lockbox 0.4.8 → 0.4.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a560c020c3adf21952f81767ffc9b5b4586784f62d748f484e7bacbd4076a64a
-  data.tar.gz: 59d05b405b4cd46da679ef4f03a53fae03cc78d7cdfe89bab13cd6981b76a4da
+  metadata.gz: 5ad5a754772ecb9d5f0a480cab88a63de9ed2fcfd973eef25f286fcf13da7694
+  data.tar.gz: d38646c9d1aedee2bf12419a24064fa5b01e4ef4cb619e8cb48903c343ec67b1
 SHA512:
-  metadata.gz: 8d6217f47cc9c38ad8cf3db11b2a3a2936950b97f91ea168c5f2e4f8a1d9a5916c832286f08156869fbecf89d05dfc9bd7c4ecade9b9b4384488c936a292a1a6
-  data.tar.gz: 3ddf36244c68b6b0bebad62801366d9827e6bee520717f1d544cfc6a18e798c644a158b68ac295fa87cef45ce5b922f37e89c5e39a5882ccb9fe512e725e778b
+  metadata.gz: 5f6e78e05cb6788ad8188314694846f70c438e3e43f48bdf1e8e6356ac94e64226a3790ebaab6369121d1083d551a7203281979731443cfdb1c611d52a617493
+  data.tar.gz: 30fc406d323dda8abdc0d5138880dc32b862abdd479e623180cf99c2531b466ef5a3be10620c975d0f2aee4b10e17b413cdc1cf21e03aa49ef5c6f0a7757cd82

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## 0.4.9 (2020-10-01)
+
+- Added `key_table` and `key_attribute` options to `previous_versions`
+- Added `encrypted_attribute` option
+- Added support for encrypting empty string
+- Improved `inspect` for models with encrypted attributes
+
 ## 0.4.8 (2020-08-30)
 
 - Added `key_table` and `key_attribute` options

data/README.md

@@ -773,7 +773,9 @@ Lockbox supports a few different ways to set keys for database fields and files.
 
 ### Master Key
 
-By default, the master key is used to generate unique keys for each field/uploader. This technique comes from [CipherSweet](https://ciphersweet.paragonie.com/internals/key-hierarchy). The table name and column/uploader name are both used in this process. You can get an individual key with:
+By default, the master key is used to generate unique keys for each field/uploader. This technique comes from [CipherSweet](https://ciphersweet.paragonie.com/internals/key-hierarchy). The table name and column/uploader name are both used in this process.
+
+You can get an individual key with:
 
 ```ruby
 Lockbox.attribute_key(table: "users", attribute: "email_ciphertext")
@@ -820,10 +822,14 @@ To use a different key for each record, use a symbol:
 ```ruby
 class User < ApplicationRecord
   encrypts :email, key: :some_method
+end
+```
 
-  def some_method
-    # code to get key
-  end
+Or a proc:
+
+```ruby
+class User < ApplicationRecord
+  encrypts :email, key: -> { some_method }
 end
 ```
 
@@ -938,12 +944,6 @@ class User < ApplicationRecord
 end
 ```
 
-or set it globally:
-
-```ruby
-Lockbox.default_options = {encode: false}
-```
-
 ## Compatibility
 
 It’s easy to read encrypted data in another language if needed.

data/lib/lockbox/aes_gcm.rb

@@ -18,9 +18,10 @@ module Lockbox
       # In encryption mode, it must be set after calling #encrypt and setting #key= and #iv=
       cipher.auth_data = associated_data || ""
 
-      ciphertext = cipher.update(message) + cipher.final
+      ciphertext = String.new
+      ciphertext << cipher.update(message) unless message.empty?
+      ciphertext << cipher.final
       ciphertext << cipher.auth_tag
-
       ciphertext
     end
 
@@ -29,7 +30,6 @@ module Lockbox
 
       fail_decryption if nonce.to_s.bytesize != nonce_bytes
       fail_decryption if auth_tag.to_s.bytesize != auth_tag_bytes
-      fail_decryption if ciphertext.to_s.bytesize == 0
 
       cipher = OpenSSL::Cipher.new("aes-256-gcm")
       # do not change order of operations
@@ -43,7 +43,11 @@ module Lockbox
       cipher.auth_data = associated_data || ""
 
       begin
-        cipher.update(ciphertext) + cipher.final
+        if ciphertext.to_s.empty?
+          cipher.final
+        else
+          cipher.update(ciphertext) + cipher.final
+        end
       rescue OpenSSL::Cipher::CipherError
         fail_decryption
       end

data/lib/lockbox/model.rb

@@ -32,11 +32,15 @@ module Lockbox
 
       raise ArgumentError, "Cannot use key_attribute with multiple attributes" if options[:key_attribute] && attributes.size > 1
 
+      original_options = options.dup
+
       attributes.each do |name|
-        # add default options
-        encrypted_attribute = "#{name}_ciphertext"
+        # per attribute options
+        # TODO use a different name
+        options = original_options.dup
 
-        options = options.dup
+        # add default options
+        encrypted_attribute = options.delete(:encrypted_attribute) || "#{name}_ciphertext"
 
         # migrating
         original_name = name.to_sym
@@ -82,6 +86,11 @@ module Lockbox
                 serializable_hash.map do |k,v|
                   "#{k}: #{respond_to?(:attribute_for_inspect) ? attribute_for_inspect(k) : v.inspect}"
                 end
+
+              self.class.lockbox_attributes.map do |_, lockbox_attribute|
+                inspection << "#{lockbox_attribute[:attribute]}: [FILTERED]" if has_attribute?(lockbox_attribute[:encrypted_attribute])
+              end
+
               "#<#{self.class} #{inspection.join(", ")}>"
             end
 
@@ -169,6 +178,7 @@ module Lockbox
           end
 
           raise "Duplicate encrypted attribute: #{original_name}" if lockbox_attributes[original_name]
+          raise "Multiple encrypted attributes use the same column: #{encrypted_attribute}" if lockbox_attributes.any? { |_, v| v[:encrypted_attribute] == encrypted_attribute }
           @lockbox_attributes[original_name] = options
 
           if activerecord

data/lib/lockbox/utils.rb

@@ -29,7 +29,17 @@ module Lockbox
         options[:previous_versions] = options[:previous_versions].dup
         options[:previous_versions].each_with_index do |version, i|
           if !(version[:key] || version[:encryption_key] || version[:decryption_key]) && version[:master_key]
-            options[:previous_versions][i] = version.merge(key: Lockbox.attribute_key(table: table, attribute: attribute, master_key: version.delete(:master_key), encode: false))
+            # could also use key_table and key_attribute from options
+            # when specified, but keep simple for now
+            # also, this change isn't backward compatible
+            key =
+              Lockbox.attribute_key(
+                table: version.delete(:key_table) || table,
+                attribute: version.delete(:key_attribute) || attribute,
+                master_key: version.delete(:master_key),
+                encode: false
+              )
+            options[:previous_versions][i] = version.merge(key: key)
           end
         end
       end

data/lib/lockbox/version.rb

@@ -1,3 +1,3 @@
 module Lockbox
-  VERSION = "0.4.8"
+  VERSION = "0.4.9"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lockbox
 version: !ruby/object:Gem::Version
-  version: 0.4.8
+  version: 0.4.9
 platform: ruby
 authors:
 - Andrew Kane
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-08-31 00:00:00.000000000 Z
+date: 2020-10-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler