raucao
4bca003983
Store only SHA256(token) in a new token_digest column and use the digest for the Redis authorization keys instead of the plaintext token. The plaintext is now held in memory only for issuance. This is the expand step: the plaintext token column stays in place so the old code can keep running during the deploy. A follow-up migration will drop it once rs:rekey_tokens has re-keyed Redis and confirmed no plaintext keys remain. Refs #259
13 lines
447 B
Ruby
13 lines
447 B
Ruby
namespace :rs do
|
|
desc "Backfill remoteStorage token digests and re-key Redis authorization keys (idempotent)"
|
|
task rekey_tokens: :environment do
|
|
result = RemoteStorageManager::RekeyTokens.call
|
|
|
|
if result.skipped
|
|
puts "remote_storage_authorizations.token column is gone; nothing to re-key."
|
|
else
|
|
puts "Re-keyed #{result.rekeyed} authorization(s); removed #{result.legacy_removed} legacy Redis key(s)."
|
|
end
|
|
end
|
|
end
|