I created a gem that acts as a wrapper for a 3rd party API. I now reference that gem in my main rails project. I have a standard pattern of:

TheGem::Client.new(api_key: current_user.account.token)

I can use encrypts :token when handling the sensitive token attribute on the Account model.

However, the gem creates a client and a custom class:

#<TheGem::Client:0x0000000112505628 @adapter=:net_http, @api_key="197a.....7uw">

The same api_key here is listed as an attribute of this custom object created by the gem but I can't make use of built in ActiveRecord encryption (as far as I know) when creating the object. Feels like I'm negating the security effort of encrypts :token but I see this as a pretty common strategy across gems I use. Maybe I'm missing something obvious here.

What is the strategy for handling and filtering out a sensitive attribute on a custom object created from a gem in the same way as encrypts :token?

CodePudding user response：

Based on guidance from @casper I added the following to my gem.

def inspect
  "<TheGem::Client @adapter=#{@adapter}, @api_key="[FILTERED]">"
end