feat(storage): Support bucket encryption config

google-cloud-storage/acceptance/storage/bucket_encryption_test.rb

@@ -25,9 +25,23 @@
     ENV["GCLOUD_TEST_STORAGE_KMS_KEY_2"] ||
       "projects/#{storage.project_id}/locations/#{bucket_location}/keyRings/ruby-test/cryptoKeys/ruby-test-key-2"
   }
+
+  let(:customer_managed_config) do
+    { restriction_mode: "NotRestricted" }
+  end
+
+  let(:customer_supplied_config) do
+    { restriction_mode: "FullyRestricted" }
+  end
+
+  let(:google_managed_config) do
+    { restriction_mode: "FullyRestricted" }
+  end
+
   let :bucket do
-    b = safe_gcs_execute { storage.create_bucket(bucket_name, location: bucket_location) }
+    b = safe_gcs_execute { storage.bucket(bucket_name) || storage.create_bucket(bucket_name, location: bucket_location) }
     b.default_kms_key = kms_key
+    b.customer_managed_encryption_enforcement_config = customer_managed_config
     b
   end
 
@@ -71,4 +85,53 @@
       _(bucket.default_kms_key).must_be :nil?
     end
   end
+
+  describe "Encryption Enforcement Config" do
+    let(:google_managed_config_complete) do
+      {google_managed_encryption_enforcement_config: { restriction_mode: "FullyRestricted" } }
+    end
+
+    it "knows its encryption enforcement config" do
+      _(bucket.customer_managed_encryption_enforcement_config).wont_be :nil?
+      _(bucket.customer_managed_encryption_enforcement_config.restriction_mode).must_equal "NotRestricted"
+      bucket.reload!
+      _(bucket.customer_managed_encryption_enforcement_config).wont_be :nil?
+      _(bucket.customer_managed_encryption_enforcement_config.restriction_mode).must_equal "NotRestricted"
+    end
+
+    it "updates encryption enforcement configs" do
+      _(bucket.customer_supplied_encryption_enforcement_config).must_be :nil?
+
+      bucket.customer_supplied_encryption_enforcement_config = customer_supplied_config
+      _(bucket.customer_supplied_encryption_enforcement_config.restriction_mode).must_equal "FullyRestricted"
+      bucket.update_bucket_encryption_enforcement_config  google_managed_config_complete
+      _(bucket.google_managed_encryption_enforcement_config.restriction_mode).must_equal "FullyRestricted"
+
+      bucket.reload!
+      _(bucket.customer_supplied_encryption_enforcement_config.restriction_mode).must_equal "FullyRestricted"
+      _(bucket.google_managed_encryption_enforcement_config.restriction_mode).must_equal "FullyRestricted"
+    end
+
+    it "deletes all encryption enforcement configs" do
+      # For the update, need to specify all three configs
+      bucket.update do |b|
+        b.customer_supplied_encryption_enforcement_config = customer_supplied_config
+        b.google_managed_encryption_enforcement_config = google_managed_config
+      end
+      _(bucket.customer_managed_encryption_enforcement_config).wont_be :nil?
+      _(bucket.customer_supplied_encryption_enforcement_config).wont_be :nil?
+      _(bucket.google_managed_encryption_enforcement_config).wont_be :nil?
+
+      bucket.update do |b|
+        b.customer_managed_encryption_enforcement_config = nil
+        b.customer_supplied_encryption_enforcement_config = nil
+        b.google_managed_encryption_enforcement_config = nil
+      end
+      # Removed all encryption enforcement configs without removing default_kms_key
+      _(bucket.customer_managed_encryption_enforcement_config).must_be :nil?
+      _(bucket.customer_supplied_encryption_enforcement_config).must_be :nil?
+      _(bucket.google_managed_encryption_enforcement_config).must_be :nil?
+      _(bucket.default_kms_key).must_equal kms_key
+    end
+  end
 end

