{"action":"closed","number":2203,"pull_request":{"url":"https://api.github.com/repos/18F/identity-idp/pulls/2203","id":191019553,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkxMDE5NTUz","html_url":"https://github.com/18F/identity-idp/pull/2203","diff_url":"https://github.com/18F/identity-idp/pull/2203.diff","patch_url":"https://github.com/18F/identity-idp/pull/2203.patch","issue_url":"https://api.github.com/repos/18F/identity-idp/issues/2203","number":2203,"state":"closed","locked":false,"title":"LG-290 Move attribute encryption away from KMS","user":{"login":"stevegsa","id":34244063,"node_id":"MDQ6VXNlcjM0MjQ0MDYz","avatar_url":"https://avatars0.githubusercontent.com/u/34244063?v=4","gravatar_id":"","url":"https://api.github.com/users/stevegsa","html_url":"https://github.com/stevegsa","followers_url":"https://api.github.com/users/stevegsa/followers","following_url":"https://api.github.com/users/stevegsa/following{/other_user}","gists_url":"https://api.github.com/users/stevegsa/gists{/gist_id}","starred_url":"https://api.github.com/users/stevegsa/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/stevegsa/subscriptions","organizations_url":"https://api.github.com/users/stevegsa/orgs","repos_url":"https://api.github.com/users/stevegsa/repos","events_url":"https://api.github.com/users/stevegsa/events{/privacy}","received_events_url":"https://api.github.com/users/stevegsa/received_events","type":"User","site_admin":false},"body":"**Why**: KMS is not multi-region and KMS does not allow importing or exporting keys which ties us to AWS.\r\n\r\n**How**: Perform an in place migration via two steps: a deployment and a subsequent feature flag change.  \r\n\r\nPerforming an in place migration in one deployment would cause destructive changes in the database that could not be rolled back upon failure and would also cause 500 errors while servers scaled in and scaled out.  This PR deploys code that supports decryption for old and new formats but continues encrypting in the old format. The ability to encrypt in old and new format will be controlled via a feature flag.  Upon this PR's successful deployment the next step is to enable the new encryption via the new feature flag.  Shortly thereafter the rake task rotate.rake can be run to convert all the attributes to the new encryption scheme.\r\n\r\nTo accomplish this in the code we move AttributeEncryptor to DeprecatedAttributeEncryptor.  Depending on the state of the feature flag the new AttributeEncryptor encrypts in old or new format.  The new AttributeEncryptor decrypts in old format if it detects an old cipher text otherwise it decrypts in the new format.\r\n\r\nHi! Before submitting your PR for review, and/or before merging it, please\r\ngo through the following checklist:\r\n\r\n- [x] For DB changes, check for missing indexes, check to see if the changes\r\naffect other apps (such as the dashboard), make sure the DB columns in the\r\nvarious environments are properly populated, coordinate with devops, plan\r\nmigrations in separate steps.\r\n\r\n- [x] For route changes, make sure GET requests don't change state or result in\r\ndestructive behavior. GET requests should only result in information being\r\nread, not written.  Use rotate.rake to migrate the attributes.\r\n\r\n- [x] For encryption changes, make sure it is compatible with data that was\r\nencrypted with the old code.\r\n\r\n- [x] For secrets changes, [make sure to update the S3 secrets bucket](https://github.com/18F/identity-private/wiki/Secrets-S3-buckets) with the \r\nnew configs in **all** environments. \r\n\r\n- [x] Do not disable Rubocop or Reek offenses unless you are absolutely sure\r\nthey are false positives. If you're not sure how to fix the offense, please\r\nask a teammate.\r\n\r\n- [x] When reading data, write tests for nil values, empty strings,\r\nand invalid formats.\r\n\r\n- [x] When calling `redirect_to` in a controller, use `_url`, not `_path`.\r\n\r\n- [x] When adding user data to the session, use the `user_session` helper\r\ninstead of the `session` helper so the data does not persist beyond the user's\r\nsession.\r\n\r\n- [x] When adding a new controller that requires the user to be fully\r\nauthenticated, make sure to add `before_action :confirm_two_factor_authenticated`.\r\n","created_at":"2018-05-29T02:27:31Z","updated_at":"2018-07-02T16:46:47Z","closed_at":"2018-07-02T16:46:47Z","merged_at":null,"merge_commit_sha":"917076141896f2ad96507b0cd828dd4aac5e4ae4","assignee":null,"assignees":[],"requested_reviewers":[{"login":"davemcorwin","id":6662371,"node_id":"MDQ6VXNlcjY2NjIzNzE=","avatar_url":"https://avatars1.githubusercontent.com/u/6662371?v=4","gravatar_id":"","url":"https://api.github.com/users/davemcorwin","html_url":"https://github.com/davemcorwin","followers_url":"https://api.github.com/users/davemcorwin/followers","following_url":"https://api.github.com/users/davemcorwin/following{/other_user}","gists_url":"https://api.github.com/users/davemcorwin/gists{/gist_id}","starred_url":"https://api.github.com/users/davemcorwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/davemcorwin/subscriptions","organizations_url":"https://api.github.com/users/davemcorwin/orgs","repos_url":"https://api.github.com/users/davemcorwin/repos","events_url":"https://api.github.com/users/davemcorwin/events{/privacy}","received_events_url":"https://api.github.com/users/davemcorwin/received_events","type":"User","site_admin":false},{"login":"mryenq","id":39062019,"node_id":"MDQ6VXNlcjM5MDYyMDE5","avatar_url":"https://avatars2.githubusercontent.com/u/39062019?v=4","gravatar_id":"","url":"https://api.github.com/users/mryenq","html_url":"https://github.com/mryenq","followers_url":"https://api.github.com/users/mryenq/followers","following_url":"https://api.github.com/users/mryenq/following{/other_user}","gists_url":"https://api.github.com/users/mryenq/gists{/gist_id}","starred_url":"https://api.github.com/users/mryenq/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mryenq/subscriptions","organizations_url":"https://api.github.com/users/mryenq/orgs","repos_url":"https://api.github.com/users/mryenq/repos","events_url":"https://api.github.com/users/mryenq/events{/privacy}","received_events_url":"https://api.github.com/users/mryenq/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":374766233,"node_id":"MDU6TGFiZWwzNzQ3NjYyMzM=","url":"https://api.github.com/repos/18F/identity-idp/labels/status%20-%20do%20not%20merge","name":"status - do not merge","color":"e99695","default":false},{"id":355011342,"node_id":"MDU6TGFiZWwzNTUwMTEzNDI=","url":"https://api.github.com/repos/18F/identity-idp/labels/status%20-%20ready%20for%20review","name":"status - ready for review","color":"006b75","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/18F/identity-idp/pulls/2203/commits","review_comments_url":"https://api.github.com/repos/18F/identity-idp/pulls/2203/comments","review_comment_url":"https://api.github.com/repos/18F/identity-idp/pulls/comments{/number}","comments_url":"https://api.github.com/repos/18F/identity-idp/issues/2203/comments","statuses_url":"https://api.github.com/repos/18F/identity-idp/statuses/d49707393fe65af1d25552fd2698a8c0fb22d092","head":{"label":"18F:stevegsa-refactor-attribute-encryption","ref":"stevegsa-refactor-attribute-encryption","sha":"d49707393fe65af1d25552fd2698a8c0fb22d092","user":{"login":"18F","id":6233994,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMzM5OTQ=","avatar_url":"https://avatars0.githubusercontent.com/u/6233994?v=4","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"repo":{"id":50386243,"node_id":"MDEwOlJlcG9zaXRvcnk1MDM4NjI0Mw==","name":"identity-idp","full_name":"18F/identity-idp","owner":{"login":"18F","id":6233994,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMzM5OTQ=","avatar_url":"https://avatars0.githubusercontent.com/u/6233994?v=4","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/18F/identity-idp","description":"18F Identity Provider (IdP)","fork":false,"url":"https://api.github.com/repos/18F/identity-idp","forks_url":"https://api.github.com/repos/18F/identity-idp/forks","keys_url":"https://api.github.com/repos/18F/identity-idp/keys{/key_id}","collaborators_url":"https://api.github.com/repos/18F/identity-idp/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/18F/identity-idp/teams","hooks_url":"https://api.github.com/repos/18F/identity-idp/hooks","issue_events_url":"https://api.github.com/repos/18F/identity-idp/issues/events{/number}","events_url":"https://api.github.com/repos/18F/identity-idp/events","assignees_url":"https://api.github.com/repos/18F/identity-idp/assignees{/user}","branches