hashicorp / vault-rails

A Rails plugin for easily integrating Vault secrets
Mozilla Public License 2.0
339 stars 53 forks source link

Drop Rails 4.2 support #108

Closed chrisarcand closed 4 years ago

chrisarcand commented 4 years ago

Description

These changes:


In #67, Rails 5+ support was added in the form of ditching our own dirty attribute logic and instead utilizing the fancy new Attributes API, which was officially introduced in Rails 5 but present (sorta) in Rails 4.2 as well. This very obviously cut off support of vault-rails for Rails 4.1, which doesn't have this API at all. Tests passed for Rails 4.2, so it looked good.

However, the Attributes API in Rails 4.2 is actually totally private API - it's no more than a refactoring in anticipation of the real API in 5, and some of the API was accidentally exposed in documentation anyway in the 4.2 release.

The whole point of the Attributes API is to provide a separation between ActiveModel attributes and the real database columns behind them (if any!), allowing you to flexibly cast types when putting and retrieving data from the database. However, in Rails 4.2 the API is simply a refactoring and the separation there doesn't exist: attributes are one-to-one with database columns.

When vault-rails began to use the Attributes API in 0.6.0, a subtle behavior change occurred (for all versions of Rails): a vault_attribute is now registered as a real model attribute.

This change is fine...in Rails 5+. In modern versions, ActiveRecord is smart enough to know that this defined attribute is not backed by a database column, and is omitted from things that expect a column to exist.

In Rails 4.2, it's not. The newly discovered attribute is expected to be backed by a database column, and things depend heavily on this expectation. This is evident via complex queries utilizing joins and where conditions, which generate aliases through intermediate tables, e.g.:

SELECT "dogs"."id" AS t0_r0, "dogs"."owner_id" AS t0_r1, ........

These queries are generated with a model's columns in mind, so you will now get an error with 0.6.0 and Rails 4.2 (where current_thought is a vault_attribute):

ActiveRecord::StatementInvalid: PG::UndefinedColumn: ERROR:  column dogs.current_thought does not exist
LINE 1: ...AS t3_r38, "dogs"."current_thought" AS t3_r39, "dogs"."u...

Conclusion: As Rails 4.2 is long EOL'd anyway and we do not wish to maintain the old implementation alongside using the Attributes API for that single old Rails version, I propose 0.6.x as supporting only Rails 5+, and 0.5.0 will be the last known compatible version with Rails =< 4.2.