diff --git a/lib/vault/encrypted_model.rb b/lib/vault/encrypted_model.rb index 401ed045..ded8da22 100644 --- a/lib/vault/encrypted_model.rb +++ b/lib/vault/encrypted_model.rb @@ -42,7 +42,7 @@ module ClassMethods # a proc to encode the value with # @option options [Proc] :decode # a proc to decode the value with - # @option options [Hash, String] :transform_secret + # @option options [Hash] :transform_secret # a hash providing details about a transformation to use, # or a name of an existing transformation def vault_attribute(attribute, options = {}) @@ -345,6 +345,8 @@ def __vault_persist_attribute!(attribute, options) generated_context = __vault_generate_context(context) if transform + # If this is a secret encrypted with FPE, we should not encrypt it in vault + # This prevents a double encryption via standard vault encryption and FPE. ciphertext = plaintext else # Generate the ciphertext and store it back as an attribute