lockbox 0.3.2 → 0.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17af286829bd927b3f3dcf156672a4dbced52dcc083d8920a24230cb89f5104a
-  data.tar.gz: 30ec2e0be697c31933b88930c02a43e5544708fe8f847b813a42bd05cd9354dc
+  metadata.gz: 8198d9c7bf3be294c7efc7c7d03abbe64ccf8d487a0a81ad01151b225dbfde92
+  data.tar.gz: dd51f9c1dc06a4cc657fb8b25a05f4a2960a2bce6883fd97dd41d1ac7e426e91
 SHA512:
-  metadata.gz: a2b0cfd5fff48b4907a29d1d67499e3bdb81d29f81c9843fae1f447ecf5dfad5d61bb383877324e6cb35f3aac9987f867f12a4106108fe5bc638f93b6fffe39a
-  data.tar.gz: be8abd51a5f0b8cea3d6cbd18d75bf1248333b9a575a5088b3d36c428fa1103f1645b5ca6b94bbf8dfcf2e9b1d3c31a14bd6f06fe9b9da8c26022bbb78e428c7
+  metadata.gz: fe9c1274693558f3e184b7881f027c0e1ce895aeacd2c222451ea87a61ed7ff1064ed324a2e11a3bf35f60fa3647698ded89574a8c378ef42c0b538fe6606e1c
+  data.tar.gz: 65ea6fb170250edf535692e085700430e4fe25ebca07e63d17de7e2f99afcb0d3089787a4b90c193b3314ae9bcde9540454eae3685a242da1e166c36d2982b19

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.3.3 (2020-02-16)
+
+- Improved performance of `rotate` for attributes with blind indexes
+- Added warning when decrypting previous value fails
+
 ## 0.3.2 (2020-02-14)
 
 - Added `encode` option to `Lockbox::Encryptor`

data/README.md

@@ -176,7 +176,7 @@ end
 
 Finally, drop the unencrypted column.
 
