Encrypt application settings with pre and post deployments

We had concerns about the cached values on Redis with the previous two
releases strategy:

First release (this commit):
  - Create new encrypted fields in the database.
  - Start populating new encrypted fields, read the encrypted fields or
    fallback to the plaintext fields.
  - Backfill the data removing the plaintext fields to the encrypted
    fields.
Second release:
  - Remove the virtual attribute (created in step 2).
  - Drop plaintext columns from the database (empty columns after
    step 3).

We end up with a better strategy only using migration scripts in one
release:
  - Pre-deployment migration: Add columns required for storing encrypted
    values.
  - Pre-deployment migration: Store the encrypted values in the new
    columns.
  - Post-deployment migration: Remove the old unencrypted columns

1 files changed, 2 insertions, 2 deletions

diff --git a/spec/migrations/encrypt_plaintext_attributes_on_application_settings_spec.rb b/spec/migrations/encrypt_plaintext_attributes_on_application_settings_spec.rb
index 6435e43f38c..122da7b3d72 100644
--- a/spec/migrations/encrypt_plaintext_attributes_on_application_settings_spec.rb
+++ b/spec/migrations/encrypt_plaintext_attributes_on_application_settings_spec.rb
@@ -18,7 +18,7 @@ describe EncryptPlaintextAttributesOnApplicationSettings, :migration do
   ].freeze
 
   describe '#up' do
-    it 'encrypts token, saves it and removes plaintext token' do
+    it 'encrypts token and saves it' do
       application_setting = application_settings.create
       application_setting.update_columns(
         PLAINTEXT_ATTRIBUTES.each_with_object({}) do |plaintext_attribute, attributes|
@@ -30,7 +30,7 @@ describe EncryptPlaintextAttributesOnApplicationSettings, :migration do
 
       application_setting.reload
       PLAINTEXT_ATTRIBUTES.each do |plaintext_attribute|
-        expect(application_setting[plaintext_attribute]).to be_nil
+        expect(application_setting[plaintext_attribute]).not_to be_nil
         expect(application_setting["encrypted_#{plaintext_attribute}"]).not_to be_nil
         expect(application_setting["encrypted_#{plaintext_attribute}_iv"]).not_to be_nil
       end