Module: SecretKeysRails

Defined in:
lib/secret_keys_rails.rb,
lib/secret_keys_rails/errors.rb,
lib/secret_keys_rails/railtie.rb,
lib/secret_keys_rails/version.rb,
lib/secret_keys_rails/commands/secret_keys_command.rb

Defined Under Namespace

Modules: Commands Classes: Error, MissingKeyError, MissingSecretsError, NotLoadedError, Railtie

Constant Summary collapse

VERSION = 
"0.1.2"

Class Attribute Summary collapse

Class Method Summary collapse

Class Attribute Details

.key_path(env = nil) ⇒ Object 



27
28
29
30
31
32
33
34
35
 
# File 'lib/secret_keys_rails.rb', line 27

def key_path(env = nil)
  if @key_path
    Pathname.new(@key_path)
  elsif env
    Pathname.new("config/secret_keys/#{env}.yml.key")
  else
    Pathname.new("config/secret_keys.yml.key")
  end
end

.require_encryption_key ⇒ Object

Returns the value of attribute require_encryption_key.



13
14
15
 
# File 'lib/secret_keys_rails.rb', line 13

def require_encryption_key
  @require_encryption_key
end

.secrets_path(env = nil) ⇒ Object 



17
18
19
20
21
22
23
24
25
 
# File 'lib/secret_keys_rails.rb', line 17

def secrets_path(env = nil)
  if @secrets_path
    Pathname.new(@secrets_path)
  elsif env
    Pathname.new("config/secret_keys/#{env}.yml")
  else
    Pathname.new("config/secret_keys.yml")
  end
end

Class Method Details

.key(env = nil) ⇒ Object 



37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/secret_keys_rails.rb', line 37

def key(env = nil)
  key = nil

  if ENV["SECRET_KEYS_ENCRYPTION_KEY"]
    key = ENV["SECRET_KEYS_ENCRYPTION_KEY"]
  else
    path = self.key_path(env)
    if File.exist?(path)
      key = File.read(path).strip
    end
  end

  if !key && self.require_encryption_key
    raise MissingKeyError.new("Missing encryption key to decrypt file with. Ask your team for your master key and write it to #{self.key_path(env)} or put it in the ENV['SECRET_KEYS_ENCRYPTION_KEY'].")
  end

  key
end

.load ⇒ Object 



64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
 
# File 'lib/secret_keys_rails.rb', line 64

def load
  # Determine whether we should try to load the environment-specific secret
  # keys file (eg, config/secret_keys/ENV.yml), or whether we should use the
  # default file (config/secret_keys.yml).
  secrets_path = nil
  key = nil
  if Pathname.new("config/secret_keys/#{::Rails.env}.yml").exist?
    secrets_path = self.secrets_path(::Rails.env)
    key = self.key(::Rails.env)
  else
    secrets_path = self.secrets_path
    key = self.key
  end

  # Decrypt the file with the SecretKeys library.
  if secrets_path.exist? && key
    secrets = SecretKeys.new(secrets_path, key).to_h
  else
    secrets = {}
  end

  # Use a HashWithIndifferentAccess for easier key access, and also deep
  # freeze the object to prevent unintended modifications of the secrets at
  # runtime.
  @secrets = IceNine.deep_freeze(secrets.with_indifferent_access)

  # If there is a `secret_key_base` secret present, then use that for the
  # default Rails secret_key_base definition (depending on Rails version,
  # this can be read out of a few different places).
  if @secrets.key?(:secret_key_base)
    if ::Rails.application.respond_to?(:credentials)
      Rails.application.credentials.secret_key_base = @secrets.fetch(:secret_key_base)
    end
    if ::Rails.application.respond_to?(:secrets)
      Rails.application.secrets.secret_key_base = @secrets.fetch(:secret_key_base)
    end
    if ::Rails.application.config.respond_to?(:secret_key_base=)
      Rails.application.config.secret_key_base = @secrets.fetch(:secret_key_base)
    end
  end
end

.read(env = nil) ⇒ Object 



106
107
108
109
110
111
112
113
 
# File 'lib/secret_keys_rails.rb', line 106

def read(env = nil)
  secrets_path = self.secrets_path(env)
  unless secrets_path.exist?
    raise MissingSecretsError.new("File '#{secrets_path}' does not exist. Use `rake secret_keys:edit` to create it.")
  end

  SecretKeys.new(secrets_path, self.key(env))
end

.secrets ⇒ Object 



56
57
58
59
60
61
62
 
# File 'lib/secret_keys_rails.rb', line 56

def secrets
  unless @secrets
    raise NotLoadedError.new("Secrets have not been loaded. Rails should automatically load the secrets on startup.")
  end

  @secrets
end