-If adding blind indexes, Lockbox can migrate them at the same time.
+If adding blind indexes, mark them as `migrating` during this process as well.
 
 ```ruby
 class User < ApplicationRecord

data/lib/lockbox/migrator.rb

@@ -13,19 +13,20 @@ module Lockbox
     def rotate(attributes:)
       fields = {}
       attributes.each do |a|
-        # use key instad of v[:attribute] to make it more intuitive when migrating: true
+        # use key instead of v[:attribute] to make it more intuitive when migrating: true
         field = model.lockbox_attributes[a]
         raise ArgumentError, "Bad attribute: #{a}" unless field
         fields[a] = field
       end
 
-      perform(fields: fields)
+      perform(fields: fields, rotate: true)
     end
 
     # TODO add attributes option
     def migrate(restart:)
       fields = model.lockbox_attributes.select { |k, v| v[:migrating] }
 
+      # need blind indexes for building relation
       blind_indexes = model.respond_to?(:blind_indexes) ? model.blind_indexes.select { |k, v| v[:migrating] } : {}
 
       perform(fields: fields, blind_indexes: blind_indexes, restart: restart)
@@ -33,11 +34,14 @@ module Lockbox
 
     private
 
-    def perform(fields:, blind_indexes: [], restart: true)
+    def perform(fields:, blind_indexes: [], restart: true, rotate: false)
       relation = @relation
 
-      # remove true condition in 0.4.0
-      if true || (defined?(ActiveRecord::Base) && base_relation.is_a?(ActiveRecord::Base))
+      # unscope if passed a model
+      unless ar_relation?(relation) || mongoid_relation?(relation)
+        relation = relation.unscoped
+      else
+        # TODO remove in 0.4.0
         relation = relation.unscoped
       end
 
@@ -48,7 +52,7 @@ module Lockbox
         attributes = fields.map { |_, v| v[:encrypted_attribute] }
         attributes += blind_indexes.map { |_, v| v[:bidx_attribute] }
 
-        if defined?(ActiveRecord::Relation) && relation.is_a?(ActiveRecord::Relation)
+        if ar_relation?(relation)
           base_relation = relation.unscoped
           or_relation = relation.unscoped
 
@@ -68,7 +72,7 @@ module Lockbox
       end
 
       each_batch(relation) do |records|
-        migrate_records(records, fields: fields, blind_indexes: blind_indexes, restart: restart)
+        migrate_records(records, fields: fields, blind_indexes: blind_indexes, restart: restart, rotate: rotate)
       end
     end
 
@@ -92,27 +96,59 @@ module Lockbox
       end
     end
 
-    def migrate_records(records, fields:, blind_indexes:, restart:)
+    def migrate_records(records, fields:, blind_indexes:, restart:, rotate:)
       # do computation outside of transaction
       # especially expensive blind index computation
-      records.each do |record|
-        fields.each do |k, v|
-          record.send("#{v[:attribute]}=", record.send(k)) if restart || !record.send(v[:encrypted_attribute])
+      if rotate
+        records.each do |record|
+          fields.each do |k, v|
+            # update encrypted attribute directly to skip blind index computation
+            record.send("lockbox_direct_#{k}=", record.send(k))
+          end
         end
-        blind_indexes.each do |k, v|
-          record.send("compute_#{k}_bidx") if restart || !record.send(v[:bidx_attribute])
+      else
+        records.each do |record|
+          if restart
+            fields.each do |k, v|
+              record.send("#{v[:encrypted_attribute]}=", nil)
+            end
+
+            blind_indexes.each do |k, v|
+              record.send("#{v[:bidx_attribute]}=", nil)
+            end
+          end
+
+          fields.each do |k, v|
+            record.send("#{v[:attribute]}=", record.send(k)) unless record.send(v[:encrypted_attribute])
+          end
+
+          # with Blind Index 2.0, bidx_attribute should be already set for each record
+          blind_indexes.each do |k, v|
+            record.send("compute_#{k}_bidx") unless record.send(v[:bidx_attribute])
+          end
         end
       end
 
+      # don't need to save records that went from nil => nil
       records.select! { |r| r.changed? }
 
-      with_transaction do
-        records.each do |record|
-          record.save!(validate: false)
+      if records.any?
+        with_transaction do
+          records.each do |record|
+            record.save!(validate: false)
+          end
         end
       end
     end
 
+    def ar_relation?(relation)
+      defined?(ActiveRecord::Relation) && relation.is_a?(ActiveRecord::Relation)
+    end
+
+    def mongoid_relation?(relation)
+      defined?(Mongoid::Criteria) && relation.is_a?(Mongoid::Criteria)
+    end
+
     def with_transaction
       if @transaction
         @relation.transaction do

data/lib/lockbox/model.rb

@@ -191,22 +191,28 @@ module Lockbox
           end
 
           define_method("#{name}=") do |message|
-            original_message = message
-
             # decrypt first for dirty tracking
             # don't raise error if can't decrypt previous
             begin
               send(name)
             rescue Lockbox::DecryptionError
+              # this is expected for hybrid cryptography
+              warn "[lockbox] Decrypting previous value failed" unless options[:algorithm] == "hybrid"
               nil
             end
 
-            # set ciphertext
+            send("lockbox_direct_#{name}=", message)
+
+            super(message)
+          end
+
+          # separate method for setting directly
+          # used to skip blind indexes for key rotation
+          define_method("lockbox_direct_#{name}=") do |message|
             ciphertext = self.class.send(encrypt_method_name, message, context: self)
             send("#{encrypted_attribute}=", ciphertext)
-
-            super(original_message)
           end
+          private :"lockbox_direct_#{name}="
 
           define_method(name) do
             message = super()

data/lib/lockbox/version.rb

@@ -1,3 +1,3 @@
 module Lockbox
-  VERSION = "0.3.2"
+  VERSION = "0.3.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lockbox
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.3.3
 platform: ruby
 authors:
 - Andrew Kane
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-02-14 00:00:00.000000000 Z
+date: 2020-02-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler