Initial commit

lib/tasks/migrate.rake

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+namespace 'migrate' do
+  desc 'Migrate api keys from vault secrets to transit'
+  task "26-api-keys": [:environment] do
+    puts 'Migrating API keys from secrets to transit keys (new in 2.6)'
+    APIKey.find_in_batches do |keys|
+      keys.each do |key|
+        legacy_key_path = "secret/barong/api_key/#{key.kid}"
+        secret = TOTPService.read_data(legacy_key_path)
+        next unless secret
+
+        value = secret.data[:value]
+        next unless value
+
+        key.secret = value
+        key.save!
+        TOTPService.delete_data(legacy_key_path)
+      end
+    end
+  end
+
+  desc 'Move TOTP secrets to include the vault application as prefix'
+  task "26-totp": [:environment] do
+    puts 'Moving TOTP secrets to include the vault application as prefix (new in 2.6)'
+
+    User.find_in_batches do |users|
+      users.each do |u|
+        legacy_key_path = "totp/keys/#{u.uid}"
+        legacy_export_path = "totp/export/#{u.uid}"
+
+        next unless TOTPService.read_data(legacy_key_path)
+
+        params = TOTPService.read_data(legacy_export_path)
+        unless params
+          raise "Failed to export key (#{legacy_export_path})\n"\
+          "Make sure vault is running with this image: quay.io/openware/vault:1.5.3-openware\n"\
+          'And make sure the token has read access to /totp/export/*'
+        end
+        key_path = TOTPService.totp_key(u.uid)
+        TOTPService.write_data(key_path, params.data.merge(generate: false))
+        TOTPService.delete_data(legacy_key_path)
+      end
+    end
+  end
+end