mongoid-kms 0.0.14 → 0.0.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 49b32845a5b6f1ca1f9d205d59915df58e7425e1
-  data.tar.gz: 1c9dbdf7f83534f9b1f94d7e1e03e83d1aef930f
+  metadata.gz: 029a4f6efe9f5dafce5aef2c5fab0801229f04cc
+  data.tar.gz: 749be3c2641a52cebab3d4f7f2e8d1491a765649
 SHA512:
-  metadata.gz: 85e1bf962a3660b1bd10f844c117383fb590c8777f5575e012fa1cb85a9526ef822d0c9d4066862301928fdb696009faf92ed6c7a8b86dd07387f598cf47580f
-  data.tar.gz: dd9bfa5812eccc83711c2c39538558e39a4f9950af12ee93c73cdba7d370b3acb1e8cc36cd2b8ea4a97783033b21b8ef93ea483355a6d7332a6828c2b8c62205
+  metadata.gz: b1386752d377273539f4f06130d820316d7398e10aac8303b7794d84015c95213b2ad5d909ff64a77516a5491f2f9878c04957d78888f93dcc5c36808eac8f27
+  data.tar.gz: 759ce38aba35b4d9b49401e2b3cb08f64ef4017c832bf7b6608bd09b9caac659228d44517a9a0e0eac480fbdfca5167ee51095cb3245cfb4078656b99b3405bb

data/lib/mongoid/kms/version.rb

@@ -1,5 +1,5 @@
 module Mongoid
 module Kms
-VERSION = "0.0.14"
+VERSION = "0.0.15"
 end
 end

data/lib/mongoid/kms.rb

@@ -6,73 +6,144 @@ module Mongoid
   module Kms
     extend ActiveSupport::Concern
 
+    included do
+      @kms_field_map ||= {}
+
+      unless self.ancestors.include?(ActiveModel::Dirty)
+        include ActiveModel::Dirty
+      end
+    end
+
     @configuration = {}
     @kms = nil
 
-    def self.configure(args)
-      @configuration = args
-    end
+    # Module methods
+    class << self
+      def configure(args)
+        @configuration = args
+      end
 
-    def self.configuration
-      @configuration || {}
-    end
+      def configuration
+        @configuration || {}
+      end
 
-    def self.kms
-      @kms ||= Aws::KMS::Client.new(region: self.region)
-    end
+      def kms
+        @kms ||= Aws::KMS::Client.new(region: self.region)
+      end
 
-    def self.region
-      configuration[:region]
-    end
+      def region
+        configuration[:region]
+      end
+
+      def key
+        configuration[:key]
+      end
 
-    def self.key
-      configuration[:key]
+      def bson_class
+        if defined? Moped::BSON
+          Moped::BSON
+        elsif defined? BSON
+          BSON
+        end
+      end
     end
 
-    def self.bson_class
-      if defined? Moped::BSON
-        Moped::BSON
-      elsif defined? BSON
-        BSON
+    # Instance methods
+    def set_kms_values
+      self.class.kms_field_map.each do |field_name, settings|
+        if self.send("#{field_name}_changed?") || kms_context_value_changed?(field_name)
+          encrypted_field_name = self.class.get_encrypted_field_name(field_name)
+
+          if instance_variable_get("@#{field_name}").nil? && kms_context_value_changed?(field_name)
+            value = self.class.decrypt_field(self, field_name, self.send(encrypted_field_name), self.class.kms_context_was(self, field_name))
+          else
+            value = send("#{field_name}")
+          end
+
+          if value.nil?
+            self.send("#{encrypted_field_name}=", nil)
+          else
+            self.send("#{encrypted_field_name}=", self.class.encrypt_field(self, field_name, value))
+          end
+        end
       end
     end
 
+    def kms_context_value_changed?(field_name)
+      self.class.kms_context_array(self, field_name).find { |f| self.respond_to?(f) && self.send("#{f}_changed?") }
+    end
+
+    # Class methods
     module ClassMethods
+      def kms_field_map
+        @kms_field_map
+      end
+
       def encrypt_field(object, field_name, value)
         Mongoid::Kms.kms.encrypt({
           key_id: Mongoid::Kms.key,
           plaintext: value,
           encryption_context: kms_context(object, field_name)
         })[:ciphertext_blob].force_encoding('UTF-8')
-      rescue ArgumentError
-        raise "Error using KMS context.  If you use an object's field for context, set your encrypted fields explicitly: myobject.#{field_name} = #{value.inspect}"
       end
 
