Use lazy decryption

This requires that each field be renamed in the database with the suffix `_encrypted` after the column name. For example, if your column name is `secret`, the column would need to be renamed to `secret_encrypted`. Accessors are setup for `secret` and `secret=` which handles the encrypted and decryption of the column data. The data is saved in the `secret_encrypted` column in the database.

I'm moving aware from serializers because it forces row decryption on all results, even if you don't ever call the attribute that is encrypted. For simple queries you could use `select()` to omit the encrypted fields, but the results become unpredictable once a query becomes more complex and `joins` or `includes` are brought into the mix. It's very tedious to build queries that way.
6a1253e



On December 3, 2014 at 12:27:41 PM, Joshua Priddle (notifications@github.com) wrote:

In lib/crypt_keeper/model.rb:

> +          define_method "reset_#{field}!" do
> +            if attribute_changed?(field)
> +              send("#{field}=", changed_attributes[field])
> +              changed_attributes.delete(field)
> +              send("reset_#{field}_encrypted!")
> +            end
> +          end
> +
> +          # Public: Gets the plaintext for field_encrypted
> +          define_method "#{field}" do
> +            self.class.decrypt_value send("#{field}_encrypted")
> +          end
> +
> +          # Public: Sets the ciphertext for field_encrypted
> +          define_method "#{field}=" do |value|
> +            unless value == self.class.decrypt_value(send("#{field}_encrypted"))
This could be unless value == send(field)

—
Reply to this email directly or view it on GitHub.