quantipay-acts_as_secure 1.0.2

data/CHANGELOG

@@ -0,0 +1,34 @@
+rel_1_0_1:
+  date: 2009-12-20
+  notes:
+    - Fixed AR serialization - now adds "serialize" to the model when adding callbacks
+    -- Added secure_column_symbols to return an array of columns to be secured, as symbols. Not very DRY, but works for now 
+    - Defaulting to :text fields instead of binary for :storage type. To allow storing base64 encoded encrypted data
+    - Need to verify :only and :except returns a valid set of columns to secure - haven't tested this much at the moment.
+
+rel_1_0_0:
+  date: 2009-12-20
+  notes:
+    - Updates to use AR serialization to manage storage of data to the DB
+    - Added acts_as_secure :only => [] option to allow specifying specific columns to be secured
+    - Added update_pk_password class method to allow setting the private key password
+    - Added gemspec
+rel_0_0_4:
+  date: 2008-09-06
+  notes:
+    - No decryption for NULL fields
+
+rel_0_0_3:
+  date: 2007-06-26
+  notes:
+    - Added support for nested crypto blocks
+
+rel_0_0_2:
+  date: 2007-06-18
+  notes:
+    - Added support for model inheritance
+
+rel_0_0_1:
+  date: 2005-04-26
+  notes:
+    - Initial release

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2007 Revolution Health Group LLC. All rights reserved.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README

@@ -0,0 +1,149 @@
+== Introduction
+
+ActsAsSecure adds an ability to store ActiveRecord model's fields encrypted in a DB. When a model is marked with acts_as_secure, the :binary type fields are recognized as needed to be stored encrypted. The plugin does before_save/after_save/after_find encryption/decryption thus making it transparent for a code using the secure models.
+
+The plugin supports a master key approach as well as individual records encryption keys. It does not contain any crypto provider but allows to plug in any external one as long as it supports encrypt/decrypt methods.
+
+The fields are converted to a YAML form before encryption. After description they are restored via YAML.load. Since fields are stored encrypted, the find usage is very limited. 
+
+== Usage
+
+=== Master Key Provider Usage
+
+class SecureModel < ActiveRecord::Base
+  acts_as_secure :crypto_provider => MasterKeyProviderClassOrInstance
+end
+
+SecureModel.create()
+SecureModel.find(:first)
+
+=== Individual Keys Provider Usage
+
+class SecureModel < ActiveRecord::Base
+  acts_as_secure
+end
+
+SecureModel.with_crypto_provider(SomeProvider.new(some_param)) { SecureModel.find(:first) }
+SecureModel.with_crypto_provider(SomeProvider.new(some_param)) { SecureModel.create() }
+
+=== Other Options
+
+acts_as_secure :storage_type => :text  -- changes the secure storage type from :binary to the supplied one
+acts_as_secure :except => [:field1, :field2] -- disables the secure behavior for the :binary type fields in a supplied list
+
+== Example
+
+Let's define three models: Fruit (not secure), SecretFruit (uses the master key approach), and UberSecretFruit (uses the individual key approach).
+
+Rot13CryptoProvider represents a master key provider. SaltedRot13CryptoProvider depends on a salt individual for each record.
+
+
+=== Models
+
+class Fruit < ActiveRecord::Base
+  has_one :secret_fruit
+  has_one :uber_secret_fruit 
+end
+
+class CreateFruits < ActiveRecord::Migration
+  def self.up
+    create_table :fruits do |t|
+      t.column :name, :string
+    end
+  end
+end
+
+class Rot13CryptoProvider
+  class << self
+    def encrypt(arg)
+      arg.tr("A-Za-z", "N-ZA-Mn-za-m")
+    end
+    alias_method :decrypt, :encrypt
+  end
+end
+
+class SecretFruit < ActiveRecord::Base
+  acts_as_secure :crypto_provider => Rot13CryptoProvider
+  belongs_to :fruit
+end
+
+class CreateSecretFruits < ActiveRecord::Migration
+  def self.up
+    create_table :secret_fruits do |t|
+      t.column :name, :binary
+      t.column :fruit_id, :integer
+    end
+  end
+end
+
+class SaltedRot13CryptoProvider
+  def initialize(salt)
+    @salt = salt
+  end
+  def encrypt(arg)
+    @salt + arg.tr("A-Za-z", "N-ZA-Mn-za-m")
+  end  
+  def decrypt(arg)
+    arg[@salt.size .. -1].tr("A-Za-z", "N-ZA-Mn-za-m")
+  end  
+end
+
+class UberSecretFruit < ActiveRecord::Base
+  acts_as_secure
+  belongs_to :fruit 
+end
+
+class CreateUberSecretFruits < ActiveRecord::Migration
+  def self.up
+    create_table :uber_secret_fruits do |t|
+      t.column :name, :binary
+      t.column :fruit_id, :integer
+    end
+  end
+end
+
+=== Usage
+
+>> f = Fruit.create(:name => 'passion fruit')
+>> SecretFruit.create(:name => 'maracuya', :fruit => f)
+>> puts f.secret_fruit.name
+maracuya
+>> secret = readline.chomp
+uber_secret
+>> crypto_provider = SaltedRot13CryptoProvider.new(secret)
+>> UberSecretFruit.with_crypto_provider(crypto_provider) { UberSecretFruit.create(:name => 'Passiflora edulis', :fruit => f) }
+>> UberSecretFruit.with_crypto_provider(crypto_provider) { puts f.uber_secret_fruit.name }
+Passiflora edulis
+
+=== DB
+
+> select * from secret_fruits;
++----+---------------+----------+
+| id | name          | fruit_id |
++----+---------------+----------+
+|  1 | --- znenphln  |        1 | 
++----+---------------+----------+
+
+> select * from uber_secret_fruits;
++----+-----------------------------------+----------+
+| id | name                              | fruit_id |
++----+-----------------------------------+----------+
+|  1 | uber_secret--- Cnffvsyben rqhyvf  |        1 | 
++----+-----------------------------------+----------+
+
+
+== Installation
+
+As plugin: 
+script/plugin install svn://rubyforge.org/var/svn/acts-as-secure/trunk/vendor/plugins/acts_as_secure
+
+
+== License
+
+ActsAsSecure released under the MIT license.
+
+
+== Support
+
+The plugin RubyForge page is http://rubyforge.org/projects/acts-as-secure
+

