Skip to content

Commit e493d07

Browse files
shubhangi-googleshubhangi-google
committed
updating code
1 parent 0b76c34 commit e493d07

6 files changed

Lines changed: 100 additions & 113 deletions

File tree

‎google-cloud-storage/acceptance/storage/bucket_encryption_test.rb‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -25,20 +25,17 @@
2525
ENV["GCLOUD_TEST_STORAGE_KMS_KEY_2"] ||
2626
"projects/#{storage.project_id}/locations/#{bucket_location}/keyRings/ruby-test/cryptoKeys/ruby-test-key-2"
2727
}
28+
2829
let(:customer_managed_config) do
29-
Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig.new(
30-
restriction_mode: "NotRestricted"
31-
)
30+
{ restriction_mode: "NotRestricted" }
3231
end
32+
3333
let(:customer_supplied_config) do
34-
Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig.new(
35-
restriction_mode: "FullyRestricted"
36-
)
34+
{ restriction_mode: "FullyRestricted" }
3735
end
36+
3837
let(:google_managed_config) do
39-
Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new(
40-
restriction_mode: "FullyRestricted"
41-
)
38+
{ restriction_mode: "FullyRestricted" }
4239
end
4340

4441
let :bucket do
@@ -90,6 +87,10 @@
9087
end
9188

9289
describe "Encryption Enforcement Config" do
90+
let(:google_managed_config_complete) do
91+
{google_managed_encryption_enforcement_config: { restriction_mode: "FullyRestricted" } }
92+
end
93+
9394
it "knows its encryption enforcement config" do
9495
_(bucket.customer_managed_encryption_enforcement_config).wont_be :nil?
9596
_(bucket.customer_managed_encryption_enforcement_config.restriction_mode).must_equal "NotRestricted"
@@ -103,8 +104,7 @@
103104

104105
bucket.customer_supplied_encryption_enforcement_config = customer_supplied_config
105106
_(bucket.customer_supplied_encryption_enforcement_config.restriction_mode).must_equal "FullyRestricted"
106-
107-
bucket.update_bucket_encryption_enforcement_config google_managed_config
107+
bucket.update_bucket_encryption_enforcement_config google_managed_config_complete
108108
_(bucket.google_managed_encryption_enforcement_config.restriction_mode).must_equal "FullyRestricted"
109109

110110
bucket.reload!

‎google-cloud-storage/lib/google/cloud/storage/bucket.rb‎

Lines changed: 74 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -727,96 +727,99 @@ def default_kms_key= new_default_kms_key
727727
# #
728728
# storage = Google::Cloud::Storage.new
729729
# bucket = storage.bucket "my-bucket"
730-
# bucket.customer_managed_encryption_enforcement_config #=> Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig.new
731-
# restriction_mode: "NotRestricted"
730+
# bucket.customer_managed_encryption_enforcement_config
731+
# ==> #<Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig:0x00007f3b1c102e90 @restriction_mode="NotRestricted">
732732
# The value for `restriction_mode` can be either "NotRestricted" or "FullyRestricted"
733733

734734
def customer_managed_encryption_enforcement_config
735735
@gapi.encryption&.customer_managed_encryption_enforcement_config
736736
end
737737
##
738-
# Sets the bucket's encryption configuration for customer-managed encryption that will be used to protect files.
739-
# @param [Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig, nil] new_customer_managed_encryption_enforcement_config The bucket's encryption configuration, or `nil` to delete the encryption configuration.
740-
# @example
738+
# Sets the customer-managed encryption enforcement configuration for the bucket.
739+
#
740+
# @param new_customer_managed_encryption_enforcement_config [Hash, nil]
741+
# The configuration hash for encryption enforcement.
742+
# * `:restriction_mode` (String) - Can be "NotRestricted" or "FullyRestricted".
743+
# Pass `nil` to clear the current configuration.
744+
#
745+
# @example Enforcing Customer-Managed Encryption
741746
# require "google/cloud/storage"
742-
# #
747+
#
743748
# storage = Google::Cloud::Storage.new
744749
# bucket = storage.bucket "my-bucket"
745-
# new_config = Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig.new restriction_mode: "FullyRestricted"
750+
#
751+
# # Set restriction mode to FullyRestricted
752+
# new_config = { restriction_mode: "FullyRestricted" }
746753
# bucket.customer_managed_encryption_enforcement_config = new_config
747-
# The value for `restriction_mode` can be either "NotRestricted" or "FullyRestricted"
748-
754+
#
755+
# @return [Hash] The updated configuration hash.
756+
# @raise [Google::Cloud::Error] If the update fails due to permissions or invalid arguments.
749757
def customer_managed_encryption_enforcement_config= new_customer_managed_encryption_enforcement_config
750758
@gapi.encryption ||= API::Bucket::Encryption.new
751759
@gapi.encryption.customer_managed_encryption_enforcement_config =
752760
new_customer_managed_encryption_enforcement_config || {}
753761
patch_gapi! :encryption
754762
end
755763

