Class: OpenLoam::Encryption::KeyProvider

Inherits:
Object
  • Object
show all
Defined in:
lib/open_loam/encryption/key_provider.rb

Overview

The seam a real KMS plugs into. A provider turns (scope, purpose) into a 32-byte data key; swap the default for a Vault/AWS-KMS-backed provider via OpenLoam::Encryption.key_provider = MyKmsProvider.new and NO call site changes — Cipher and Encryptable only ever ask for a key.

scope is a namespaced owner string: "tenant/5" for an entity field, "user/12" for genuinely user-owned data (an MFA secret) that must decrypt regardless of which tenant the user is currently acting in.

Direct Known Subclasses

HkdfKeyProvider

Instance Method Summary collapse

Instance Method Details

#data_key(scope:, purpose:) ⇒ Object

Raises:

  • (NotImplementedError) 


12
13
14
 
# File 'lib/open_loam/encryption/key_provider.rb', line 12

def data_key(scope:, purpose:)
  raise NotImplementedError, "#{self.class} must implement #data_key(scope:, purpose:)"
end