yrby-rails 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1fe04378813fb80d02f8a7044258741096d7db25ddfca9d15451055bb00893a0
-  data.tar.gz: fa3f4d4f4b5bd62884c56235addb80c38c0c6b2185ffeb8f7862b83389bbcbd0
+  metadata.gz: 805c1e286dbc5d7fd802c9b6a1a70fce29b9ea10b6ba1e45966c5c29507cc4c2
+  data.tar.gz: e5939ca7311f642d1685ad785f8ea8b312d6ae20f59661139f481b95a1253fb2
 SHA512:
-  metadata.gz: 4e1226ee5c5de50fb97cd8712f2e9dd4ac0730be26449d0053e177910516308caf7021b0b0e192b63ae19f693c417455fcdab53d45135434acae72352064550e
-  data.tar.gz: 5a47202000292a09671ce92791b5accc72400eb13e035d26994c65bf490b0b1c8abddb30a69d0c73fb1876ff01db7736fe1fc18707367dbcf74ae822b37eca30
+  metadata.gz: aa51adae8ea5fc9259453730d24a609c7faf990ceef1a6c4bce18a49123d6222a1402695bcb9d44e3e53dd634ab560522ee03f705c892d7dfd188121205cfbb8
+  data.tar.gz: '09ada40a8d1e1989a7a514e8b06ea5128d0fcb3cee79a59c61430681634b54d6f5ee7db717da3c9b94ad07137ef7d49367ace024f5d5ac0cf377925375ea0bdf'

data/CHANGELOG-rails.md

@@ -5,6 +5,21 @@ documented here. The
 format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.0] - 2026-08-05
+
+### Added
+
+- `Y::EncryptedDocument` / `Y::EncryptedDocumentUpdate`: document storage
+  encrypted with Active Record encryption (`state` and update payloads),
+  on the same tables — the class you access through decides the
+  cryptography, the way `ActionText::EncryptedRichText` does. Point a
+  channel's `on_load`/`on_change` (or a record association) at
+  `Y::EncryptedDocument` and configure the app's encryption keys. Keep
+  one access path per document: rows written encrypted read back as
+  ciphertext through the plain classes. Ciphertext is larger than the
+  plaintext, so the effective payload cap is roughly three quarters of
+  the column limit.
+
 ## [0.4.0] - 2026-08-04
 
 ### Changed

data/README.md

@@ -492,6 +492,13 @@ The models ship in the gem, the way Action Text owns
   quarantined until they heal rather than compacted into state or
   deleted. Destroying a document deletes its updates with it.
 
+Encrypted storage: `Y::EncryptedDocument` stores `state` and update
+payloads through Active Record encryption on the same tables, the way
+`ActionText::EncryptedRichText` does — point the channel's
+`on_load`/`on_change` at it instead and configure your app's encryption
+keys. Use one access path per document: rows written encrypted read back
+as ciphertext through the plain classes.
+
 The migration creates `y_documents` and `y_document_updates`. To rename
 them, edit the generated migration and point `Y::Document.table_name` /
 `Y::DocumentUpdate.table_name` at the new names in an initializer.

data/app/models/y/document.rb

@@ -119,7 +119,7 @@ class Y::Document < ActiveRecord::Base
   # healed by a newer tail row is served immediately instead of waiting
   # for the next compaction.
   def load_state
-    tail = Y::DocumentUpdate.where(document_id: id).pluck(:payload)
+    tail = updates.reset.pluck(:payload) # reset: never a cached tail
     snapshot = self.class.where(id: id).pick(:state)
     return snapshot if tail.empty?
 

data/app/models/y/encrypted_document.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+# A document whose stored bytes are encrypted with Active Record encryption
+# (state here, update payloads via Y::EncryptedDocumentUpdate). Same tables
+# as Y::Document — the class you access through decides the cryptography,
+# the way ActionText::EncryptedRichText does for rich text. Keep one access
+# path per document: rows written encrypted read back as ciphertext through
+# the plain classes.
+#
+# Requires the app to configure Active Record encryption keys. Ciphertext
+# is larger than the plaintext (a serialized envelope around Base64), so
+# the effective payload cap drops to roughly three quarters of the column
+# limit.
+class Y::EncryptedDocument < Y::Document
+  has_many :updates, class_name: "Y::EncryptedDocumentUpdate",
+                     foreign_key: :document_id, dependent: :delete_all,
+                     inverse_of: :document
+
+  encrypts :state
+end

data/app/models/y/encrypted_document_update.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# The encrypted tail row: Y::DocumentUpdate with the payload encrypted.
+# Written and read through Y::EncryptedDocument's updates association.
+class Y::EncryptedDocumentUpdate < Y::DocumentUpdate
+  belongs_to :document, class_name: "Y::EncryptedDocument"
+
+  encrypts :payload
+end

data/lib/yrby/rails/version.rb

@@ -2,6 +2,6 @@
 
 module Yrby
   module Rails
-    VERSION = "0.4.0"
+    VERSION = "0.5.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: yrby-rails
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.5.0
 platform: ruby
 authors:
 - JP Camara
@@ -136,6 +136,8 @@ files:
 - README.md
 - app/models/y/document.rb
 - app/models/y/document_update.rb
+- app/models/y/encrypted_document.rb
+- app/models/y/encrypted_document_update.rb
 - lib/generators/yrby/install/USAGE
 - lib/generators/yrby/install/install_generator.rb
 - lib/generators/yrby/install/templates/document_channel.rb