sidekiq-field-encryptor 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 204c8e1c027462e1fd8b44117a1e2a7953f3f793
-  data.tar.gz: 5d0f753a7031408d647d9508def52146c4d8609a
+  metadata.gz: d7b580f10f55bd99cc1b08a0d41157746562b155
+  data.tar.gz: d93bb7059b52325809a24f161c98ec4b705f9323
 SHA512:
-  metadata.gz: 86b140ff56fc6cb4d3baf1901fb42b8f34a2bc2f0955280b497b3956c83d6505ae00df0da5057aa8d75ff7dc32952cb8b09baa24317320e03744252d80f2762f
-  data.tar.gz: 9904d3395415ad5c0697e86c238273a17d85dda7717f7de28e53878edf59038960b7dfba9b9c7b954b3c6dffac054f7406c0887f39bcec344927bb79da3ce563
+  metadata.gz: 73208766812240af540b2fac93f98f4d585ffb0065dda731dbd47be7b01ee4d4b8eab048925c2254c465ce46ecaf0a775ffb6a6e010c1b52d429f04119992f02
+  data.tar.gz: 04f77a80f08b85d429c804a38b2244a4f5f564cd6a4a5e7704fb9727796261d7280a0fc47f80a4d3f593d9a6940be13f9b397c6d4f930a38eb294440012aa048

data/.travis.yml

@@ -1,4 +1,3 @@
 rvm:
   - "2.1"
   - 2.0.0
-  - jruby

data/README.md

@@ -4,7 +4,7 @@
 [![Build Status](https://travis-ci.org/aptible/sidekiq-field-encryptor.png?branch=master)](https://travis-ci.org/aptible/sidekiq-field-encryptor)
 [![Dependency Status](https://gemnasium.com/aptible/sidekiq-field-encryptor.png)](https://gemnasium.com/aptible/sidekiq-field-encryptor)
 
-TODO: Add description.
+This is a utility which is intended to be used for encrypting sensitive data in Sidekiq jobs. The data is encrypted before sending it to Redis, and decrypted right before the Sidekiq job is executed.
 
 ## Installation
 
@@ -16,7 +16,24 @@ And then run `bundle install`.
 
 ## Usage
 
-TODO: Add usage notes.
+This middleware configures encryption of any fields that can contain sensitive
+information. Keys in the hash are Sidekiq job classes and values are hashes
+that map indices in the args array to either "true" (encrypt the entire arg)
+or a list of keys (encrypt certain values in a hash argument). For example,
+the configuration hash:
+
+    { 'Job::Foo' => { 0 => true, 3 => [ 'secret', 'id' ] } }
+
+When applied to the Sidekiq job:
+
+    {
+      'class' => 'Job::Foo',
+      'args' => [{'x' => 1}, 'y', 'z', { 'public' => 'a', 'secret' => 'b' }],
+      ...
+    }
+
+Will encrypt the values {'x' => 1} and 'b' when storing the job in Redis and
+decrypt the values inside the client before the job is executed.
 
 ## Contributing
 

data/lib/sidekiq-field-encryptor/encryptor.rb

@@ -2,28 +2,47 @@ require 'base64'
 require 'encryptor'
 require 'sidekiq-field-encryptor/version'
 
+# This middleware configures encryption of any fields that can contain sensitive
+# information. Keys in the hash are Sidekiq job classes and values are hashes
+# that map indices in the args array to either "true" (encrypt the entire arg)
+# or a list of keys (encrypt certain values in a hash argument). For example,
+# the configuration hash:
+#
+#   { 'Job::Foo' => { 0 => true, 3 => [ 'secret', 'id' ] } }
+#
+# When applied to the Sidekiq job:
+#
+#   {
+#     'class' => 'Job::Foo',
+#     'args' => [{'x' => 1}, 'y', 'z', { 'public' => 'a', 'secret' => 'b' }],
+#     ...
+#   }
+#
+# Will encrypt the values {'x' => 1} and 'b' when storing the job in Redis and
+# decrypt the values inside the client before the job is executed.
 module SidekiqFieldEncryptor
   class Base
     def initialize(options = {})
       @encryption_key = options[:encryption_key]
       @encrypted_fields = options[:encrypted_fields] || {}
+      @encryption_algorithm = options[:encryption_algorithm] || 'aes-256-gcm'
     end
 
     def assert_key_configured
-      fail 'Encryption key not configured' if @encryption_key.nil?
+      raise 'Encryption key not configured' if @encryption_key.nil?
     end
 
     def encrypt(value)
       plaintext = Marshal.dump(value)
-      iv = OpenSSL::Cipher::Cipher.new('aes-256-cbc').random_iv
-      args = { key: @encryption_key, iv: iv }
+      iv = OpenSSL::Cipher::Cipher.new(@encryption_algorithm).random_iv
+      args = { key: @encryption_key, iv: iv, algorithm: @encryption_algorithm }
       ciphertext = ::Encryptor.encrypt(plaintext, **args)
       [::Base64.encode64(ciphertext), ::Base64.encode64(iv)]
     end
 
