Class: HatiConfig::Encryption::EncryptionConfig

Inherits:
Object
  • Object
show all
Defined in:
lib/hati_config/encryption.rb

Overview

EncryptionConfig class handles encryption configuration and behavior.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize ⇒ EncryptionConfig

Returns a new instance of EncryptionConfig.



33
34
35
36
37
38
39
40
 
# File 'lib/hati_config/encryption.rb', line 33

def initialize
  @key_provider = nil
  @key_provider_type = nil
  @key_provider_options = {}
  @algorithm = 'aes'
  @key_size = 256
  @mode = 'gcm'
end

Instance Attribute Details

#algorithm(value = nil) ⇒ Object (readonly)

Sets the encryption algorithm.

Parameters:

  • value (String) (defaults to: nil) —

    The encryption algorithm (e.g., "aes")



60
61
62
 
# File 'lib/hati_config/encryption.rb', line 60

def algorithm
  @algorithm
end

#key_provider(provider = nil, options = {}) ⇒ Object (readonly)

Sets the key provider.

Parameters:

  • provider (Symbol) (defaults to: nil) —

    The key provider type (:env, :file, :aws_kms)

  • options (Hash) (defaults to: {}) —

    Options for the key provider



46
47
48
 
# File 'lib/hati_config/encryption.rb', line 46

def key_provider
  @key_provider
end

#key_provider_options ⇒ Object (readonly)

Returns the value of attribute key_provider_options.



31
32
33
 
# File 'lib/hati_config/encryption.rb', line 31

def key_provider_options
  @key_provider_options
end

#key_provider_type ⇒ Object (readonly)

Returns the value of attribute key_provider_type.



31
32
33
 
# File 'lib/hati_config/encryption.rb', line 31

def key_provider_type
  @key_provider_type
end

#key_size(value = nil) ⇒ Object (readonly)

Sets the key size.

Parameters:

  • value (Integer) (defaults to: nil) —

    The key size in bits (e.g., 256)



72
73
74
 
# File 'lib/hati_config/encryption.rb', line 72

def key_size
  @key_size
end

#mode(value = nil) ⇒ Object (readonly)

Sets the encryption mode.

Parameters:

  • value (String) (defaults to: nil) —

    The encryption mode (e.g., "gcm")



84
85
86
 
# File 'lib/hati_config/encryption.rb', line 84

def mode
  @mode
end

Instance Method Details

#decrypt(encrypted_value) ⇒ String

Decrypts a value.

Parameters:

  • encrypted_value (String) —

    The encrypted value in Base64 format

Returns:

  • (String) —

    The decrypted value

Raises:



133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
 
# File 'lib/hati_config/encryption.rb', line 133

def decrypt(encrypted_value)
  raise EncryptionError, 'No key provider configured' unless @key_provider
  return nil if encrypted_value.nil?

  begin
    data = Base64.strict_decode64(encrypted_value)
    cipher = OpenSSL::Cipher.new("#{@algorithm}-#{@key_size}-#{@mode}")
    cipher.decrypt
    cipher.key = @key_provider.key

    if @mode == 'gcm'
      iv = data[0, 12] # GCM uses 12-byte IV
      auth_tag = data[12, 16] # GCM uses 16-byte auth tag
      ciphertext = data[28..]

      cipher.iv = iv
      cipher.auth_tag = auth_tag
      cipher.auth_data = ''

    else
      iv = data[0, 16] # Other modes typically use 16-byte IV
      ciphertext = data[16..]

      cipher.iv = iv
    end
    cipher.update(ciphertext) + cipher.final
  rescue OpenSSL::Cipher::CipherError => e
    raise EncryptionError, "Decryption failed: #{e.message}"
  rescue ArgumentError => e
    raise EncryptionError, "Invalid encrypted value: #{e.message}"
  end
end

#encrypt(value) ⇒ String

Encrypts a value.

Parameters:

  • value (String) —

    The value to encrypt

Returns:

  • (String) —

    The encrypted value in Base64 format

Raises:



98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
 
# File 'lib/hati_config/encryption.rb', line 98

def encrypt(value)
  raise EncryptionError, 'No key provider configured' unless @key_provider

  begin
    cipher = OpenSSL::Cipher.new("#{@algorithm}-#{@key_size}-#{@mode}")
    cipher.encrypt
    cipher.key = @key_provider.key

    if @mode == 'gcm'
      cipher.auth_data = ''
      iv = cipher.random_iv
      cipher.iv = iv
      ciphertext = cipher.update(value.to_s) + cipher.final
      auth_tag = cipher.auth_tag

      # Format: Base64(IV + Auth Tag + Ciphertext)
      Base64.strict_encode64(iv + auth_tag + ciphertext)
    else
      iv = cipher.random_iv
      cipher.iv = iv
      ciphertext = cipher.update(value.to_s) + cipher.final

      # Format: Base64(IV + Ciphertext)
      Base64.strict_encode64(iv + ciphertext)
    end
  rescue OpenSSL::Cipher::CipherError => e
    raise EncryptionError, "Encryption failed: #{e.message}"
  end
end