Class: Karafka::Pro::Encryption::Cipher

Inherits:
Object
  • Object
show all
Defined in:
lib/karafka/pro/encryption/cipher.rb

Overview

Cipher for encrypting and decrypting data

A facade over the cipher implementations in Ciphers:

Encryption follows the encryption.mode setting. Decryption is mode-independent: the format is recognized per message (a valid direct RSA ciphertext is always exactly the key modulus size, while an envelope is always at least 29 bytes longer), so consumers decrypt both formats transparently regardless of the configured mode, making staged producer-side rollout of the envelope mode safe.

Format detection is deliberately payload-based rather than header-based, even though the encryption middleware already writes message headers that could carry a format marker. A header marker would remove the truncation blind spot documented on Karafka::Pro::Encryption::Ciphers::Direct#owns?, but the payload would stop being self-describing: it must remain decryptable also when it leaves Kafka through channels that do not preserve headers (mirroring and replication tools, dumps, storage sinks) and when handled by custom parsers or ciphers that only receive the payload through the stable #decrypt(version, content) contract. We accept the blind spot as the cheaper cost.

Instance Method Summary collapse

Instance Method Details

#decrypt(version, content) ⇒ String

Decrypts provided content using version key with the cipher implementation that recognizes the content format, independently of the configured mode

Parameters:

  • version (String) —

    encryption version

  • content (String) —

    encrypted content

Returns:

  • (String) —

    decrypted content



74
75
76
77
78
79
80
 
# File 'lib/karafka/pro/encryption/cipher.rb', line 74

def decrypt(version, content)
  if direct.owns?(version, content)
    direct.decrypt(version, content)
  else
    envelope.decrypt(version, content)
  end
end

#encrypt(content) ⇒ String

Encrypts given string content according to the configured encryption.mode

Parameters:

  • content (String)

Returns:

  • (String) 


65
66
67
 
# File 'lib/karafka/pro/encryption/cipher.rb', line 65

def encrypt(content)
  (encryption.mode == :envelope) ? envelope.encrypt(content) : direct.encrypt(content)
end

#warmup(root_config) ⇒ Object

Eagerly builds the underlying ciphers and parses the key material of the given config. Invoked during the single-threaded setup phase so that runtime encryption and decryption only read already-built, effectively frozen state and the lazy initialization below never races across worker threads.

Parameters:

  • root_config (Karafka::Core::Configurable::Node) —

    config whose key material to warm. During setup this is the same app config the ciphers read at runtime.



89
90
91
92
 
# File 'lib/karafka/pro/encryption/cipher.rb', line 89

def warmup(root_config)
  direct.warmup(root_config.encryption)
  envelope.warmup(root_config.encryption)
end