756-
##
757-
# Updates the bucket's encryption enforcement configuration.
758-
#
759-
# @param [Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig, Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig, Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig] incoming_config The new encryption enforcement configuration to apply.
760-
#
761-
# @raise [ArgumentError] If the provided config type is unsupported.
762-
#
763-
# @example
764-
# require "google/cloud/storage"
765-
#
766-
# storage = Google::Cloud::Storage.new
767-
# bucket = storage.bucket "my-bucket"
768-
#
769-
# new_config = Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new restriction_mode: "FullyRestricted"
770-
# bucket.update_bucket_encryption_enforcement_config new_config
771-
#
772-
def update_bucket_encryption_enforcement_config incoming_config
773-
attr_name = case incoming_config
774-
when Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig
775-
:google_managed_encryption_enforcement_config
776-
when Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig
777-
:customer_managed_encryption_enforcement_config
778-
when Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig
779-
:customer_supplied_encryption_enforcement_config
780-
else
781-
raise ArgumentError, "Unsupported config type: #{incoming_config.class}"
782-
end
783-
encryption_patch = Google::Apis::StorageV1::Bucket::Encryption.new
784-
encryption_patch.public_send "#{attr_name}=", incoming_config
785-
patch_gapi! :encryption, bucket_encryption_config: encryption_patch
786-
end
787-
788-
##
789-
# The bucket's encryption configuration for customer-supplied encryption keys. This configuration defines the
790-
# default encryption behavior for the bucket and its files, and it can be used to enforce encryption requirements
791-
# for the bucket.
764+
# Updates the bucket's encryption enforcement configuration.
765+
#
766+
# This method applies a patch to the bucket's encryption settings using the
767+
# provided configuration.
768+
#
769+
# @param incoming_config [Hash, Google::Apis::StorageV1::Bucket::Encryption]
770+
# The encryption configuration to apply. If a Hash is provided, it should
771+
# contain keys corresponding to the encryption enforcement types.
772+
#
773+
# @example Updating to Google-Managed Encryption
774+
# storage = Google::Cloud::Storage.new
775+
# bucket = storage.bucket "my-bucket"
776+
#
777+
# new_config = {
778+
# google_managed_encryption_enforcement_config: { restriction_mode: "NotRestricted" }
779+
# }
780+
#
781+
# bucket.update_bucket_encryption_enforcement_config new_config
782+
#
783+
# @return [void]
784+
# @raise [Google::Cloud::Error] If the API request fails (e.g., insufficient permissions).
785+
def update_bucket_encryption_enforcement_config incoming_config
786+
patch_gapi! :encryption, bucket_encryption_config: incoming_config
787+
end
788+
789+
##
790+
# The bucket's encryption configuration for customer-supplied encryption keys.
792791
# For more information, see [Bucket encryption](https://docs.cloud.google.com/storage/docs/encryption/).
793-
# @return [Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig, nil]
792+
# @return [Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig, nil]
794793
# The bucket's encryption configuration, or `nil` if no encryption configuration has been set.
795794
# @example
796795
# require "google/cloud/storage"
797796
#
798797
# storage = Google::Cloud::Storage.new
799798
# bucket = storage.bucket "my-bucket"
800-
#
801-
# new_config = Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig.new restriction_mode: "NotRestricted"
802-
# bucket.customer_supplied_encryption_enforcement_config = new_config
799+
#
800+
# bucket.customer_supplied_encryption_enforcement_config
801+
# ==> #<Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig:0x00007f3b1c102e90 @restriction_mode="NotRestricted">
803802
# The value for `restriction_mode` can be either "NotRestricted" or "FullyRestricted".
804803

805804
def customer_supplied_encryption_enforcement_config
806805
@gapi.encryption&.customer_supplied_encryption_enforcement_config
807806
end
808807

809808
##
810-
# Sets the bucket's encryption configuration for customer-managed encryption that will be used to protect files.
811-
# @param [Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig, nil] new_customer_supplied_encryption_enforcement_config The bucket's encryption configuration, or `nil` to delete the encryption configuration.
809+
# Sets the bucket's encryption configuration for customer-supplied encryption that will be used to protect files.
810+
# @param new_customer_supplied_encryption_enforcement_config [Hash, nil]
811+
# The configuration hash for encryption enforcement.
812+
# * `:restriction_mode` (String) - Can be "NotRestricted" or "FullyRestricted".
813+
# Pass `nil` to clear the current configuration.
812814
# @example
813815
# require "google/cloud/storage"
814816
#
815817
# storage = Google::Cloud::Storage.new
816818
# bucket = storage.bucket "my-bucket"
817-
# new_config = Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig.new restriction_mode: "FullyRestricted"
819+
# new_config = { restriction_mode: "FullyRestricted" }
818820
# bucket.customer_supplied_encryption_enforcement_config = new_config
819-
# The value for `restriction_mode` can be either "NotRestricted" or "FullyRestricted"
821+
# @return [Hash] The updated configuration hash.
822+
# @raise [Google::Cloud::Error] If the update fails due to permissions or invalid arguments.
820823