-      def decrypt_field(object, field_name, data)
+      def decrypt_field(object, field_name, data, encryption_context = nil)
+        encryption_context ||= kms_context(object, field_name)
+
         Mongoid::Kms.kms.decrypt({
           ciphertext_blob: data,
-          encryption_context: kms_context(object, field_name)
+          encryption_context: encryption_context
         })[:plaintext]
       end
 
       def kms_context(object, field_name)
-        c = @kms_field_map[field_name.to_s][:context]
-        c = c.call(object) if c.is_a?(Proc)
-        c
+        kms_context_array(object, field_name).inject({}) do |hash, key|
+          if object.respond_to?(key)
+            hash[key] = object.send(key)
+          else
+            hash[key] = key
+          end
+
+          hash
+        end
+      end
+
+      def kms_context_was(object, field_name)
+        kms_context_array(object, field_name).inject({}) do |hash, key|
+          if object.respond_to?("#{key}_was") && object.send("#{key}_changed?")
+            hash[key] = object.send("#{key}_was")
+          elsif object.respond_to?(key)
+            hash[key] = object.send(key)
+          else
+            hash[key] = key
+          end
+
+          hash
+        end
+      end
+
+      def kms_context_array(object, field_name)
+        @kms_field_map[field_name.to_s][:context] || []
       end
 
       def kms_type(field_name)
         @kms_field_map[field_name.to_s][:type]
       end
 
+      def get_encrypted_field_name(field_name)
+        "kms_secure_#{field_name}"
+      end
+
       def secure_field(field_name, args)
-        encrypted_field_name = "kms_secure_#{field_name}"
+        encrypted_field_name = get_encrypted_field_name(field_name)
 
-        @kms_field_map ||= {}
         @kms_field_map[field_name.to_s] = {context: args.delete(:context), type: args.delete(:type)}
 
         field encrypted_field_name, args.merge(type: Mongoid::Kms.bson_class::Binary)
 
+        define_attribute_methods field_name.to_sym
+        before_save :set_kms_values
+
         define_method(field_name) do
           instance_variable_get("@#{field_name}") || begin
             raw = send("kms_secure_#{field_name}")
@@ -88,13 +159,8 @@ module Mongoid
         end
 
         define_method("#{field_name}=") do |value|
+          self.send("#{field_name}_will_change!")
           instance_variable_set("@#{field_name}", value)
-
-          if value.nil?
-            self.send("#{encrypted_field_name}=", nil)
-          else
-            self.send("#{encrypted_field_name}=", self.class.encrypt_field(self, field_name, value))
-          end
         end
       end
     end

data/spec/lib/mongoid/kms_spec.rb

@@ -3,8 +3,7 @@ require 'spec_helper'
 describe Mongoid::Kms do
 
   it "encrypts the secure fields" do
-    o = MyClass.new(unsecure: "robin")
-    o.secure = "batman"
+    o = MyClass.new(secure: "batman", unsecure: "robin")
     o.save!
 
     expect(o.secure).to eq("batman")
@@ -12,8 +11,7 @@ describe Mongoid::Kms do
   end
 
   it "descripts the secure fields" do
-    o = MyClass.new(unsecure: "robin")
-    o.secure = "batman"
+    o = MyClass.new(unsecure: "robin", secure: "batman")
     o.save!
 
     o = MyClass.find(o.id)
@@ -21,9 +19,8 @@ describe Mongoid::Kms do
     expect(o.unsecure).to eq("robin")
   end
 
-  it "encrypts teh other fields" do
-    o = OtherClass.new(unsecure: "pengiun")
-    o.super_secure = "joker"
+  it "encrypts the other fields" do
+    o = OtherClass.new(unsecure: "pengiun", super_secure: "joker")
     o.save!
 
     o = OtherClass.find(o.id)
@@ -31,4 +28,24 @@ describe Mongoid::Kms do
     expect(o.unsecure).to eq("pengiun")
   end
 
+  it "modifies the encryption if the context field changes" do
+    o = MyClass.new(unsecure: "robin", secure: "other")
+    o.save!
+
+    o = MyClass.find(o.id)
+    o.unsecure = "bla"
+    o.save!
+
+    o = MyClass.find(o.id)
+    expect(o.secure).to eq("other")
+  end
+
+  it "handles a class without context" do
+    o = MyClass.new(secure: "bla", unsecure: "blatoo")
+    o.save!
+
+    o = MyClass.find(o.id)
+    expect(o.secure).to eq("bla")
+  end
+
 end

data/spec/spec_helper.rb

@@ -9,7 +9,7 @@ class MyClass
   include Mongoid::Document
   include Mongoid::Kms
 
-  secure_field :secure, type: String, context: lambda { |d| {name: d.unsecure} }
+  secure_field :secure, type: String, context: [:unsecure]
   field :unsecure
 end
 
@@ -17,9 +17,16 @@ class OtherClass
   include Mongoid::Document
   include Mongoid::Kms
 
-  secure_field :super_secure, type: String, context: lambda { |d| {some_name: d.unsecure} }
+  secure_field :super_secure, type: String, context: [:unsecure, "deployment"]
   field :unsecure
 end
 
+class ClassWithoutContext
+  include Mongoid::Document
+  include Mongoid::Kms
+
+  secure_field :secure, type: String
+  field :unsecure
+end
 
 Mongoid::Kms.configure({region: "us-east-1", key: ENV['AWS_KMS_KEY_ID']})

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mongoid-kms
 version: !ruby/object:Gem::Version
-  version: 0.0.14
+  version: 0.0.15
 platform: ruby
 authors:
 - Chris Winslett
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-12-13 00:00:00.000000000 Z
+date: 2014-12-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mongoid