README.md in lockbox-0.2.3 vs README.md in lockbox-0.2.4

- old
+ new

@@ -44,10 +44,12 @@ Alternatively, you can use a [key management service](#key-management) to manage your keys. ## Database Fields +### Active Record + Create a migration with: ```ruby class AddEmailCiphertextToUsers < ActiveRecord::Migration[5.2] def change @@ -70,11 +72,11 @@ User.create!(email: "hi@example.org") ``` If you need to query encrypted fields, check out [Blind Index](https://github.com/ankane/blind_index). -### Types +#### Types Specify the type of a field with: ```ruby class User < ApplicationRecord @@ -99,14 +101,34 @@ serialize :properties, JSON encrypts :properties end ``` -### Validations +#### Validations Validations work as expected with the exception of uniqueness. Uniqueness validations require a [blind index](https://github.com/ankane/blind_index). +### Mongoid + +Add to your model: + +```ruby +class User + field :email_ciphertext, type: String + + encrypts :email +end +``` + +You can use `email` just like any other attribute. + +```ruby +User.create!(email: "hi@example.org") +``` + +If you need to query encrypted fields, check out [Blind Index](https://github.com/ankane/blind_index). + ## Files ### Active Storage Add to your model: @@ -138,40 +160,61 @@ def license send_data @user.license.download, type: @user.license.content_type end ``` -**Note:** With Rails 6, attachments are not encrypted with: +### CarrierWave +Add to your uploader: + ```ruby -User.create!(avatar: params[:avatar]) +class LicenseUploader < CarrierWave::Uploader::Base + encrypt +end ``` -Until this is addressed, use: +Encryption is applied to all versions after processing. +To serve encrypted files, use a controller action. + ```ruby -user = User.new -user.attach(params[:avatar]) -user.save! +def license + send_data @user.license.read, type: @user.license.content_type +end ``` -### CarrierWave +### Shrine -Add to your uploader: +Create a box ```ruby -class LicenseUploader < CarrierWave::Uploader::Base - encrypt -end +box = Lockbox.new(key: key) ``` -Encryption is applied to all versions after processing. +Encrypt files before passing them to Shrine +```ruby +LicenseUploader.upload(box.encrypt_io(file), :store) +``` + +And decrypt them after reading + +```ruby +box.decrypt(uploaded_file.read) +``` + +For models, encrypt with: + +```ruby +license = params.require(:user).fetch(:license) +@user.license = box.encrypt_io(license) +``` + To serve encrypted files, use a controller action. ```ruby def license - send_data @user.license.read, type: @user.license.content_type + send_data box.decrypt(@user.license.read), type: @user.license.mime_type end ``` ### Local Files