google-cloud-storage/acceptance/storage/file_encryption_test.rb

@@ -22,7 +22,7 @@
   let(:bucket_location) { "us-central1" }
 
   let :bucket do
-    safe_gcs_execute {storage.create_bucket bucket_name, location: bucket_location }
+    safe_gcs_execute { storage.bucket(bucket_name) || storage.create_bucket(bucket_name, location: bucket_location) }
   end
 
   let(:file_path) { "acceptance/data/abc.txt" }

google-cloud-storage/lib/google/cloud/storage/bucket.rb

@@ -716,6 +716,228 @@ def default_kms_key= new_default_kms_key
             default_kms_key_name: new_default_kms_key
           patch_gapi! :encryption
         end
+        ##
+        # The bucket's encryption configuration for customer-managed encryption keys.
+        # This configuration defines the
+        # default encryption behavior for the bucket and its files, and it can be used to enforce encryption requirements for the bucket.
+        # For more information, see [Bucket encryption](https://docs.cloud.google.com/storage/docs/encryption/).
+        # @return [Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig, nil] The bucket's encryption configuration, or `nil` if no encryption configuration has been set.
+        # @example
+        #   require "google/cloud/storage"
+        #   #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   bucket.customer_managed_encryption_enforcement_config 
+        #   ==> #<Google::Apis::StorageV1::Bucket::Encryption::CustomerManagedEncryptionEnforcementConfig:0x00007f3b1c102e90 @restriction_mode="NotRestricted">
+        #   The value for `restriction_mode` can be either "NotRestricted" or "FullyRestricted"
+
+        def customer_managed_encryption_enforcement_config
+          @gapi.encryption&.customer_managed_encryption_enforcement_config
+        end
+        ##
+        # Sets the customer-managed encryption enforcement configuration for the bucket.
+        #
+        # @param new_customer_managed_encryption_enforcement_config [Hash, nil] 
+        #   The configuration hash for encryption enforcement. 
+        #   * `:restriction_mode` (String) - Can be "NotRestricted" or "FullyRestricted".
+        #   Pass `nil` to clear the current configuration.
+        #
+        # @example Enforcing Customer-Managed Encryption
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #
+        #   # Set restriction mode to FullyRestricted
+        #   new_config = { restriction_mode: "FullyRestricted" }
+        #   bucket.customer_managed_encryption_enforcement_config = new_config
+        #
+        # @example Setting via Request Object (Google API Client)
+        #   require "google/apis/storage_v1"
+        #
+        #   enforcement_config = { restriction_mode: "FullyRestricted" }
+        #   
+        #   request_obj = Google::Apis::StorageV1::Bucket::Encryption.new(
+        #     customer_managed_encryption_enforcement_config: enforcement_config
+        #   )
+        #   bucket.customer_managed_encryption_enforcement_config = request_obj
+        #
+        # @return [Hash, Google::Apis::StorageV1::Bucket::Encryption] The updated configuration.
+        # @raise [Google::Cloud::Error] If the update fails due to permissions or invalid arguments.
+        def customer_managed_encryption_enforcement_config= new_customer_managed_encryption_enforcement_config
+          @gapi.encryption ||= API::Bucket::Encryption.new
+          @gapi.encryption.customer_managed_encryption_enforcement_config =
+            new_customer_managed_encryption_enforcement_config || {}
+          patch_gapi! :encryption
+        end
+
+        # Updates the bucket's encryption enforcement configuration.
+        #
+        # This method applies a patch to the bucket's encryption settings using the 
+        # provided configuration.
+        #
+        # @param incoming_config [Hash, Google::Apis::StorageV1::Bucket::Encryption] 
+        #   The encryption configuration to apply. If a Hash is provided, it should 
+        #   contain keys corresponding to the encryption enforcement types.
+        #
+        # @example Updating to Google-Managed Encryption
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #
+        #   new_config = {
+        #     google_managed_encryption_enforcement_config: { restriction_mode: "NotRestricted" }
+        #   }
+        #
+        #   bucket.update_bucket_encryption_enforcement_config new_config