data/Rakefile

@@ -0,0 +1,35 @@
+require 'rake'
+require 'rubygems'
+require 'rake/gempackagetask'
+require 'rake/rdoctask'
+
+desc 'Default Task'
+task :default => [:package]
+
+gem_spec = Gem::Specification.new do |s|
+    s.platform  =   Gem::Platform::RUBY
+    s.name      =   "acts_as_secure"
+    s.version   =   "0.0.4"
+    s.author    =   "RHG Team"
+    s.email     =   "rails-trunk@revolution.com"
+    s.summary   =   "Adds attribute encryption to ActiveRecord models"
+    s.files     =   FileList["init.rb", "lib/**/*"].to_a
+    s.require_path  =   "lib"
+    s.has_rdoc  =   false
+    s.extra_rdoc_files  =   ['README', 'MIT-LICENSE']
+    s.autorequire = 'acts_as_secure'
+end
+    
+gem = Rake::GemPackageTask.new(gem_spec) do |pkg|
+  pkg.need_tar = true
+  pkg.need_zip = true
+end
+
+desc 'Generate documentation'
+Rake::RDocTask.new(:rdoc) do |rdoc|
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title    = 'ActsAsSecure'
+  rdoc.options << '--line-numbers' << '--inline-source'
+  rdoc.rdoc_files.include('README')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end

data/init.rb

@@ -0,0 +1 @@
+require 'acts_as_secure'

