yaml_vault 1.1.3 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c5acc1523b3bc454d4a73628874710b40427a6dd75ad476786597a30033b95d6
-  data.tar.gz: b8dce922143c7eb87977c0c84bf6148c9eba014887bdd40a726e8ed32f1e0034
+  metadata.gz: 5d971a272200b74721608df31003f4fe36c267debc941b249e046c9d3c0eda87
+  data.tar.gz: 05e9089f383a10b942b63c6378a876d23a9d24c00dd6bd5135c83955f3d857ce
 SHA512:
-  metadata.gz: 5d94c3dfbb3be2dd235989e88e5a639a32f56a638392e09b93f5601c392445550a226e7bf919721f4ce585a35f2fa31af29f83c4dcc6e8b0ce83e870f8fa15ef
-  data.tar.gz: 6c3a2897d5a265de39fb12b730ee7bba29152604b769ee5cba085712c47a7ae4dda7c3140537bbadc45ec9c9ecf23ea699ca53a3ec0a8497e531b9467d9c1722
+  metadata.gz: 8c2604b1ecc2f4c85968fa4a673a3a6f34ad29c18805c63fbffb2a82a896fde931a0c45c77d4c64aa3f413ba2ba13010474f92cdc84f11b9cdf7f431e20c61da
+  data.tar.gz: 24102ad777468b515c728d686d496d93c92a77e5c5864899406a90e49200fa6dca6a9ee44fa237210b763084fe9be2fbe65fffba4112ea1c9b7786176b1de46e

data/.gitignore

@@ -9,3 +9,4 @@
 /tmp/
 
 .envrc
+.idea

data/README.md

@@ -180,6 +180,18 @@ vault:
 
 ex. `$.production.:slaves.[0].*.:password`
 
+You can also use the `--prefix` and `--suffix` options to format the encrypted value. i.e by providing `--prefix "ENC(" --suffix ")"` you can get the following output from the above example:
+
+```yml
+# encrypted_secrets.yml
+
+default: &default
+...
+vault:
+  secret_data: ENC(SzZoOGlpcSs4UlBaQnhTYWx0YlN3NHk2QXhiZGYvVmpsc0c3ckllSlh1TT0tLU13ZERzRWsxaGc0Y090blNIdXVVMmc9PQ==--24b2af56d2563776ca316dbfa243333dd053fea1)
+...
+```
+
 #### AWS KMS Encryption
 
 Max encryptable size is 4096 bytes. (value size as encoded by Base64)
@@ -215,6 +227,8 @@ Enter passphrase: <enter your passphrase>
 
