id: key_id, msgpack: msgpack, context_key: context_key, context_value: context_value)
       end
 
-      def kms_args(field_numbers, key_id:, context_key: nil, context_value: nil)
-        enc = Core.new(key_id: key_id, context_key: context_key, context_value: context_value)
+      def kms_args(field_numbers, key_id:, msgpack: false, context_key: nil, context_value: nil)
+        enc = Core.new(key_id: key_id, context_key: context_key, msgpack: msgpack, context_value: context_value)
 
         define_method 'serialize_arguments' do |args|
           args = args.dup

data/lib/kms_rails/active_record.rb

@@ -14,21 +14,19 @@ module KmsRails
         include InstanceMethods
 
         real_field = "#{field}_enc"
-        raise RuntimeError, "Field '#{real_field}' must exist to store encrypted data" unless self.column_names.include?(real_field)
-        raise RuntimeError, "Field '#{field}' must not be a real column, '#{real_field}' is the real column" if self.column_names.include?(field)
-        
-        enc = Core.new(key_id: key_id, context_key: context_key, context_value: context_value)
+        enc        = Core.new(key_id: key_id, msgpack: msgpack, context_key: context_key, context_value: context_value)
 
         define_method "#{field}=" do |data|
-          if data.nil? # Just set to nil if nil
+          raise RuntimeError, "Field '#{field}' must not be a real column, '#{real_field}' is the real column" if self.class.column_names.include?(field.to_s)
+          raise RuntimeError, "Field '#{real_field}' must exist to store encrypted data" unless self.class.column_names.include?(real_field)
+
+          if data.blank? # Just set to nil if nil
             clear_retained(field)
             self[real_field] = nil
             return 
           end
 
           set_retained(field, data) if retain
-          data = data.to_msgpack if msgpack
-
           encrypted_data = enc.encrypt(data)
           data = nil
           
@@ -36,10 +34,15 @@ module KmsRails
         end
 
         define_method "#{real_field}" do
+          raise RuntimeError, "Field '#{field}' must not be a real column, '#{real_field}' is the real column" if self.class.column_names.include?(field.to_s)
+          raise RuntimeError, "Field '#{real_field}' must exist to retrieve encrypted data" unless self.class.column_names.include?(real_field)
           Core.to64( get_hash(field) )
         end
 
         define_method "#{field}" do
+          raise RuntimeError, "Field '#{field}' must not be a real column, '#{real_field}' is the real column" if self.class.column_names.include?(field.to_s)
+          raise RuntimeError, "Field '#{real_field}' must exist to retrieve decrypted data" unless self.class.column_names.include?(real_field)
+
           hash = get_hash(field)
           return nil unless hash
 
@@ -47,7 +50,6 @@ module KmsRails
             plaintext
           else
             plaintext = enc.decrypt(hash)
-            plaintext = MessagePack.unpack(plaintext) if msgpack
             set_retained(field, plaintext) if retain
             plaintext
           end

data/lib/kms_rails/configuration.rb

@@ -1,23 +1,28 @@
 module KmsRails
-  class << self
-    attr_accessor :configuration
-  end
+  module ConfigurationBase
+    attr_writer :configuration
 
-  def self.configure
-    self.configuration ||= Configuration.new
-    yield(configuration)
-  end
+    class Configuration
+      attr_accessor :fake_kms_api, :alias_prefix
 
-  def self.reset_config
-    self.configuration = Configuration.new
-  end
+      def initialize
+        @fake_kms_api = false
+        @alias_prefix = ''
+      end
+    end
 
-  class Configuration
-    attr_accessor :fake_kms_api, :alias_prefix
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def configure
+      yield(self.configuration)
+    end
 
-    def initialize
-      @fake_kms_api = false
-      @alias_prefix = ''
+    def reset_config
+      @configuration = Configuration.new
     end
   end
-end
+
+  extend ConfigurationBase
+end

data/lib/kms_rails/core.rb

@@ -1,22 +1,25 @@
 require 'base64'
 require 'openssl'
-require 'aws-sdk'
+require 'msgpack'
+require 'aws-sdk-kms'
 require 'kms_rails/configuration'
 
 module KmsRails
   class Core
     attr_reader :context_key, :context_value
 
-    def initialize(key_id:, context_key: nil, context_value: nil)
+    def initialize(key_id:, msgpack: false, context_key: nil, context_value: nil)
       @base_key_id = key_id
       @context_key = context_key
       @context_value = context_value
+      @msgpack = msgpack
     end
 
     def encrypt(data)
       return nil if data.nil?
 