821824
def customer_supplied_encryption_enforcement_config= new_customer_supplied_encryption_enforcement_config
822825
@gapi.encryption ||= API::Bucket::Encryption.new
@@ -838,25 +841,34 @@ def customer_supplied_encryption_enforcement_config= new_customer_supplied_encry
838841
#
839842
# storage = Google::Cloud::Storage.new
840843
# bucket = storage.bucket "my-bucket"
841-
# new_config= Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new restriction_mode: "NotRestricted"
842-
# bucket.google_managed_encryption_enforcement_config = new_config
844+
# bucket.google_managed_encryption_enforcement_config
845+
# ==> #<Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig:0x00007f3b1c102e90 @restriction_mode="NotRestricted">
843846
# The value for `restriction_mode` can be either "NotRestricted" or "FullyRestricted".
844847

845848
def google_managed_encryption_enforcement_config
846849
@gapi.encryption&.google_managed_encryption_enforcement_config
847850
end
848851

849852
##
850-
# Sets the bucket's encryption configuration for google-managed encryption that will be used to protect files.
851-
# @param [Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig, nil] new_google_managed_encryption_enforcement_config The bucket's encryption configuration, or `nil` to delete the encryption configuration.
852-
# @example
853+
# Sets the google-managed encryption enforcement configuration for the bucket.
854+
#
855+
# @param new_google_managed_encryption_enforcement_config [Hash, nil]
856+
# The configuration hash for encryption enforcement.
857+
# * `:restriction_mode` (String) - Can be "NotRestricted" or "FullyRestricted".
858+
# Pass `nil` to clear the current configuration.
859+
#
860+
# @example Enforcing Customer-Managed Encryption
853861
# require "google/cloud/storage"
854-
# #
862+
#
855863
# storage = Google::Cloud::Storage.new
856864
# bucket = storage.bucket "my-bucket"
857-
# new_config = Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new restriction_mode: "FullyRestricted"
858-
# bucket.google_managed_encryption_enforcement_config = new_config
859-
# The value for `restriction_mode` can be either "NotRestricted" or "FullyRestricted"
865+
#
866+
# # Set restriction mode to FullyRestricted
867+
# new_config = { restriction_mode: "FullyRestricted" }
868+
# bucket.new_google_managed_encryption_enforcement_config = new_config
869+
#
870+
# @return [Hash] The updated configuration hash.
871+
# @raise [Google::Cloud::Error] If the update fails due to permissions or invalid arguments.
860872

861873
def google_managed_encryption_enforcement_config= new_google_managed_encryption_enforcement_config
862874
@gapi.encryption ||= API::Bucket::Encryption.new

‎google-cloud-storage/samples/storage_set_bucket_encryption_enforcement_config.rb‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,9 @@ def set_bucket_encryption_enforcement_config bucket_name:
2121

2222
storage = Google::Cloud::Storage.new
2323

24-
customer_managed_config =
25-
Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig.new(
26-
restriction_mode: "NotRestricted"
27-
)
28-
customer_supplied_config =
29-
Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig.new(
30-
restriction_mode: "FullyRestricted"
31-
)
32-
google_managed_config =
33-
Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new(
34-
restriction_mode: "FullyRestricted"
35-
)
24+
customer_managed_config = { restriction_mode: "NotRestricted" }
25+
customer_supplied_config = { restriction_mode: "FullyRestricted" }
26+
google_managed_config = { restriction_mode: "FullyRestricted" }
3627

3728
bucket = storage.create_bucket bucket_name do |b|
3829
b.customer_managed_encryption_enforcement_config = customer_managed_config

‎google-cloud-storage/samples/storage_update_bucket_encryption_enforcement_config.rb‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,11 @@ def update_bucket_encryption_enforcement_config bucket_name:
2222

2323
storage = Google::Cloud::Storage.new
2424
bucket = storage.bucket bucket_name
25-
2625
# Update a specific type (e.g., change GMEK to NotRestricted)
27-
google_managed_config =
28-
Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new(
29-
restriction_mode: "NotRestricted"
30-
)
26+
google_managed_config = {
27+
google_managed_encryption_enforcement_config: { restriction_mode: "NotRestricted" }
28+
}
29+
3130
bucket.update_bucket_encryption_enforcement_config google_managed_config
3231