+        #
+        # @example Passing a Request Object
+        #   require "google/apis/storage_v1"
+        #   config_obj = Google::Apis::StorageV1::Bucket::Encryption.new(
+        #     google_managed_encryption_enforcement_config: { restriction_mode: "NotRestricted" }
+        #   )
+        #   bucket.update_bucket_encryption_enforcement_config config_obj
+        # @raise [ArgumentError] If the config is empty, contains invalid keys, or is the wrong type.
+        def update_bucket_encryption_enforcement_config incoming_config
+          allowed_keys = [
+            :google_managed_encryption_enforcement_config,
+            :customer_managed_encryption_enforcement_config,
+            :customer_supplied_encryption_enforcement_config
+          ]
+
+          if incoming_config.is_a? Hash
+            input_keys = incoming_config.keys
+            raise ArgumentError, "Config cannot be empty" if input_keys.empty?
+
+            extra_keys = input_keys - allowed_keys
+            unless extra_keys.empty?
+              raise ArgumentError, "Invalid config detected: #{extra_keys.join(', ')}. " \
+                                  "Only #{allowed_keys.join(', ')} are allowed."
+            end
+
+          elsif incoming_config.is_a? Google::Apis::StorageV1::Bucket::Encryption
+            # For objects, ensure at least one of the allowed enforcement configs is present
+            has_any_config = allowed_keys.any? { |key| !incoming_config.send(key).nil? }
+            binding.pry
+            raise ArgumentError, "Encryption request object must have at least one enforcement config set" unless has_any_config
+
+          else
+            raise ArgumentError, "incoming_config must be a Hash or Google::Apis::StorageV1::Bucket::Encryption"
+          end
+
+          patch_gapi! :encryption, bucket_encryption_config: incoming_config
+        end
+
+        ##
+        # The bucket's encryption configuration for customer-supplied encryption keys.
+        # For more information, see [Bucket encryption](https://docs.cloud.google.com/storage/docs/encryption/).
+        # @return [Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig, nil]
+        # The bucket's encryption configuration, or `nil` if no encryption configuration has been set.
+        # @example
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #
+        #   bucket.customer_supplied_encryption_enforcement_config 
+        #     ==> #<Google::Apis::StorageV1::Bucket::Encryption::CustomerSuppliedEncryptionEnforcementConfig:0x00007f3b1c102e90 @restriction_mode="NotRestricted">
+        #   The value for `restriction_mode` can be either "NotRestricted" or "FullyRestricted".
+
+        def customer_supplied_encryption_enforcement_config
+          @gapi.encryption&.customer_supplied_encryption_enforcement_config
+        end
+
+        ##
+        # Sets the bucket's encryption configuration for customer-supplied encryption that will be used to protect files.
+        # @param new_customer_supplied_encryption_enforcement_config [Hash, nil]
+        #   The configuration hash for encryption enforcement. 
+        #   * `:restriction_mode` (String) - Can be "NotRestricted" or "FullyRestricted".
+        #   Pass `nil` to clear the current configuration.
+        # @example
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   new_config = { restriction_mode: "FullyRestricted" }
+        #   bucket.customer_supplied_encryption_enforcement_config = new_config
+        #
+        # @example Setting via Request Object (Google API Client)
+        #   require "google/apis/storage_v1"
+        #
+        #   enforcement_config = { restriction_mode: "FullyRestricted" }
+        #   
+        #   request_obj = Google::Apis::StorageV1::Bucket::Encryption.new(
+        #     customer_supplied_encryption_enforcement_config: enforcement_config
+        #   )
+        #   bucket.customer_supplied_encryption_enforcement_config = request_obj
+        #
+        # @return [Hash, Google::Apis::StorageV1::Bucket::Encryption] The updated configuration.
+        # @raise [Google::Cloud::Error] If the update fails due to permissions or invalid arguments.
+
+        def customer_supplied_encryption_enforcement_config= new_customer_supplied_encryption_enforcement_config
+          @gapi.encryption ||= API::Bucket::Encryption.new
