diff options
author | Krasimir Angelov <kangelov@gitlab.com> | 2019-06-06 12:37:49 +0300 |
---|---|---|
committer | Krasimir Angelov <kangelov@gitlab.com> | 2019-06-18 02:09:15 +0300 |
commit | 03000c8f26e85f5bc8bbfe292af7ffd1bcc38d29 (patch) | |
tree | 066683f2351ad7bc56fe02fbdd2765f4be252326 /spec/migrations | |
parent | 30bddd546f117043f2b7389ad06ba5257184c148 (diff) |
Add migrations needed to encrypt feature flags client tokens
Make plaintext token column not null, add new token_encrypted column and
index on project_id & token_encrypted.
Post deployment migration to encrypt existing tokens.
Diffstat (limited to 'spec/migrations')
-rw-r--r-- | spec/migrations/encrypt_feature_flags_clients_tokens_spec.rb | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/spec/migrations/encrypt_feature_flags_clients_tokens_spec.rb b/spec/migrations/encrypt_feature_flags_clients_tokens_spec.rb new file mode 100644 index 00000000000..95b02d20594 --- /dev/null +++ b/spec/migrations/encrypt_feature_flags_clients_tokens_spec.rb @@ -0,0 +1,36 @@ +# frozen_string_literal: true + +require 'spec_helper' +require Rails.root.join('db', 'post_migrate', '20190606175050_encrypt_feature_flags_clients_tokens.rb') + +describe EncryptFeatureFlagsClientsTokens, :migration do + let(:migration) { described_class.new } + let(:feature_flags_clients) { table(:operations_feature_flags_clients) } + let(:projects) { table(:projects) } + let(:plaintext) { "secret-token" } + let(:ciphertext) { Gitlab::CryptoHelper.aes256_gcm_encrypt(plaintext) } + + describe '#up' do + it 'keeps plaintext token the same and populates token_encrypted if not present' do + project = projects.create!(id: 123, name: 'gitlab1', path: 'gitlab1', namespace_id: 123) + feature_flags_client = feature_flags_clients.create!(project_id: project.id, token: plaintext) + + migration.up + + expect(feature_flags_client.reload.token).to eq(plaintext) + expect(feature_flags_client.reload.token_encrypted).to eq(ciphertext) + end + end + + describe '#down' do + it 'decrypts encrypted token and saves it' do + project = projects.create!(id: 123, name: 'gitlab1', path: 'gitlab1', namespace_id: 123) + feature_flags_client = feature_flags_clients.create!(project_id: project.id, token_encrypted: ciphertext) + + migration.down + + expect(feature_flags_client.reload.token).to eq(plaintext) + expect(feature_flags_client.reload.token_encrypted).to eq(ciphertext) + end + end +end |