Class: ConcernsOnRails::Encryption::Config

Inherits:
Object
  • Object
show all
Defined in:
lib/concerns_on_rails/encryption.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ Config

Returns a new instance of Config.



47
48
49
50
51
52
 
# File 'lib/concerns_on_rails/encryption.rb', line 47

def initialize
  @key = nil
  @key_derivation_salt = DEFAULT_KDF_SALT
  @on_missing_key = :raise
  @raise_on_decrypt_error = true
end

Instance Attribute Details

#key ⇒ Object

key: raw 32-byte binary, 64-hex, passphrase, or a Proc returning one. key_derivation_salt: PBKDF2 salt (part of key identity — keep stable). on_missing_key: :raise (default) or :passthrough (dev/test escape hatch that stores/reads plaintext when no key is configured — never in prod). raise_on_decrypt_error: true (default) raises DecryptionError on a bad read; false returns nil (a narrow reporting-path opt-out, less safe).



45
46
47
 
# File 'lib/concerns_on_rails/encryption.rb', line 45

def key
  @key
end

#key_derivation_salt ⇒ Object

key: raw 32-byte binary, 64-hex, passphrase, or a Proc returning one. key_derivation_salt: PBKDF2 salt (part of key identity — keep stable). on_missing_key: :raise (default) or :passthrough (dev/test escape hatch that stores/reads plaintext when no key is configured — never in prod). raise_on_decrypt_error: true (default) raises DecryptionError on a bad read; false returns nil (a narrow reporting-path opt-out, less safe).



45
46
47
 
# File 'lib/concerns_on_rails/encryption.rb', line 45

def key_derivation_salt
  @key_derivation_salt
end

#on_missing_key ⇒ Object

key: raw 32-byte binary, 64-hex, passphrase, or a Proc returning one. key_derivation_salt: PBKDF2 salt (part of key identity — keep stable). on_missing_key: :raise (default) or :passthrough (dev/test escape hatch that stores/reads plaintext when no key is configured — never in prod). raise_on_decrypt_error: true (default) raises DecryptionError on a bad read; false returns nil (a narrow reporting-path opt-out, less safe).



45
46
47
 
# File 'lib/concerns_on_rails/encryption.rb', line 45

def on_missing_key
  @on_missing_key
end

#raise_on_decrypt_error ⇒ Object

key: raw 32-byte binary, 64-hex, passphrase, or a Proc returning one. key_derivation_salt: PBKDF2 salt (part of key identity — keep stable). on_missing_key: :raise (default) or :passthrough (dev/test escape hatch that stores/reads plaintext when no key is configured — never in prod). raise_on_decrypt_error: true (default) raises DecryptionError on a bad read; false returns nil (a narrow reporting-path opt-out, less safe).



45
46
47
 
# File 'lib/concerns_on_rails/encryption.rb', line 45

def raise_on_decrypt_error
  @raise_on_decrypt_error
end

Instance Method Details

#key? ⇒ Boolean

Returns:

  • (Boolean) 


64
65
66
 
# File 'lib/concerns_on_rails/encryption.rb', line 64

def key?
  !key_material.nil?
end

#key_material ⇒ Object

Resolve the configured key (calling a Proc) to raw String material, or nil when unset. Callers decide raise-vs-passthrough from that nil.



56
57
58
59
60
61
62
 
# File 'lib/concerns_on_rails/encryption.rb', line 56

def key_material
  material = key.respond_to?(:call) ? key.call : key
  return nil if material.nil?

  material = material.to_s
  material.empty? ? nil : material
end

#resolve_material(field_key = nil) ⇒ Object

Resolve the effective key material for a field: a per-field override (String or Proc) wins, else the global key. Returns PASSTHROUGH in the escape-hatch mode, or raises MissingKeyError. Shared by encryption and blind indexing so both derive from the same key.

Raises:



72
73
74
75
76
77
78
79
80
81
82
83
84
 
# File 'lib/concerns_on_rails/encryption.rb', line 72

def resolve_material(field_key = nil)
  material = field_key.respond_to?(:call) ? field_key.call : field_key
  material = material.to_s unless material.nil?
  return material if material && !material.empty?

  global = key_material
  return global unless global.nil?
  return PASSTHROUGH if on_missing_key == :passthrough

  raise MissingKeyError,
        "ConcernsOnRails::Models::Encryptable: no encryption key configured. Set " \
        "ConcernsOnRails.configure_encryption { |c| c.key = ... } or pass key: to the macro."
end