chore: test ENCRYPTION_SALT_KEYS multi-key and two-step rotation#61038
Merged
Conversation
Add coverage for the multi-key ENCRYPTION_SALT_KEYS contract shared by the Python (MultiFernet) and Node.js (fernet-nodejs) implementations: the first key encrypts, every key is tried for decryption. Also verify the two-step rollout used to rotate the key across independently deployed apps ([old] -> [old,new] -> [new,old]): within each step's mixed-version window every running app can decrypt what any other writes, and a direct one-step jump would break an un-upgraded app. Tests only; no production code changes.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
|
Reviews (1): Last reviewed commit: "chore: test ENCRYPTION_SALT_KEYS multi-k..." | Re-trigger Greptile |
Contributor
|
🎭 Playwright report · View test results →
These issues are not necessarily caused by your changes. |
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
We're rotating
ENCRYPTION_SALT_KEYS. The key list is consumed by two independent implementations — Django (MultiFernet) and the Node.js services (fernet-nodejs) — and the rotation rolls out across apps that cannot be guaranteed to redeploy at the same moment. Before rotating, we want automated proof that the multi-key contract and the staged rollout behave safely in both implementations.Changes
Tests only — no production code changes.
posthog/helpers/tests/test_encrypted_fields.py): cover the multi-keyENCRYPTION_SALT_KEYScontract and the two-step rotation.nodejs/src/cdp/utils/encryption-utils.test.ts): matching coverage for the same contract.Both suites assert the shared contract and the rollout safety property:
[old] → [old,new] → [new,old], within each step's mixed-version window every coexisting app can decrypt whatever any other app writes;[old] → [new,old]) would break an un-upgraded[old]-only app — the negative case that justifies doing it in two steps.How did you test this code?
I'm an agent (Claude Code). No manual testing — only the automated tests below, run locally and passing:
hogli test posthog/helpers/tests/test_encrypted_fields.py::TestEncryptedFieldsMultiKeyand::TestEncryptionKeyRotationTwoStephogli test nodejs/src/cdp/utils/encryption-utils.test.ts(14 passed)Both new suites are database-free (
SimpleTestCase/ jest unit tests).Automatic notifications
Docs update
Tests only; no docs impact.
🤖 Agent context
Authored with Claude Code (Opus). The work verifies the encryption-key-rotation behavior in both implementations independently, since they're separate codebases that must honor the same first-key-encrypts / try-all-keys-to-decrypt contract. The rollout is expressed as coexisting app states (parameterized in Python,
it.eachin Node) so the safety invariant is asserted directly rather than described.Scope decision: a companion re-encryption management command (and its database-backed tests) was developed alongside these tests but is intentionally excluded from this PR by request — this PR is the self-contained behavior tests only. Agent-authored; requires human review.