     def decrypt(encrypted)
       ciphertext, iv = encrypted.map { |value| ::Base64.decode64(value) }
-      args = { key: @encryption_key, iv: iv }
+      args = { key: @encryption_key, iv: iv, algorithm: @encryption_algorithm }
       plaintext = ::Encryptor.decrypt(ciphertext, **args)
       Marshal.load(plaintext)
     end

data/lib/sidekiq-field-encryptor/version.rb

@@ -1,3 +1,3 @@
 module SidekiqFieldEncryptor
-  VERSION = '0.1.0'
+  VERSION = '0.1.1'.freeze
 end

data/spec/sidekiq-field-encryptor/encryptor_spec.rb

@@ -12,7 +12,8 @@ describe SidekiqFieldEncryptor::Client do
     end
     it 'fails when encryption is attempted' do
       client = SidekiqFieldEncryptor::Client.new(
-        encrypted_fields: { 'FooJob' => { 1 => true } })
+        encrypted_fields: { 'FooJob' => { 1 => true } }
+      )
       expect { client.call('FooJob', message, nil, nil) {} }
         .to raise_error('Encryption key not configured')
     end
@@ -22,9 +23,8 @@ describe SidekiqFieldEncryptor::Client do
     subject do
       SidekiqFieldEncryptor::Client.new(
         encryption_key: key,
-        encrypted_fields: {
-          'FooJob' => { 1 => true, 2 => %w(b d) }
-        })
+        encrypted_fields: { 'FooJob' => { 1 => true, 2 => %w(b d) } }
+      )
     end
 
     it 'encrypts only fields specified by the encryption config' do
@@ -35,6 +35,28 @@ describe SidekiqFieldEncryptor::Client do
       expect(subject.decrypt(message['args'][2]['b'])).to eq('B')
     end
   end
+
+  it 'supports setting the encryption algorithm' do
+    key = OpenSSL::Cipher::Cipher.new('aes-128-cbc').random_key
+    fields = { 'FooJob' => { 1 => true, 2 => %w(b d) } }
+
+    ko = SidekiqFieldEncryptor::Client.new(
+      encryption_key: key,
+      encryption_algorithm: 'aes-256-cbc',
+      encrypted_fields: fields
+    )
+
+    ok = SidekiqFieldEncryptor::Client.new(
+      encryption_key: key,
+      encryption_algorithm: 'aes-128-cbc',
+      encrypted_fields: fields
+    )
+
+    expect { ko.call('FooJob', message, nil, nil) {} }
+      .to raise_error(/must be 32 bytes or longer/)
+
+    ok.call('FooJob', message, nil, nil) {}
+  end
 end
 
 describe SidekiqFieldEncryptor::Server do
@@ -49,7 +71,8 @@ describe SidekiqFieldEncryptor::Server do
     end
     it 'fails when decryption is attempted' do
       server = SidekiqFieldEncryptor::Server.new(
-        encrypted_fields: { 'FooJob' => { 1 => true } })
+        encrypted_fields: { 'FooJob' => { 1 => true } }
+      )
       expect { server.call('FooJob', message, nil) {} }
         .to raise_error('Encryption key not configured')
     end
@@ -59,9 +82,8 @@ describe SidekiqFieldEncryptor::Server do
     subject do
       SidekiqFieldEncryptor::Server.new(
         encryption_key: key,
-        encrypted_fields: {
-          'FooJob' => { 1 => true, 2 => %w(b d) }
-        })
+        encrypted_fields: { 'FooJob' => { 1 => true, 2 => %w(b d) } }
+      )
     end
 
     it 'decrypts all fields specified by the encryption config' do
@@ -71,5 +93,29 @@ describe SidekiqFieldEncryptor::Server do
       subject.call('FooJob', message, nil) {}
       expect(message).to eq(original_message)
     end
+
+    it 'supports setting the encryption algorithm' do
+      key = OpenSSL::Cipher::Cipher.new('aes-128-cbc').random_key
+      fields = { 'FooJob' => { 1 => true } }
+
+      ko = SidekiqFieldEncryptor::Server.new(
+        encryption_key: key,
+        encryption_algorithm: 'aes-256-cbc',
+        encrypted_fields: fields
+      )
+
+      ok = SidekiqFieldEncryptor::Server.new(
+        encryption_key: key,
+        encryption_algorithm: 'aes-128-cbc',
+        encrypted_fields: fields
+      )
+
+      message['args'][1] = ok.encrypt(message['args'][1])
+
+      expect { ko.call('FooJob', message, nil) {} }
+        .to raise_error(/key must be 32 bytes or longer/)
+
+      ok.call('FooJob', message, nil) {}
+    end
   end
 end

metadata

@@ -1,83 +1,83 @@
 --- !ruby/object:Gem::Specification
 name: sidekiq-field-encryptor
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Blake Pettersson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-09-01 00:00:00.000000000 Z
+date: 2016-12-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: encryptor
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: aptible-tasks
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 description: Selectively encrypt fields in Sidekiq
@@ -87,9 +87,9 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
-- .rspec
-- .travis.yml
+- ".gitignore"
+- ".rspec"
+- ".travis.yml"
 - Gemfile
 - LICENSE.md
 - README.md
@@ -110,17 +110,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.4.5.1
 signing_key: 
 specification_version: 4
 summary: Selectively encrypt fields sent into Sidekiq