Class: WatchList::Secure

Inherits:
Object
  • Object
show all
Defined in:
lib/watch_list/secure.rb

Constant Summary collapse

CIPHER_NAME = 
'AES-256-CBC'

Class Method Summary collapse

Class Method Details

.decrypt(pass, salt, encrypted) ⇒ Object 



23
24
25
26
27
28
29
 
# File 'lib/watch_list/secure.rb', line 23

def decrypt(pass, salt, encrypted)
  encrypted = Base64.strict_decode64(encrypted)
  cipher = OpenSSL::Cipher.new(CIPHER_NAME)
  cipher.decrypt
  set_key_iv(pass, salt, cipher)
  cipher.update(encrypted) + cipher.final
end

.decrypt_if_possible(value) ⇒ Object 



61
62
63
64
65
66
67
 
# File 'lib/watch_list/secure.rb', line 61

def decrypt_if_possible(value)
  if git_encryptable? and encrypted_value?(value)
    git_decrypt(value)
  else
    value
  end
end

.encrypt(pass, salt, data) ⇒ Object 



15
16
17
18
19
20
21
 
# File 'lib/watch_list/secure.rb', line 15

def encrypt(pass, salt, data)
  cipher = OpenSSL::Cipher.new(CIPHER_NAME)
  cipher.encrypt
  set_key_iv(pass, salt, cipher)
  encrypted = cipher.update(data) + cipher.final
  Base64.strict_encode64(encrypted)
end

.encrypted_value?(value) ⇒ Boolean

Returns:

  • (Boolean) 


57
58
59
 
# File 'lib/watch_list/secure.rb', line 57

def encrypted_value?(value)
  value.kind_of?(Hash) and value.has_key?(:secure)
end

.get_pass_salt_from_git(options = {}) ⇒ Object 



40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/watch_list/secure.rb', line 40

def get_pass_salt_from_git(options = {})
  pass = `git config watch-list.pass`.strip
  salt = `git config watch-list.salt`.strip

  if options[:validate]
    raise 'cannot get "watch-list.pass" from git config' if pass.empty?
    raise 'cannot get "watch-list.salt" from git config' if salt.empty?
  end

  [pass, salt]
end

.git_decrypt(data) ⇒ Object 



10
11
12
13
 
# File 'lib/watch_list/secure.rb', line 10

def git_decrypt(data)
  pass, salt = get_pass_salt_from_git(:validate => true)
  decrypt(pass, salt, data.fetch(:secure))
end

.git_encrypt(data) ⇒ Object 



5
6
7
8
 
# File 'lib/watch_list/secure.rb', line 5

def git_encrypt(data)
  pass, salt = get_pass_salt_from_git(:validate => true)
  {:secure => encrypt(pass, salt, data)}
end

.git_encryptable? ⇒ Boolean

Returns:

  • (Boolean) 


52
53
54
55
 
# File 'lib/watch_list/secure.rb', line 52

def git_encryptable?
  pass, salt = get_pass_salt_from_git
  not pass.empty? and not salt.empty?
end

.set_key_iv(pass, salt, cipher) ⇒ Object 



31
32
33
34
35
36
37
38
 
# File 'lib/watch_list/secure.rb', line 31

def set_key_iv(pass, salt, cipher)
  salt = Base64.strict_decode64(salt)
  key_iv = OpenSSL::PKCS5.pbkdf2_hmac_sha1(pass, salt, 2000, cipher.key_len + cipher.iv_len)
  key = key_iv[0, cipher.key_len]
  iv = key_iv[cipher.key_len, cipher.iv_len]
  cipher.key = key
  cipher.iv = iv
end