From 03000c8f26e85f5bc8bbfe292af7ffd1bcc38d29 Mon Sep 17 00:00:00 2001
From: Krasimir Angelov <kangelov@gitlab.com>
Date: Thu, 6 Jun 2019 21:37:49 +1200
Subject: Add migrations needed to encrypt feature flags client tokens

Make plaintext token column not null, add new token_encrypted column and
index on project_id & token_encrypted.

Post deployment migration to encrypt existing tokens.
---
 ...rations_feature_flags_clients_token_not_null.rb | 11 +++++++++
 ...ncrypted_to_operations_feature_flags_clients.rb | 11 +++++++++
 ...ations_feature_flags_clients_token_encrypted.rb | 18 +++++++++++++++
 ...6175050_encrypt_feature_flags_clients_tokens.rb | 27 ++++++++++++++++++++++
 db/schema.rb                                       |  4 +++-
 5 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 db/migrate/20190606054649_change_operations_feature_flags_clients_token_not_null.rb
 create mode 100644 db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb
 create mode 100644 db/migrate/20190606054832_add_index_to_operations_feature_flags_clients_token_encrypted.rb
 create mode 100644 db/post_migrate/20190606175050_encrypt_feature_flags_clients_tokens.rb

(limited to 'db')

diff --git a/db/migrate/20190606054649_change_operations_feature_flags_clients_token_not_null.rb b/db/migrate/20190606054649_change_operations_feature_flags_clients_token_not_null.rb
new file mode 100644
index 00000000000..c9dbb48f5bd
--- /dev/null
+++ b/db/migrate/20190606054649_change_operations_feature_flags_clients_token_not_null.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class ChangeOperationsFeatureFlagsClientsTokenNotNull < ActiveRecord::Migration[5.1]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def change
+    change_column_null :operations_feature_flags_clients, :token, true
+  end
+end
diff --git a/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb b/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb
new file mode 100644
index 00000000000..024b5bd2ba5
--- /dev/null
+++ b/db/migrate/20190606054742_add_token_encrypted_to_operations_feature_flags_clients.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class AddTokenEncryptedToOperationsFeatureFlagsClients < ActiveRecord::Migration[5.1]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  def change
+    add_column :operations_feature_flags_clients, :token_encrypted, :string
+  end
+end
diff --git a/db/migrate/20190606054832_add_index_to_operations_feature_flags_clients_token_encrypted.rb b/db/migrate/20190606054832_add_index_to_operations_feature_flags_clients_token_encrypted.rb
new file mode 100644
index 00000000000..5627457af5c
--- /dev/null
+++ b/db/migrate/20190606054832_add_index_to_operations_feature_flags_clients_token_encrypted.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class AddIndexToOperationsFeatureFlagsClientsTokenEncrypted < ActiveRecord::Migration[5.1]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_index :operations_feature_flags_clients, [:project_id, :token_encrypted],
+      unique: true, name: "index_feature_flags_clients_on_project_id_and_token_encrypted"
+  end
+
+  def down
+    remove_concurrent_index_by_name :operations_feature_flags_clients, "index_feature_flags_clients_on_project_id_and_token_encrypted"
+  end
+end
diff --git a/db/post_migrate/20190606175050_encrypt_feature_flags_clients_tokens.rb b/db/post_migrate/20190606175050_encrypt_feature_flags_clients_tokens.rb
new file mode 100644
index 00000000000..cb7d723670f
--- /dev/null
+++ b/db/post_migrate/20190606175050_encrypt_feature_flags_clients_tokens.rb
@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+class EncryptFeatureFlagsClientsTokens < ActiveRecord::Migration[5.1]
+  DOWNTIME = false
+
+  class FeatureFlagsClient < ActiveRecord::Base
+    self.table_name = 'operations_feature_flags_clients'
+  end
+
+  def up
+    say_with_time("Encrypting tokens from operations_feature_flags_clients") do
+      FeatureFlagsClient.where('token_encrypted is NULL AND token IS NOT NULL').find_each do |feature_flags_client|
+        token_encrypted = Gitlab::CryptoHelper.aes256_gcm_encrypt(feature_flags_client.token)
+        feature_flags_client.update!(token_encrypted: token_encrypted)
+      end
+    end
+  end
+
+  def down
+    say_with_time("Decrypting tokens from operations_feature_flags_clients") do
+      FeatureFlagsClient.where('token_encrypted IS NOT NULL AND token IS NULL').find_each do |feature_flags_client|
+        token = Gitlab::CryptoHelper.aes256_gcm_decrypt(feature_flags_client.token_encrypted)
+        feature_flags_client.update!(token: token)
+      end
+    end
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index c6186c52699..6903b061ee5 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -2257,8 +2257,10 @@ ActiveRecord::Schema.define(version: 20190613030606) do
 
   create_table "operations_feature_flags_clients", force: :cascade do |t|
     t.integer "project_id", null: false
-    t.string "token", null: false
+    t.string "token"
+    t.string "token_encrypted"
     t.index ["project_id", "token"], name: "index_operations_feature_flags_clients_on_project_id_and_token", unique: true, using: :btree
+    t.index ["project_id", "token_encrypted"], name: "index_feature_flags_clients_on_project_id_and_token_encrypted", unique: true, using: :btree
   end
 
   create_table "packages_maven_metadata", force: :cascade do |t|
-- 
cgit v1.2.3