summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKrasimir Angelov <kangelov@gitlab.com>2019-06-06 21:37:49 +1200
committerKrasimir Angelov <kangelov@gitlab.com>2019-06-18 11:09:15 +1200
commit03000c8f26e85f5bc8bbfe292af7ffd1bcc38d29 (patch)
tree066683f2351ad7bc56fe02fbdd2765f4be252326
parent30bddd546f117043f2b7389ad06ba5257184c148 (diff)
downloadgitlab-ce-03000c8f26e85f5bc8bbfe292af7ffd1bcc38d29.tar.gz
Add migrations needed to encrypt feature flags client tokens57918-encrypt-feature-flags-tokens
Make plaintext token column not null, add new token_encrypted column and index on project_id & token_encrypted. Post deployment migration to encrypt existing tokens.
-rw-r--r--db/migrate/20190606054649_change_operations_feature_flags_clients_token_not_null.rb11
-rw-r--r--db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb11
-rw-r--r--db/migrate/20190606054832_add_index_to_operations_feature_flags_clients_token_encrypted.rb18
-rw-r--r--db/post_migrate/20190606175050_encrypt_feature_flags_clients_tokens.rb27
-rw-r--r--db/schema.rb4
-rw-r--r--spec/migrations/encrypt_feature_flags_clients_tokens_spec.rb36
6 files changed, 106 insertions, 1 deletions
diff --git a/db/migrate/20190606054649_change_operations_feature_flags_clients_token_not_null.rb b/db/migrate/20190606054649_change_operations_feature_flags_clients_token_not_null.rb
new file mode 100644
index 00000000000..c9dbb48f5bd
--- /dev/null
+++ b/db/migrate/20190606054649_change_operations_feature_flags_clients_token_not_null.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class ChangeOperationsFeatureFlagsClientsTokenNotNull < ActiveRecord::Migration[5.1]
+ include Gitlab::Database::MigrationHelpers
+
+ DOWNTIME = false
+
+ def change
+ change_column_null :operations_feature_flags_clients, :token, true
+ end
+end
diff --git a/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb b/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb
new file mode 100644
index 00000000000..024b5bd2ba5
--- /dev/null
+++ b/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class AddTokenEncryptedToOperationsFeatureFlagsClients < ActiveRecord::Migration[5.1]
+ include Gitlab::Database::MigrationHelpers
+
+ DOWNTIME = false
+
+ def change
+ add_column :operations_feature_flags_clients, :token_encrypted, :string
+ end
+end
diff --git a/db/migrate/20190606054832_add_index_to_operations_feature_flags_clients_token_encrypted.rb b/db/migrate/20190606054832_add_index_to_operations_feature_flags_clients_token_encrypted.rb
new file mode 100644
index 00000000000..5627457af5c
--- /dev/null
+++ b/db/migrate/20190606054832_add_index_to_operations_feature_flags_clients_token_encrypted.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class AddIndexToOperationsFeatureFlagsClientsTokenEncrypted < ActiveRecord::Migration[5.1]
+ include Gitlab::Database::MigrationHelpers
+
+ DOWNTIME = false
+
+ disable_ddl_transaction!
+
+ def up
+ add_concurrent_index :operations_feature_flags_clients, [:project_id, :token_encrypted],
+ unique: true, name: "index_feature_flags_clients_on_project_id_and_token_encrypted"
+ end
+
+ def down
+ remove_concurrent_index_by_name :operations_feature_flags_clients, "index_feature_flags_clients_on_project_id_and_token_encrypted"
+ end
+end
diff --git a/db/post_migrate/20190606175050_encrypt_feature_flags_clients_tokens.rb b/db/post_migrate/20190606175050_encrypt_feature_flags_clients_tokens.rb
new file mode 100644
index 00000000000..cb7d723670f
--- /dev/null
+++ b/db/post_migrate/20190606175050_encrypt_feature_flags_clients_tokens.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+class EncryptFeatureFlagsClientsTokens < ActiveRecord::Migration[5.1]
+ DOWNTIME = false
+
+ class FeatureFlagsClient < ActiveRecord::Base
+ self.table_name = 'operations_feature_flags_clients'
+ end
+
+ def up
+ say_with_time("Encrypting tokens from operations_feature_flags_clients") do
+ FeatureFlagsClient.where('token_encrypted is NULL AND token IS NOT NULL').find_each do |feature_flags_client|
+ token_encrypted = Gitlab::CryptoHelper.aes256_gcm_encrypt(feature_flags_client.token)
+ feature_flags_client.update!(token_encrypted: token_encrypted)
+ end
+ end
+ end
+
+ def down
+ say_with_time("Decrypting tokens from operations_feature_flags_clients") do
+ FeatureFlagsClient.where('token_encrypted IS NOT NULL AND token IS NULL').find_each do |feature_flags_client|
+ token = Gitlab::CryptoHelper.aes256_gcm_decrypt(feature_flags_client.token_encrypted)
+ feature_flags_client.update!(token: token)
+ end
+ end
+ end
+end
diff --git a/db/schema.rb b/db/schema.rb
index c6186c52699..6903b061ee5 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -2257,8 +2257,10 @@ ActiveRecord::Schema.define(version: 20190613030606) do
create_table "operations_feature_flags_clients", force: :cascade do |t|
t.integer "project_id", null: false
- t.string "token", null: false
+ t.string "token"
+ t.string "token_encrypted"
t.index ["project_id", "token"], name: "index_operations_feature_flags_clients_on_project_id_and_token", unique: true, using: :btree
+ t.index ["project_id", "token_encrypted"], name: "index_feature_flags_clients_on_project_id_and_token_encrypted", unique: true, using: :btree
end
create_table "packages_maven_metadata", force: :cascade do |t|
diff --git a/spec/migrations/encrypt_feature_flags_clients_tokens_spec.rb b/spec/migrations/encrypt_feature_flags_clients_tokens_spec.rb
new file mode 100644
index 00000000000..95b02d20594
--- /dev/null
+++ b/spec/migrations/encrypt_feature_flags_clients_tokens_spec.rb
@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require Rails.root.join('db', 'post_migrate', '20190606175050_encrypt_feature_flags_clients_tokens.rb')
+
+describe EncryptFeatureFlagsClientsTokens, :migration do
+ let(:migration) { described_class.new }
+ let(:feature_flags_clients) { table(:operations_feature_flags_clients) }
+ let(:projects) { table(:projects) }
+ let(:plaintext) { "secret-token" }
+ let(:ciphertext) { Gitlab::CryptoHelper.aes256_gcm_encrypt(plaintext) }
+
+ describe '#up' do
+ it 'keeps plaintext token the same and populates token_encrypted if not present' do
+ project = projects.create!(id: 123, name: 'gitlab1', path: 'gitlab1', namespace_id: 123)
+ feature_flags_client = feature_flags_clients.create!(project_id: project.id, token: plaintext)
+
+ migration.up
+
+ expect(feature_flags_client.reload.token).to eq(plaintext)
+ expect(feature_flags_client.reload.token_encrypted).to eq(ciphertext)
+ end
+ end
+
+ describe '#down' do
+ it 'decrypts encrypted token and saves it' do
+ project = projects.create!(id: 123, name: 'gitlab1', path: 'gitlab1', namespace_id: 123)
+ feature_flags_client = feature_flags_clients.create!(project_id: project.id, token_encrypted: ciphertext)
+
+ migration.down
+
+ expect(feature_flags_client.reload.token).to eq(plaintext)
+ expect(feature_flags_client.reload.token_encrypted).to eq(ciphertext)
+ end
+ end
+end