+          @gapi.encryption.customer_supplied_encryption_enforcement_config =
+            new_customer_supplied_encryption_enforcement_config || {}
+          patch_gapi! :encryption
+        end
+
+        ##
+        # The bucket's encryption configuration for google-managed encryption keys.
+        # This configuration defines the
+        # default encryption behavior for the bucket and its files, and it can be used to enforce encryption
+        # requirements for the bucket.
+        # For more information, see [Bucket encryption](https://docs.cloud.google.com/storage/docs/encryption/).
+        # @return [Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig, nil]
+        # The bucket's encryption configuration, or `nil` if no encryption configuration has been set.
+        # @example
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #   bucket.google_managed_encryption_enforcement_config
+        #   ==> #<Google::Apis::StorageV1::Bucket::Encryption::GoogleManagedEncryptionEnforcementConfig:0x00007f3b1c102e90 @restriction_mode="NotRestricted">
+        #   The value for `restriction_mode` can be either "NotRestricted" or "FullyRestricted".
+
+        def google_managed_encryption_enforcement_config
+          @gapi.encryption&.google_managed_encryption_enforcement_config
+        end
+
+        ##
+        # Sets the google-managed encryption enforcement configuration for the bucket.
+        #
+        # @param new_google_managed_encryption_enforcement_config [Hash, nil] 
+        #   The configuration hash for encryption enforcement. 
+        #   * `:restriction_mode` (String) - Can be "NotRestricted" or "FullyRestricted".
+        #   Pass `nil` to clear the current configuration.
+        #
+        # @example Enforcing Customer-Managed Encryption
+        #   require "google/cloud/storage"
+        #
+        #   storage = Google::Cloud::Storage.new
+        #   bucket = storage.bucket "my-bucket"
+        #
+        #   # Set restriction mode to FullyRestricted
+        #   new_config = { restriction_mode: "FullyRestricted" }
+        #   bucket.new_google_managed_encryption_enforcement_config = new_config
+        #
+        # @example Setting via Request Object (Google API Client)
+        #   require "google/apis/storage_v1"
+        #
+        #   enforcement_config = { restriction_mode: "FullyRestricted" }
+        #   
+        #   request_obj = Google::Apis::StorageV1::Bucket::Encryption.new(
+        #     google_managed_encryption_enforcement_config: enforcement_config
+        #   )
+        #   bucket.google_managed_encryption_enforcement_config = request_obj
+        #
+        # @return [Hash, Google::Apis::StorageV1::Bucket::Encryption] The updated configuration.
+        # @raise [Google::Cloud::Error] If the update fails due to permissions or invalid arguments.
+
+        def google_managed_encryption_enforcement_config= new_google_managed_encryption_enforcement_config
+          @gapi.encryption ||= API::Bucket::Encryption.new
+          @gapi.encryption.google_managed_encryption_enforcement_config =
+            new_google_managed_encryption_enforcement_config || {}
+          patch_gapi! :encryption
+        end
 
         ##
         # The period of time (in seconds) that files in the bucket must be
@@ -3252,13 +3474,18 @@ def ensure_gapi!
 
         def patch_gapi! attributes,
                         if_metageneration_match: nil,
-                        if_metageneration_not_match: nil
+                        if_metageneration_not_match: nil,
+                        bucket_encryption_config: nil
           attributes = Array(attributes)
           attributes.flatten!
           return if attributes.empty?
           ensure_service!
           patch_args = attributes.to_h do |attr|
-            [attr, @gapi.send(attr)]
+            if bucket_encryption_config
+              [attr, bucket_encryption_config]
+            else
+              [attr, @gapi.send(attr)]
+            end
           end
           patch_gapi = API::Bucket.new(**patch_args)
           @gapi = service.patch_bucket name,

google-cloud-storage/samples/Gemfile

@@ -36,3 +36,7 @@ group :test do
   gem "minitest-hooks", "~> 1.5"
   gem "rake"
 end
+# The following gems have been removed from ruby core and are required for testing.
+gem "ostruct"
+gem "cgi"
+gem "irb"