README.md in lockbox-0.2.3 vs README.md in lockbox-0.2.4
- old
+ new
@@ -44,10 +44,12 @@
Alternatively, you can use a [key management service](#key-management) to manage your keys.
## Database Fields
+### Active Record
+
Create a migration with:
```ruby
class AddEmailCiphertextToUsers < ActiveRecord::Migration[5.2]
def change
@@ -70,11 +72,11 @@
User.create!(email: "hi@example.org")
```
If you need to query encrypted fields, check out [Blind Index](https://github.com/ankane/blind_index).
-### Types
+#### Types
Specify the type of a field with:
```ruby
class User < ApplicationRecord
@@ -99,14 +101,34 @@
serialize :properties, JSON
encrypts :properties
end
```
-### Validations
+#### Validations
Validations work as expected with the exception of uniqueness. Uniqueness validations require a [blind index](https://github.com/ankane/blind_index).
+### Mongoid
+
+Add to your model:
+
+```ruby
+class User
+ field :email_ciphertext, type: String
+
+ encrypts :email
+end
+```
+
+You can use `email` just like any other attribute.
+
+```ruby
+User.create!(email: "hi@example.org")
+```
+
+If you need to query encrypted fields, check out [Blind Index](https://github.com/ankane/blind_index).
+
## Files
### Active Storage
Add to your model:
@@ -138,40 +160,61 @@
def license
send_data @user.license.download, type: @user.license.content_type
end
```
-**Note:** With Rails 6, attachments are not encrypted with:
+### CarrierWave
+Add to your uploader:
+
```ruby
-User.create!(avatar: params[:avatar])
+class LicenseUploader < CarrierWave::Uploader::Base
+ encrypt
+end
```
-Until this is addressed, use:
+Encryption is applied to all versions after processing.
+To serve encrypted files, use a controller action.
+
```ruby
-user = User.new
-user.attach(params[:avatar])
-user.save!
+def license
+ send_data @user.license.read, type: @user.license.content_type
+end
```
-### CarrierWave
+### Shrine
-Add to your uploader:
+Create a box
```ruby
-class LicenseUploader < CarrierWave::Uploader::Base
- encrypt
-end
+box = Lockbox.new(key: key)
```
-Encryption is applied to all versions after processing.
+Encrypt files before passing them to Shrine
+```ruby
+LicenseUploader.upload(box.encrypt_io(file), :store)
+```
+
+And decrypt them after reading
+
+```ruby
+box.decrypt(uploaded_file.read)
+```
+
+For models, encrypt with:
+
+```ruby
+license = params.require(:user).fetch(:license)
+@user.license = box.encrypt_io(license)
+```
+
To serve encrypted files, use a controller action.
```ruby
def license
- send_data @user.license.read, type: @user.license.content_type
+ send_data box.decrypt(@user.license.read), type: @user.license.mime_type
end
```
### Local Files