data/lib/acts_as_secure.rb

@@ -0,0 +1,133 @@
+# Copyright (c) 2007 Revolution Health Group LLC. All rights reserved.
+
+module ActiveRecord; module Acts; end; end 
+
+module ActiveRecord::Acts::ActsAsSecure
+  
+  require 'yaml'
+    
+  def self.included(base)
+    base.extend(ClassMethods)
+  end
+  
+  module ClassMethods
+            
+    def acts_as_secure(options = {})
+      parse_options!(options)
+      add_callbacks
+      extend(ActsAsSecureClassMethods)
+      send(:include, InstanceMethods)
+    end
+          
+  private
+            
+    def parse_options!(options)
+      @secure_except = filter_secure_columns(options.delete(:except))
+      @secure_only = filter_secure_columns(options.delete(:only))
+      @secure_storage_type = options.delete(:storage_type) || :text
+      @secure_crypto_provider = options.delete(:crypto_provider)
+      fail("Unknown option(s): #{ options.keys.join(', ') }") unless options.empty?
+    end
+    
+    def add_callbacks
+      before_save :encrypt_secure_columns
+      after_save :decrypt_secure_columns
+      after_find :decrypt_secure_columns
+      define_method(:after_find) { } 
+      secure_column_symbols.each {|col| serialize col}
+    end
+
+    def filter_secure_columns(*names)
+      names.flatten.collect(&:to_s)
+    end
+    
+    def secure_column_symbols
+      cols = columns.reject { |col| !@secure_only.include?(col.name) }
+      cols.reject { |col| (col.type != @secure_storage_type) || @secure_except.include?(col.name) }
+      c_sym = []
+      cols.each { |col| c_sym.push(col.name.to_sym) }
+      c_sym
+    end
+        
+    module ActsAsSecureClassMethods
+      
+      def inherited(sub)
+
+        [:secure_except, :secure_storage_type, :secure_crypto_provider].each do |p|
+          sub.instance_variable_set("@#{ p }", instance_variable_get("@#{ p }"))
+        end
+
+        super
+
+      end
+      
+      def with_crypto_provider(provider)
+        begin
+          original_provider = @secure_crypto_provider
+          @secure_crypto_provider = provider
+          yield
+        ensure
+          @secure_crypto_provider = original_provider
+        end
+      end
+
+      def secure_columns
+        cols = columns.reject { |col| !@secure_only.include?(col.name) }
+        cols.reject { |col| (col.type != @secure_storage_type) || @secure_except.include?(col.name) }
+      end
+
+      def secure_crypto_provider
+        @secure_crypto_provider
+      end
+      
+      def update_pk_password(pk_password)
+        @secure_crypto_provider.pk_password = pk_password
+      end
+    end
+    
+    
+    module InstanceMethods
+
+      def encrypt_secure_columns
+        self.class.secure_columns.each do |col|
+          unless self[col.name].nil?
+            enc = secure_encrypt(self[col.name])
+            self[col.name] = enc unless enc.nil?
+          end
+        end
+      end
+      
+      def decrypt_secure_columns
+        self.class.secure_columns.each do |col|
+          unless self[col.name].nil?
+            dec = secure_decrypt(self[col.name])
+            self[col.name] = dec unless dec.nil?            
+          end
+        end
+      end
+            
+    private
+      
+      def secure_encrypt(arg)
+        secure_crypto_provider.encrypt(arg)
+      end 
+           
+      def secure_decrypt(arg)
+        begin
+          secure_crypto_provider.decrypt(arg)
+        rescue Exception => ex
+          raise "Failed to decode the field. Incorrect key?: #{ex.message}"
+        end
+      end
+      
+      def secure_crypto_provider
+        self.class.secure_crypto_provider || fail('No crypto provider defined')
+      end
+      
+    end
+    
+  end
+  
+end
+
+ActiveRecord::Base.send(:include, ActiveRecord::Acts::ActsAsSecure)

metadata

@@ -0,0 +1,62 @@
+--- !ruby/object:Gem::Specification 
+name: quantipay-acts_as_secure
+version: !ruby/object:Gem::Version 
+  version: 1.0.2
+platform: ruby
+authors: 
+- Revolution on Rails
+- Joe Scharf
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2009-02-10 00:00:00 -07:00
+default_executable: 
+dependencies: []
+
+description: Acts as secure adds automatic encryption and decryption to an ActiveRecord model
+email: joe@obility.net
+executables: []
+
+extensions: []
+
+extra_rdoc_files: []
+
+files: 
+- CHANGELOG
+- init.rb
+- lib/acts_as_secure.rb
+- MIT-LICENSE
+- Rakefile
+- README
+has_rdoc: true
+homepage: http://github.com/quantipay/acts_as_secure
+licenses: []
+
+post_install_message: 
+rdoc_options: 
+- --inline-source
+- --charset=UTF-8
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+requirements: []
+
+rubyforge_project: acts_as_secured
+rubygems_version: 1.3.5
+signing_key: 
+specification_version: 3
+summary: Acts as secure adds automatic encryption and decryption to an ActiveRecord model
+test_files: []
+