Move column validation to method execution to prevent migration issues, discussed in #1

Author: atyndall

lib/kms_rails/active_record.rb

@@ -14,12 +14,13 @@ def kms_attr(field, key_id:, retain: false, msgpack: false, context_key: nil, co
         include InstanceMethods
 
         real_field = "#{field}_enc"
-        raise RuntimeError, "Field '#{real_field}' must exist to store encrypted data" unless self.column_names.include?(real_field)
-        raise RuntimeError, "Field '#{field}' must not be a real column, '#{real_field}' is the real column" if self.column_names.include?(field)
+        raise RuntimeError, "Field '#{field}' must not be a real column, '#{real_field}' is the real column" if self.column_names.include?(field.to_s)
 
         enc = Core.new(key_id: key_id, msgpack: msgpack, context_key: context_key, context_value: context_value)
 
         define_method "#{field}=" do |data|
+          raise RuntimeError, "Field '#{real_field}' must exist to store encrypted data" unless self.class.column_names.include?(real_field)
+
           if data.blank? # Just set to nil if nil
             clear_retained(field)
             self[real_field] = nil
@@ -34,10 +35,13 @@ def kms_attr(field, key_id:, retain: false, msgpack: false, context_key: nil, co
         end
 
         define_method "#{real_field}" do
+          raise RuntimeError, "Field '#{real_field}' must exist to retrieve encrypted data" unless self.class.column_names.include?(real_field)
           Core.to64( get_hash(field) )
         end
 
         define_method "#{field}" do
+          raise RuntimeError, "Field '#{real_field}' must exist to retrieve decrypted data" unless self.class.column_names.include?(real_field)
+
           hash = get_hash(field)
           return nil unless hash
 

spec/kms_rails/active_record_spec.rb

@@ -50,7 +50,6 @@
 
   context '::kms_attr' do
     let(:model) { NormalModelNoRetain }
-    subject { model.kms_attr :the_secret, key_id: 'a' }
 
     it 'defines the_secret fields' do
       expect(model.instance_methods).to include(
@@ -59,29 +58,45 @@
     end
 
     context '_enc field doens\'t exist' do 
-      let (:model) { NoEncModel }
-
       with_model :NoEncModel do
         table do |t|
           t.string :secret_name
         end
       end
 
-      it 'throws an exception' do
-        expect { subject }.to raise_error(RuntimeError)
+      let(:model) { NoEncModel }
+
+      before do
+        model.kms_attr :the_secret, key_id: 'a'
+      end
+
+      subject { model.new }
+
+      it 'throws an exception on retrieve' do
+        expect { subject.the_secret }.to raise_error(RuntimeError)
+      end
+
+      it 'throws an exception on set' do
+        expect { subject.the_secret = 'foo' }.to raise_error(RuntimeError)
+      end
+
+      it 'throws an exception on real retrieve' do
+        expect { subject.the_secret_enc }.to raise_error(RuntimeError)
       end
     end
 
     context 'real field exists' do
-      let (:model) { RealFieldModel }
-
       with_model :RealFieldModel do
         table do |t|
           t.string :secret_name
           t.binary :the_secret
+          t.binary :the_borker
         end
       end
 
+      let (:model) { RealFieldModel }
+      subject { model.kms_attr :the_secret, key_id: 'a' }
+
       it 'throws an exception' do
         expect { subject }.to raise_error(RuntimeError)
       end