Class: CommandTower::Messaging::Endpoints::SecretBox

Inherits:
Object
  • Object
show all
Defined in:
app/services/command_tower/messaging/endpoints/secret_box.rb

Overview

Encrypts endpoint secrets at rest using ActiveSupport::MessageEncryptor. Root secret → separately derived encryption keys per purpose (never shared with Fingerprinter).

Defined Under Namespace

Classes: MissingSecretError

Constant Summary collapse

CURRENT_KEY_VERSION = 
1
ENCRYPT_PURPOSE = 
"command_tower.messaging.endpoints.encrypt.v1"
PUSHOVER_USER_KEY_PURPOSE = 
"command_tower.messaging.endpoints.encrypt.pushover.user_key.v1"
PUSHOVER_APPLICATION_TOKEN_PURPOSE = 
"command_tower.messaging.endpoints.encrypt.pushover.application_token.v1"
CIPHER = 
"aes-256-gcm"

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(purpose: ENCRYPT_PURPOSE) ⇒ SecretBox

Returns a new instance of SecretBox.



33
34
35
 
# File 'app/services/command_tower/messaging/endpoints/secret_box.rb', line 33

def initialize(purpose: ENCRYPT_PURPOSE)
  @purpose = purpose.to_s
end

Class Method Details

.decrypt(ciphertext, key_version: CURRENT_KEY_VERSION, purpose: ENCRYPT_PURPOSE) ⇒ Object 



25
26
27
 
# File 'app/services/command_tower/messaging/endpoints/secret_box.rb', line 25

def self.decrypt(ciphertext, key_version: CURRENT_KEY_VERSION, purpose: ENCRYPT_PURPOSE)
  new(purpose:).decrypt(ciphertext, key_version:)
end

.encrypt(plaintext, purpose: ENCRYPT_PURPOSE) ⇒ Object 



21
22
23
 
# File 'app/services/command_tower/messaging/endpoints/secret_box.rb', line 21

def self.encrypt(plaintext, purpose: ENCRYPT_PURPOSE)
  new(purpose:).encrypt(plaintext)
end

.key_version ⇒ Object 



29
30
31
 
# File 'app/services/command_tower/messaging/endpoints/secret_box.rb', line 29

def self.key_version
  CURRENT_KEY_VERSION
end

Instance Method Details

#decrypt(ciphertext, key_version: CURRENT_KEY_VERSION) ⇒ Object

Raises:



42
43
44
45
46
 
# File 'app/services/command_tower/messaging/endpoints/secret_box.rb', line 42

def decrypt(ciphertext, key_version: CURRENT_KEY_VERSION)
  raise ValidationError, "unsupported encryption_key_version: #{key_version}" unless key_version.to_i == CURRENT_KEY_VERSION

  encryptor.decrypt_and_verify(ciphertext.to_s)
end

#encrypt(plaintext) ⇒ Object 



37
38
39
40
 
# File 'app/services/command_tower/messaging/endpoints/secret_box.rb', line 37

def encrypt(plaintext)
  payload = encryptor.encrypt_and_sign(plaintext.to_s)
  { ciphertext: payload, key_version: CURRENT_KEY_VERSION }
end