pgcontents/query.py
def reencrypt_user_content(engine,
                           user_id,
                           old_decrypt_func,
                           new_encrypt_func,
                           logger):
    """
    Re-encrypt all of the files and checkpoints for a single user.
    """
    logger.info("Begin re-encryption for user %s", user_id)
    with engine.begin() as db:
        # NOTE: Doing both of these operations in one transaction depends for
        # correctness on the fact that the creation of new checkpoints always
        # involves writing new data into the database from Python, rather than
        # simply copying data inside the DB.

        # If we change checkpoint creation so that it does an in-database copy,
        # then we need to split this transaction to ensure that
        # file-reencryption is complete before checkpoint-reencryption starts.

        # If that doesn't happen, it will be possible for a user to create a
        # new checkpoint in a transaction that hasn't seen the completed
        # file-reencryption process, but we might not see that checkpoint here,
        # which means that we would never update the content of that checkpoint
        # to the new encryption key.
        logger.info("Re-encrypting files for %s", user_id)
        for (file_id,) in select_file_ids(db, user_id):
            reencrypt_row_content(
                db,
                files,
                file_id,
                old_decrypt_func,
                new_encrypt_func,
                logger,
            )

        logger.info("Re-encrypting checkpoints for %s", user_id)
        for (cp_id,) in select_remote_checkpoint_ids(db, user_id):
            reencrypt_row_content(
                db,
                remote_checkpoints,
                cp_id,
                old_decrypt_func,
                new_encrypt_func,
                logger,
            )
    logger.info("Finished re-encryption for user %s", user_id)
def reencrypt_user_content(engine,
                           user_id,
                           old_decrypt_func,
                           new_encrypt_func,
                           logger):
    logger.info("Begin re-encryption for user %s", user_id)
    with engine.begin() as db:
        # NOTE: Doing both of these operations in one transaction depends for
        # correctness on the fact that the creation of new checkpoints always
        # involves writing new data into the database from Python, rather than
        # simply copying data inside the DB.

        # If we change checkpoint creation so that it does an in-database copy,
        # then we need to split this transaction to ensure that
        # file-reencryption is complete before checkpoint-reencryption starts.

        # If that doesn't happen, it will be possible for a user to create a
        # new checkpoint in a transaction that hasn't seen the completed
        # file-reencryption process, but we might not see that checkpoint here,
        # which means that we would never update the content of that checkpoint
        # to the new encryption key.
        logger.info("Re-encrypting files for %s", user_id)
        for (file_id,) in select_file_ids(db, user_id):
            reencrypt_row_content(
                db,
                files,
                file_id,
                old_decrypt_func,
                new_encrypt_func,
                logger,
            )

        logger.info("Re-encrypting checkpoints for %s", user_id)
        for (cp_id,) in select_remote_checkpoint_ids(db, user_id):
            reencrypt_row_content(
                db,
                remote_checkpoints,
                cp_id,
                old_decrypt_func,
                new_encrypt_func,
                logger,
            )
    logger.info("Finished re-encryption for user %s", user_id)
def reencrypt_user_content ( engine , user_id , old_decrypt_func , new_encrypt_func , logger ) : logger . info ( "Begin re-encryption for user %s" , user_id ) with engine . begin ( ) as db : # NOTE: Doing both of these operations in one transaction depends for # correctness on the fact that the creation of new checkpoints always # involves writing new data into the database from Python, rather than # simply copying data inside the DB. # If we change checkpoint creation so that it does an in-database copy, # then we need to split this transaction to ensure that # file-reencryption is complete before checkpoint-reencryption starts. # If that doesn't happen, it will be possible for a user to create a # new checkpoint in a transaction that hasn't seen the completed # file-reencryption process, but we might not see that checkpoint here, # which means that we would never update the content of that checkpoint # to the new encryption key. logger . info ( "Re-encrypting files for %s" , user_id ) for ( file_id , ) in select_file_ids ( db , user_id ) : reencrypt_row_content ( db , files , file_id , old_decrypt_func , new_encrypt_func , logger , ) logger . info ( "Re-encrypting checkpoints for %s" , user_id ) for ( cp_id , ) in select_remote_checkpoint_ids ( db , user_id ) : reencrypt_row_content ( db , remote_checkpoints , cp_id , old_decrypt_func , new_encrypt_func , logger , ) logger . info ( "Finished re-encryption for user %s" , user_id )
Re-encrypt all of the files and checkpoints for a single user.
Re - encrypt all of the files and checkpoints for a single user .