vault-rails 0.9.0 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c055664571a8c3823f5628d70a444685157ac01635896d286ae6fadba332507c
-  data.tar.gz: e40a6d7dccccb60d82bf0ac941233a3ce1cb8f623d30ccc3d71b317ec3fbb392
+  metadata.gz: 2cb9b608c70662fc9e761cbed5eaf27dd34382e502ffdc9fbf8a2d847309b65d
+  data.tar.gz: c7d1746c9807cb13771757a55e2c06077dca2a376d497c145194f57ca27a34c9
 SHA512:
-  metadata.gz: 5b0b4e77c0c06bf3185db3e255aaeb1d184a2fe2c3c422e507d77e1099c85af0bf02b64ff69fe2941950c645572d53ed9705433d99be9e4ff92d60e95412affb
-  data.tar.gz: 6fe948db7a47f95b2b961102ef476ae339b1b6f8ffe0fcecb08c8aaad1b9df19d611efe31a42835de8a8080ef38e4bf7bf9188f3e089c539ab14edb2aea4cf07
+  metadata.gz: 8e2bb2b378c2707f7e2a2d14f68b16522e0817afbaa3f0c4850a595e4b1cec07abe6a9ae351347a334c9fe7455b9860c7f3870b8fa85ddfc62636d752420f67e
+  data.tar.gz: 79e817496fc0b5a30a281ecbdc4f9b86d2b575d091dde48f62380a4d80812c7af8409400f5155d84cba13477c7c9c3a0e317970dea79ab1038c81b00d87855e5

data/README.md

@@ -104,7 +104,7 @@ vault_attribute :credit_card,
 - **Note** This value **cannot** be the same name as the vault attribute!
 
 #### Specifying a custom key
-By default, the name of the key in Vault is `#{app}_#{table}_#{column}`. This is customizable by setting the `:key` option when declaring the attribute:
+By default, the name of the key in Vault is `#{app}_#{table}_#{attribute}`. This is customizable by setting the `:key` option when declaring the attribute:
 
 ```ruby
 vault_attribute :credit_card,
@@ -332,6 +332,21 @@ So for the example above, the key would be:
 
     my_app_people_ssn
 
+### Encrypting without Saving
+Normally, vault-rails will wait until the after_save callback to encrypt changed
+values before updating them. If you'd like to encrypt changed attributes without
+saving, call `vault_encrypt_attributes!`
+
+```ruby
+p = Person.new(ssn: "123-45-6789")
+p.ssn_encrypted
+=> nil
+p.vault_encrypt_attributes!
+p.ssn_encrypted
+=> "vault:dev:flu/yp9oeYYFgjcZH2hVBA=="
+p.persisted?
+=> false
+```
 
 ### Searching Encrypted Attributes
 Because each column is uniquely encrypted, it is not possible to search for a
@@ -345,7 +360,6 @@ Person.where(ssn: "123-45-6789")
 This is because the database is unaware of the plain-text data (which is part of
 the security model).
 
-
 Development
 -----------
 ↥ [back to top](#table-of-contents)

data/lib/vault/encrypted_model.rb

@@ -325,12 +325,7 @@ module Vault
       # Encrypt a single attribute using Vault and persist back onto the
       # encrypted attribute value.
       def __vault_persist_attribute!(attribute, options)
-        key        = options[:key]
-        path       = options[:path]
-        serializer = options[:serializer]
-        column     = options[:encrypted_column]
-        context    = options[:context]
-        transform  = options[:transform_secret]
+        column = options[:encrypted_column]
 
         # Only persist changed attributes to minimize requests - this helps
         # minimize the number of requests to Vault.
@@ -346,6 +341,19 @@ module Vault
 
         # Get the current value of the plaintext attribute
         plaintext = attributes[attribute.to_s]
+        ciphertext = __vault_write_encrypted_attribute!(plaintext, options)
+
+        # Return the updated column so we can save
+        { column => ciphertext }
+      end
+
+      def __vault_write_encrypted_attribute!(plaintext, options)
+        column     = options[:encrypted_column]
+        key        = options[:key]
+        path       = options[:path]
+        serializer = options[:serializer]
+        context    = options[:context]
+        transform  = options[:transform_secret]
 
         # Apply the serialize to the plaintext value, if one exists
         if serializer
@@ -372,8 +380,7 @@ module Vault
         # to get the ciphertext
         write_attribute(column, ciphertext)
 
-        # Return the updated column so we can save
-        { column => ciphertext }
+        ciphertext
       end
 
       # Generates an Vault Transit encryption context for use on derived keys.
@@ -405,6 +412,18 @@ module Vault
           self.__vault_initialize_attributes!
         end
       end
+
+      def vault_encrypt_attributes!
+        self.class.__vault_attributes.each do |attribute, options|
+          next if !attribute_changed?(attribute) && options[:default].nil?
+
+          # Get the current value of the plaintext attribute
+          plaintext = attributes[attribute.to_s]
+
+          __vault_write_encrypted_attribute!(plaintext, options)
+        end
+        self
+      end
     end
   end
 end

data/lib/vault/rails/version.rb

@@ -3,6 +3,6 @@
 
 module Vault
   module Rails
-    VERSION = "0.9.0"
+    VERSION = "0.10.0"
   end
 end