Migration Path from unecrypted to encrypted

[hundredwatt]

We need a way to encrypted an previously unencrypted column and keep the data intact. Ideally, there would be a way to detected if a value is encrypted or not so that the accessor can return the correct value regardless AND then run a migration to encrypt all unencrypted values.

[ebababi]

Let's just extend the migration generator for the time being. Generator should contain something like:

require 'openssl'
require 'base64'

class ChangeSecretInModel < ActiveRecord::Migration
  def up
    public_key = OpenSSL::PKey::RSA.new(File.read(ENV['PUBLIC_KEY_FILE']))

    change_column :models, :secret, :text, limit: 4096

    say_with_time "encrypt_model_secrets" do
      encrypt_model_secrets(public_key)
    end
  end

  def down
    private_key = OpenSSL::PKey::RSA.new(File.read(ENV['PRIVATE_KEY_FILE']), ENV['PRIVATE_KEY_PASSWORD'])

    say_with_time "decrypt_model_secrets" do
      decrypt_model_secrets(private_key)
    end

    change_column :models, :secret, :string
  end

  private
    def encrypt_model_secrets(public_key)
      Model.reset_column_information

      Model.find_each do |model|
        secret = model.instance_variable_get(:@attributes).send(:fetch, 'secret')

        model.update_columns(
          secret: secret.nil? ? secret : Base64.encode64(public_key.public_encrypt(secret))
        )
      end

      Model.count
    end

    def decrypt_model_secrets(private_key)
      Model.reset_column_information

      Model.find_each do |model|
        secret = model.instance_variable_get(:@attributes).send(:fetch, 'secret')

        model.update_columns(
          secret: secret.nil? ? secret : private_key.private_decrypt(Base64.decode64(secret)),
        )
      end

      Model.count
    end
end

[hundredwatt]

@ebababi This generator isn't working for me (Rails 4.1.9):

Amplify $ ./bin/rake db:migrate
== 20150113181325 ChangeTokenSecretInUsers: migrating =========================
-- change_column(:users, :token, :text, {:limit=>4096})
   -> 0.0098s
-- change_column(:users, :secret, :text, {:limit=>4096})
   -> 0.0089s
-- encrypt_user_tokens_and_secrets
rake aborted!
StandardError: An error has occurred, all later migrations canceled:

no implicit conversion of ActiveRecord::AttributeMethods::Serialization::Attribute into String/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:36:in `public_encrypt'
/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:36:in `block in encrypt_user_tokens_and_secrets'
/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:31:in `encrypt_user_tokens_and_secrets'
/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:12:in `block in up'
/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:11:in `up'
-e:1:in `<main>'
TypeError: no implicit conversion of ActiveRecord::AttributeMethods::Serialization::Attribute into String
/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:36:in `public_encrypt'
/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:36:in `block in encrypt_user_tokens_and_secrets'
/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:31:in `encrypt_user_tokens_and_secrets'
/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:12:in `block in up'
/Users/jason/Dropbox (Personal)/Current/Amplify/db/migrate/20150113181325_change_token_secret_in_users.rb:11:in `up'
-e:1:in `<main>'
Tasks: TOP => db:migrate
(See full trace by running task with --trace)

[hundredwatt]

The code is in the Amplify app on the feat/token-encryption branch: https://github.com/GaggleAMP/Amplify/commit/2edf79091ec7cdebcf88d4afa2377f28fcd94830