 If `ENV["YAML_VAULT_PASSPHRASE"]`, use it as passphrase
 
+Note to pass the same `--suffix` and `--prefix` if the yaml was encrypted using these options.
+
 #### AWS KMS Decryption
 
 ```

data/exe/yaml_vault

@@ -8,6 +8,8 @@ class YamlVault::Cli < Thor
   include Thor::Actions
 
   class_option :key, aliases: "-k", type: :string, banner: "KEYNAME (format: \"KEY1.INNER_KEY,KEY2\")", desc: "target key", default: "$"
+  class_option :prefix, type: :string, banner: "PREFIX", desc: "prefix string to add to the encrypted value"
+  class_option :suffix, type: :string, banner: "SUFFIX", desc: "suffix string to add to the encrypted value"
   class_option :cryptor, type: :string, enum: %w(simple aws-kms gcp-kms), default: "simple"
 
   class_option :salt, aliases: "-s", type: :string
@@ -33,6 +35,8 @@ class YamlVault::Cli < Thor
     encrypted_yaml = YamlVault::Main.from_file(
       yaml_file,
       target_keys,
+      options[:prefix],
+      options[:suffix],
       options[:cryptor],
       passphrase: passphrase,
       sign_passphrase: sign_passphrase,
@@ -57,6 +61,8 @@ class YamlVault::Cli < Thor
     decrypted_yaml = YamlVault::Main.from_file(
       yaml_file,
       target_keys,
+      options[:prefix],
+      options[:suffix],
       options[:cryptor],
       passphrase: passphrase,
       sign_passphrase: sign_passphrase,

data/lib/yaml_vault.rb

@@ -11,22 +11,24 @@ require 'yaml_vault/yaml_tree_builder'
 module YamlVault
   class Main
     class << self
-      def from_file(filename, keys, cryptor_name = nil, **options)
+      def from_file(filename, keys, prefix = nil, suffix = nil, cryptor_name = nil, **options)
         yaml_content = ERB.new(File.read(filename)).result
-        new(yaml_content, keys, cryptor_name, **options)
+        new(yaml_content, keys, prefix, suffix, cryptor_name, **options)
       end
 
       alias :from_content :new
     end
 
     def initialize(
-      yaml_content, keys, cryptor_name = nil,
+      yaml_content, keys, prefix = nil, suffix = nil, cryptor_name = nil,
       passphrase: nil, sign_passphrase: nil, salt: nil, cipher: "aes-256-cbc", key_len: 32, signature_key_len: 64, digest: "SHA256",
       aws_kms_key_id: nil, aws_region: nil, aws_access_key_id: nil, aws_secret_access_key: nil, aws_profile: nil,
       gcp_kms_resource_id: nil, gcp_credential_file: nil
     )
       @yaml = yaml_content
       @keys = keys
+      @prefix = prefix
+      @suffix = suffix
 
       @passphrase = passphrase
       @sign_passphrase = sign_passphrase
@@ -49,12 +51,12 @@ module YamlVault
     end
 
     def encrypt
-      parser = YAML::Parser.new(YamlVault::YAMLTreeBuilder.new(@keys, @cryptor, :encrypt))
+      parser = YAML::Parser.new(YamlVault::YAMLTreeBuilder.new(@keys, @prefix, @suffix, @cryptor, :encrypt))
       parser.parse(@yaml).handler.root
     end
 
     def decrypt
-      parser = YAML::Parser.new(YamlVault::YAMLTreeBuilder.new(@keys, @cryptor, :decrypt))
+      parser = YAML::Parser.new(YamlVault::YAMLTreeBuilder.new(@keys, @prefix, @suffix, @cryptor, :decrypt))
       parser.parse(@yaml).handler.root
     end
 

data/lib/yaml_vault/rails.rb

@@ -23,7 +23,7 @@ module YamlVault
           # Fallback to config.secret_key_base if secrets.secret_key_base isn't set
           secrets.secret_key_base ||= config.secret_key_base
           # Fallback to config.secret_token if secrets.secret_token isn't set
-          secrets.secret_token ||= config.secret_token
+          secrets.secret_token ||= config&.secret_token if config.respond_to?(:secret_token)
 
           secrets
         end

data/lib/yaml_vault/version.rb

@@ -1,3 +1,3 @@
 module YamlVault
-  VERSION = "1.1.3"
+  VERSION = "1.2.0"
 end

data/lib/yaml_vault/yaml_tree_builder.rb

@@ -3,11 +3,13 @@ require 'yaml'
 
 module YamlVault
   class YAMLTreeBuilder < YAML::TreeBuilder
-    def initialize(target_paths, cryptor, mode)
+    def initialize(target_paths, prefix, suffix, cryptor, mode)
       super()
 
       @path_stack = []
       @target_paths = target_paths
+      @prefix = prefix
+      @suffix = suffix
       @cryptor = cryptor
       @mode = mode
     end
@@ -74,7 +76,9 @@ module YamlVault
           else
             result.value = @cryptor.encrypt(value)
           end
+          result.value = add_prefix_and_suffix(result.value)
         else
+          value = remove_prefix_and_suffix(value)
           decrypted_value = @cryptor.decrypt(value).to_s
           if decrypted_value =~ /\A(!.*?)\s+(.*)\z/
             result.tag = $1
@@ -100,6 +104,20 @@ module YamlVault
 
     private
 
+    def add_prefix_and_suffix(value)
+      return "#{@prefix}#{value}#{@suffix}"
+    end
+
+    def remove_prefix_and_suffix(value)
+      if @prefix != nil && value.start_with?(@prefix)
+        value = value.delete_prefix(@prefix)
+      end
+      if @suffix != nil && value.end_with?(@suffix)
+        value = value.delete_suffix(@suffix)
+      end
+      value
+    end
+
     def match_path?
       @target_paths.any? do |target_path|
         target_path.each_with_index.all? do |path, i|

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: yaml_vault
 version: !ruby/object:Gem::Version
-  version: 1.1.3
+  version: 1.2.0
 platform: ruby
 authors:
 - joker1007
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2019-07-10 00:00:00.000000000 Z
+date: 2021-04-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -110,7 +110,7 @@ homepage: https://github.com/joker1007/yaml_vault
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -125,8 +125,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.2.3
+signing_key:
 specification_version: 4
 summary: yaml encryption/decryption helper.
 test_files: []