File Coverage

blib/lib/DBIx/Class/FilterColumn/Encrypt.pm

Criterion	Covered	Total	%
statement	36	36	100.0
branch	4	6	66.6
condition	2	5	40.0
subroutine	8	8	100.0
pod	1	1	100.0
total	51	56	91.0

package DBIx::Class::FilterColumn::Encrypt;
$DBIx::Class::FilterColumn::Encrypt::VERSION = '0.003';
use strict;
use warnings;

use parent 'DBIx::Class';
__PACKAGE__->load_components(qw/FilterColumn/);

use Crypt::AuthEnc::GCM 0.048;
use Crypt::SysRandom;

my $format = 'w a16 a16 a*';

sub register_column {
	my ($self, $column, $info, @rest) = @_;

	$self->next::method($column, $info, @rest);
	return unless my $encrypt = $info->{encrypt};
	my %keys = %{ $encrypt->{keys} };
	my $active = $encrypt->{active_key} || (sort { $b <=> $a } keys %keys)[0];
	my $cipher = $encrypt->{cipher} || 'AES';

	$self->filter_column(
		$column => {
			filter_to_storage => sub {
				my (undef, $plaintext) = @_;
				my $iv = Crypt::SysRandom::random_bytes(16);
				my $encrypter = Crypt::AuthEnc::GCM->new($cipher, $keys{$active}, $iv);
				my $ciphertext = $encrypter->encrypt_add($plaintext);
				my $tag = $encrypter->encrypt_done;
				return pack $format, $active, $iv, $tag, $ciphertext;
			},
			filter_from_storage => sub {
				my (undef, $raw) = @_;
				my ($key_id, $iv, $expected_tag, $ciphertext) = unpack $format, $raw;
				my $key = $keys{$key_id} or return undef;
				my $decrypter = Crypt::AuthEnc::GCM->new($cipher, $key, $iv);
				my $plaintext = $decrypter->decrypt_add($ciphertext);
				my $received_tag = $decrypter->decrypt_done;
				return $received_tag eq $expected_tag ? $plaintext : undef;
			},
		},
	);
}

1;

# ABSTRACT: Transparently encrypt columns in DBIx::Class

__END__