3332
puts "Updated google_managed_config to " \

‎google-cloud-storage/test/google/cloud/storage/bucket_encryption_test.rb‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,6 @@
8989
bucket_gapi_with_key = bucket_gapi.dup
9090
bucket_gapi_with_key.encryption = encryption_gapi(key_name: kms_key)
9191
bucket_with_key = Google::Cloud::Storage::Bucket.from_gapi bucket_gapi_with_key, storage.service
92-
patch_bucket_gapi = Google::Apis::StorageV1::Bucket.new encryption: encryption_gapi(key_name: kms_key)
9392
patch_bucket_gapi = Google::Apis::StorageV1::Bucket.new(
9493
encryption: Google::Apis::StorageV1::Bucket::Encryption.new(
9594
default_kms_key_name: nil
@@ -150,17 +149,19 @@
150149

151150
it "updates encryption_enforcement_config using update_bucket_encryption_enforcement_config" do
152151
mock = Minitest::Mock.new
153-
incoming_config = Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new restriction_mode: "FullyRestricted"
152+
incoming_config = { google_managed_encryption_enforcement_config: { restriction_mode: "FullyRestricted" } }
154153

155154
patch_bucket_gapi = Google::Apis::StorageV1::Bucket.new(
156155
encryption: Google::Apis::StorageV1::Bucket::Encryption.new(
157-
google_managed_encryption_enforcement_config: incoming_config
156+
google_managed_encryption_enforcement_config: Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig.new(
157+
restriction_mode: "FullyRestricted"
158+
)
158159
)
159160
)
160161

161162
returned_bucket_gapi = bucket_gapi.dup
162163
returned_bucket_gapi.encryption = bucket_gapi.encryption.dup
163-
returned_bucket_gapi.encryption.google_managed_encryption_enforcement_config = incoming_config
164+
returned_bucket_gapi.encryption.google_managed_encryption_enforcement_config = patch_bucket_gapi.encryption.google_managed_encryption_enforcement_config
164165
mock.expect :patch_bucket, returned_bucket_gapi, [bucket_name, patch_bucket_gapi], **patch_bucket_args(options: { retries: 0 })
165166

166167
bucket.service.mocked_service = mock
@@ -169,18 +170,13 @@
169170
_(bucket.google_managed_encryption_enforcement_config.restriction_mode).must_equal "NotRestricted"
170171

171172
bucket.update_bucket_encryption_enforcement_config incoming_config
172-
_(bucket.customer_managed_encryption_enforcement_config.restriction_mode).must_equal "FullyRestricted"
173+
_(bucket.customer_managed_encryption_enforcement_config.restriction_mode).must_equal "FullyRestricted"
173174
_(bucket.customer_supplied_encryption_enforcement_config.restriction_mode).must_equal "NotRestricted"
174175
_(bucket.google_managed_encryption_enforcement_config.restriction_mode).must_equal "FullyRestricted"
175176

176177
mock.verify
177178
end
178179

179-
it "raises error on invalid config using update_bucket_encryption_enforcement_config" do
180-
expect {
181-
bucket.update_bucket_encryption_enforcement_config "invalid config"
182-
}.must_raise ArgumentError
183-
end
184180

185181
it "deletes all encryption enforcement configs together and preserves default_kms_key" do
186182
mock = Minitest::Mock.new

‎google-cloud-storage/test/helper.rb‎

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -262,20 +262,9 @@ def google_managed_encryption
262262
)
263263
end
264264

265-
def encryption_gapi(key_name: nil,
266-
customer_managed_config_restriction_mode: nil,
267-
customer_supplied_config_restriction_mode: nil,
268-
google_managed_config_restriction_mode: nil)
269-
270-
cm_config = customer_managed_config(restriction_mode: customer_managed_config_restriction_mode) if customer_managed_config_restriction_mode
271-
cs_config = customer_supplied_config(restriction_mode: customer_supplied_config_restriction_mode) if customer_supplied_config_restriction_mode
272-
gm_config = google_managed_config(restriction_mode: google_managed_config_restriction_mode) if google_managed_config_restriction_mode
273-
265+
def encryption_gapi key_name: nil
274266
params = {
275-
default_kms_key_name: key_name,
276-
customer_managed_encryption_enforcement_config: cm_config,
277-
customer_supplied_encryption_enforcement_config: cs_config,
278-
google_managed_encryption_enforcement_config: gm_config
267+
default_kms_key_name: key_name
279268
}.compact
280269

281270
Google::Apis::StorageV1::Bucket::Encryption.new(**params)

0 commit comments

Comments
 (0)