       data_key = aws_generate_data_key(key_id)
+      data = data.to_msgpack if @msgpack
       encrypted = encrypt_attr(data, data_key.plaintext)
 
       self.class.shred_string(data_key.plaintext)
@@ -36,13 +39,17 @@ module KmsRails
 
     def decrypt(data_obj)
       return nil if data_obj.nil?
-      decrypt_attr(
-        data_obj['blob'], 
+
+      decrypted = decrypt_attr(
+        data_obj['blob'],
         aws_decrypt_key(data_obj['key']),
         data_obj['iv']
       )
+
+      decrypted = MessagePack.unpack(decrypted) if @msgpack
+      decrypted
     end
-    
+
     def decrypt64(data_obj)
       return nil if data_obj.nil?
       decrypt( self.class.from64(data_obj) )
@@ -54,7 +61,7 @@ module KmsRails
         @base_key_id.call
       when String
         if @base_key_id =~ /\A\w{8}-\w{4}-\w{4}-\w{4}-\w{12}\z/ || @base_key_id.start_with?('alias/') # if UUID or direct alias
-          @base_key_id 
+          @base_key_id
         else
           'alias/' + KmsRails.configuration.alias_prefix + @base_key_id
         end
@@ -78,7 +85,7 @@ module KmsRails
       data_obj.map { |k,v| [k, Base64.strict_decode64(v)] }.to_h
     end
 
-    private 
+    private
 
     def apply_context(args, key, value)
       if key && value
@@ -116,7 +123,7 @@ module KmsRails
 
     def aws_decrypt_key(key)
       args = {ciphertext_blob: key}
-      aws_kms.decrypt(apply_context(args, @context_key, @context_value)).plaintext
+      aws_kms.decrypt(**apply_context(args, @context_key, @context_value)).plaintext
     end
 
     def aws_kms
@@ -126,7 +133,7 @@ module KmsRails
 
     def aws_generate_data_key(key_id)
       args = {key_id: key_id, key_spec: 'AES_256'}
-      aws_kms.generate_data_key(apply_context(args, @context_key, @context_value))
+      aws_kms.generate_data_key(**apply_context(args, @context_key, @context_value))
     end
   end
-end
+end

data/lib/kms_rails/kms_client_mock.rb

@@ -1,4 +1,4 @@
-require 'aws-sdk'
+require 'aws-sdk-kms'
 require 'msgpack'
 
 module KmsRails

data/lib/kms_rails/version.rb

@@ -1,3 +1,3 @@
 module KmsRails
-  VERSION = "0.0.7"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,58 +1,58 @@
 --- !ruby/object:Gem::Specification
 name: kms_rails
 version: !ruby/object:Gem::Version
-  version: 0.0.7
+  version: 0.2.1
 platform: ruby
 authors:
 - Ash Tyndall
 - Justin Ouellette
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2016-12-20 00:00:00.000000000 Z
+date: 2020-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4'
 - !ruby/object:Gem::Dependency
   name: activejob
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '4'
 - !ruby/object:Gem::Dependency
-  name: aws-sdk
+  name: aws-sdk-kms
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2'
+        version: '1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2'
+        version: '1'
 - !ruby/object:Gem::Dependency
   name: msgpack
   requirement: !ruby/object:Gem::Requirement
@@ -71,30 +71,30 @@ dependencies:
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.12'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.12'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: 12.3.3
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -137,20 +137,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: codeclimate-test-reporter
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: with_model
   requirement: !ruby/object:Gem::Requirement
@@ -238,7 +224,7 @@ homepage: https://github.com/appbot/kms_rails
 licenses:
 - GPLv3
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -246,16 +232,16 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.1'
+      version: '2.5'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.5.1
-signing_key: 
+rubyforge_project:
+rubygems_version: 2.7.9
+signing_key:
 specification_version: 4
 summary: AWS KMS encryption for ActiveRecord & ActiveJob.
 test_files: []