_url":"https://api.github.com/repos/18F/identity-idp/branches{/branch}","tags_url":"https://api.github.com/repos/18F/identity-idp/tags","blobs_url":"https://api.github.com/repos/18F/identity-idp/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/18F/identity-idp/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/18F/identity-idp/git/refs{/sha}","trees_url":"https://api.github.com/repos/18F/identity-idp/git/trees{/sha}","statuses_url":"https://api.github.com/repos/18F/identity-idp/statuses/{sha}","languages_url":"https://api.github.com/repos/18F/identity-idp/languages","stargazers_url":"https://api.github.com/repos/18F/identity-idp/stargazers","contributors_url":"https://api.github.com/repos/18F/identity-idp/contributors","subscribers_url":"https://api.github.com/repos/18F/identity-idp/subscribers","subscription_url":"https://api.github.com/repos/18F/identity-idp/subscription","commits_url":"https://api.github.com/repos/18F/identity-idp/commits{/sha}","git_commits_url":"https://api.github.com/repos/18F/identity-idp/git/commits{/sha}","comments_url":"https://api.github.com/repos/18F/identity-idp/comments{/number}","issue_comment_url":"https://api.github.com/repos/18F/identity-idp/issues/comments{/number}","contents_url":"https://api.github.com/repos/18F/identity-idp/contents/{+path}","compare_url":"https://api.github.com/repos/18F/identity-idp/compare/{base}...{head}","merges_url":"https://api.github.com/repos/18F/identity-idp/merges","archive_url":"https://api.github.com/repos/18F/identity-idp/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/18F/identity-idp/downloads","issues_url":"https://api.github.com/repos/18F/identity-idp/issues{/number}","pulls_url":"https://api.github.com/repos/18F/identity-idp/pulls{/number}","milestones_url":"https://api.github.com/repos/18F/identity-idp/milestones{/number}","notifications_url":"https://api.github.com/repos/18F/identity-idp/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/18F/identity-idp/labels{/name}","releases_url":"https://api.github.com/repos/18F/identity-idp/releases{/id}","deployments_url":"https://api.github.com/repos/18F/identity-idp/deployments","created_at":"2016-01-25T22:40:59Z","updated_at":"2018-07-02T15:16:34Z","pushed_at":"2018-07-02T16:21:20Z","git_url":"git://github.com/18F/identity-idp.git","ssh_url":"git@github.com:18F/identity-idp.git","clone_url":"https://github.com/18F/identity-idp.git","svn_url":"https://github.com/18F/identity-idp","homepage":"https://secure.login.gov/","size":14180,"stargazers_count":169,"watchers_count":169,"language":"Ruby","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":35,"mirror_url":null,"archived":false,"open_issues_count":20,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":35,"open_issues":20,"watchers":169,"default_branch":"master"}},"base":{"label":"18F:master","ref":"master","sha":"dc7dbd81f888cf38c4ff5bc45c6e2c6b91010353","user":{"login":"18F","id":6233994,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMzM5OTQ=","avatar_url":"https://avatars0.githubusercontent.com/u/6233994?v=4","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"repo":{"id":50386243,"node_id":"MDEwOlJlcG9zaXRvcnk1MDM4NjI0Mw==","name":"identity-idp","full_name":"18F/identity-idp","owner":{"login":"18F","id":6233994,"node_id":"MDEyOk9yZ2FuaXphdGlvbjYyMzM5OTQ=","avatar_url":"https://avatars0.githubusercontent.com/u/6233994?v=4","gravatar_id":"","url":"https://api.github.com/users/18F","html_url":"https://github.com/18F","followers_url":"https://api.github.com/users/18F/followers","following_url":"https://api.github.com/users/18F/following{/other_user}","gists_url":"https://api.github.com/users/18F/gists{/gist_id}","starred_url":"https://api.github.com/users/18F/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/18F/subscriptions","organizations_url":"https://api.github.com/users/18F/orgs","repos_url":"https://api.github.com/users/18F/repos","events_url":"https://api.github.com/users/18F/events{/privacy}","received_events_url":"https://api.github.com/users/18F/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/18F/identity-idp","description":"18F Identity Provider (IdP)","fork":false,"url":"https://api.github.com/repos/18F/identity-idp","forks_url":"https://api.github.com/repos/18F/identity-idp/forks","keys_url":"https://api.github.com/repos/18F/identity-idp/keys{/key_id}","collaborators_url":"https://api.github.com/repos/18F/identity-idp/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/18F/identity-idp/teams","hooks_url":"https://api.github.com/repos/18F/identity-idp/hooks","issue_events_url":"https://api.github.com/repos/18F/identity-idp/issues/events{/number}","events_url":"https://api.github.com/repos/18F/identity-idp/events","assignees_url":"https://api.github.com/repos/18F/identity-idp/assignees{/user}","branches_url":"https://api.github.com/repos/18F/identity-idp/branches{/branch}","tags_url":"https://api.github.com/repos/18F/identity-idp/tags","blobs_url":"https://api.github.com/repos/18F/identity-idp/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/18F/identity-idp/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/18F/identity-idp/git/refs{/sha}","trees_url":"https://api.github.com/repos/18F/identity-idp/git/trees{/sha}","statuses_url":"https://api.github.com/repos/18F/identity-idp/statuses/{sha}","languages_url":"https://api.github.com/repos/18F/identity-idp/languages","stargazers_url":"https://api.github.com/repos/18F/identity-idp/stargazers","contributors_url":"https://api.github.com/repos/18F/identity-idp/contributors","subscribers_url":"https://api.github.com/repos/18F/identity-idp/subscribers","subscription_url":"https://api.github.com/repos/18F/identity-idp/subscription","commits_url":"https://api.github.com/repos/18F/identity-idp/commits{/sha}","git_commits_url":"https://api.github.com/repos/18F/identity-idp/git/commits{/sha}","comments_url":"https://api.github.com/repos/18F/identity-idp/comments{/number}","issue_comment_url":"https://api.github.com/repos/18F/identity-idp/issues/comments{/number}","contents_url":"https://api.github.com/repos/18F/identity-idp/contents/{+path}","compare_url":"https://api.github.com/repos/18F/identity-idp/compare/{base}...{head}","merges_url":"https://api.github.com/repos/18F/identity-idp/merges","archive_url":"https://api.github.com/repos/18F/identity-idp/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/18F/identity-idp/downloads","issues_url":"https://api.github.com/repos/18F/identity-idp/issues{/number}","pulls_url":"https://api.github.com/repos/18F/identity-idp/pulls{/number}","milestones_url":"https://api.github.com/repos/18F/identity-idp/milestones{/number}","notifications_url":"https://api.github.com/repos/18F/identity-idp/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/18F/identity-idp/labels{/name}","releases_url":"https://api.github.com/repos/18F/identity-idp/releases{/id}","deployments_url":"https://api.github.com/repos/18F/identity-idp/deployments","created_at":"2016-01-25T22:40:59Z","updated_at":"2018-07-02T15:16:34Z","pushed_at":"2018-07-02T16:21:20Z","git_url":"git://github.com/18F/identity-idp.git","ssh_url":"git@github.com:18F/identity-idp.git","clone_url":"https://github.com/18F/identity-idp.git","svn_url":"https://github.com/18F/identity-idp","homepage":"https://secure.login.gov/","size":14180,"stargazers_count":169,"watchers_count":169,"language":"Ruby","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":35,"mirror_url":null,"archived":false,"open_issues_count":20,"license":{"key":"other","name":"Other","spdx_id":null,"url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":35,"open_issues":20,"watchers":169,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/18F/identity-idp/pulls/2203"},"html":{"href":"https://github.com/18F/identity-idp/pull/2203"},"issue":{"href":"https://api.github.com/repos/18F/identity-idp/issues/2203"},"comments":{"href":"https://api.github.com/repos/18F/identity-idp/issues/2203/comments"},"review_comments":{"href":"https://api.github.com/repos/18F/identity-idp/pulls/2203/comments"},"review_comment":{"href":"https://api.github.com/repos/18F/identity-idp/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/18F/identity-idp/pulls/2203/commits"},"statuses":{"href":"https://api.github.com/repos/18F/identity-idp/statuses/d49707393fe65af1d25552fd2698a8c0fb22d092"}},"author_association":"MEMBER","merged":false,"mergeable":true,"rebaseable":true,"mergeable_state":"unstable","merged_by":null,"comments":11,"review_comments":0,"maintainer_can_modify":false,"commits":1,"additions":367,"deletions":96,"changed_files":10}}
{"actor":{"display_login":"monfresh"}}