module Transcryptor

To use Transcryptor, here is a sample migration that showcases this:

class ReencryptUsersAndDocumentsWithNewKeys < ActiveRecord::Migration

def transcryptor
  Transcryptor.init(self)
end

# +keyifier+ mirrors the functionality provided by the :key Proc in
# attr_encrypted.
# NOTE: Has to return the entire Hash.
#
def old_keyifier
  -> opts {
    opts[:key] = ENV['old_master_encryption_key'] + opts[:key]
    opts
  }
end

def new_keyifier
  -> opts {
    opts[:key] = ENV['new_master_encryption_key'] + opts[:key]
    opts
  }
end

def table_column_spec
  {
    users:  {
      id_column: :id,
      columns: {
        email: {
          prefix: 'encrypted_',
          key: :ekey,
        },
        birthday: {
          prefix: 'encrypted_',
          key: :ekey,
        },
      }
    },
    documents:  {
      id_column: :id,
      columns: {
        passphrase: {
          prefix: 'encrypted_',
          key: :ekey,
        },
      }
    },
  }
end

def up
  transcryptor.updown_migrate(
    table_column_spec,
    {
      algorithm:      'aes-256-cbc',
      decode64_value: true,
    }, {
      algorithm:      'aes-256-gcm',
      encode64_iv:    true,
      encode64_value: true,
      iv: true,
    },
    old_keyifier,
    new_keyifier,
  )
end

def down
  transcryptor.updown_migrate(
    table_column_spec,
    {
      algorithm:      'aes-256-gcm',
      decode64_iv:    true,
      decode64_value: true,
    }, {
      algorithm:      'aes-256-cbc',
      iv:             false,
      salt:           false,
      encode64_value: true,
      insecure_mode:  true,
    },
    new_keyifier,
    old_keyifier,
  )
end