1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
/** |
4
|
|
|
* Copyright 2021 SURFnet bv |
5
|
|
|
* |
6
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
7
|
|
|
* you may not use this file except in compliance with the License. |
8
|
|
|
* You may obtain a copy of the License at |
9
|
|
|
* |
10
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0 |
11
|
|
|
* |
12
|
|
|
* Unless required by applicable law or agreed to in writing, software |
13
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS, |
14
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
15
|
|
|
* See the License for the specific language governing permissions and |
16
|
|
|
* limitations under the License. |
17
|
|
|
*/ |
|
|
|
|
18
|
|
|
|
19
|
|
|
declare(strict_types=1); |
20
|
|
|
|
21
|
|
|
namespace Surfnet\Migrations; |
22
|
|
|
|
23
|
|
|
use Doctrine\DBAL\Schema\Schema; |
24
|
|
|
use Doctrine\Migrations\AbstractMigration; |
25
|
|
|
|
26
|
|
|
/** |
27
|
|
|
* This migration removes sensitive data (vetting type) from the event stream |
28
|
|
|
* This data ended up by accident, this migration loads the targeted events and |
29
|
|
|
* removes the sensitive data via JSON encoding/decoding the payload of the event. |
30
|
|
|
*/ |
|
|
|
|
31
|
|
|
final class Version20210610131957 extends AbstractMigration |
32
|
|
|
{ |
33
|
|
|
private static string $select = <<<SQL |
34
|
|
|
SELECT uuid, playhead, payload |
35
|
|
|
FROM event_stream |
36
|
|
|
WHERE (type = 'Surfnet.Stepup.Identity.Event.SecondFactorVettedEvent' |
37
|
|
|
OR type = 'Surfnet.Stepup.Identity.Event.SecondFactorVettedWithoutTokenProofOfPossession') |
38
|
|
|
AND recorded_on > '2021-04-11' |
39
|
|
|
AND payload LIKE '%"vetting_type":%'; |
40
|
|
|
SQL; |
41
|
|
|
|
42
|
|
|
private static string $update = <<<SQL |
43
|
|
|
UPDATE event_stream |
44
|
|
|
SET payload = :payload |
45
|
|
|
WHERE uuid = :uuid |
46
|
|
|
AND playhead = :playhead; |
47
|
|
|
SQL; |
48
|
|
|
|
49
|
|
|
public function up(Schema $schema): void |
50
|
|
|
{ |
51
|
|
|
// Do not show warning on migrations. |
52
|
|
|
$this->addSql('# Updating entities.'); |
53
|
|
|
|
54
|
|
|
$result = $this->connection->executeQuery(self::$select); |
55
|
|
|
|
56
|
|
|
$affectedEventStreamRows = $result->fetchAllAssociative(); |
57
|
|
|
$this->write("<info>Affected records: {$result->rowCount()}</info>"); |
58
|
|
|
|
59
|
|
|
if ($result->rowCount() === 0) { |
60
|
|
|
return; |
61
|
|
|
} |
62
|
|
|
|
63
|
|
|
foreach ($affectedEventStreamRows as $eventStream) { |
64
|
|
|
$rawPayload = $eventStream['payload']; |
65
|
|
|
$uuid = $eventStream['uuid']; |
66
|
|
|
$playhead = $eventStream['playhead']; |
67
|
|
|
|
68
|
|
|
$this->write("<info>Migating: {$uuid}#{$playhead}</info>"); |
69
|
|
|
|
70
|
|
|
$payload = $this->stripSensitiveData($rawPayload); |
71
|
|
|
$this->connection->executeUpdate( |
|
|
|
|
72
|
|
|
self::$update, |
73
|
|
|
[ |
74
|
|
|
'payload' => $payload, |
75
|
|
|
'uuid' => $uuid, |
76
|
|
|
'playhead' => $playhead, |
77
|
|
|
], |
78
|
|
|
); |
79
|
|
|
} |
80
|
|
|
} |
81
|
|
|
|
82
|
|
|
public function down(Schema $schema): void |
83
|
|
|
{ |
84
|
|
|
// This migration can not be undone. |
85
|
|
|
} |
86
|
|
|
|
87
|
|
|
private function stripSensitiveData(string $rawPayload): string |
|
|
|
|
88
|
|
|
{ |
89
|
|
|
$payload = json_decode($rawPayload, true); |
90
|
|
|
unset($payload['payload']['vetting_type']); |
91
|
|
|
return json_encode($payload); |
92
|
|
|
} |
93
|
|
|
} |
94
|
|
|
|