pgcontents/query.py
def reencrypt_user_content(engine,
                           user_id,
                           old_decrypt_func,
                           new_encrypt_func,
                           logger):
    """
    Re-encrypt all of the files and checkpoints for a single user.
    """
    logger.info("Begin re-encryption for user %s", user_id)
    with engine.begin() as db:
        # NOTE: Doing both of these operations in one transaction depends for
        # correctness on the fact that the creation of new checkpoints always
        # involves writing new data into the database from Python, rather than
        # simply copying data inside the DB.

        # If we change checkpoint creation so that it does an in-database copy,
        # then we need to split this transaction to ensure that
        # file-reencryption is complete before checkpoint-reencryption starts.

        # If that doesn't happen, it will be possible for a user to create a
        # new checkpoint in a transaction that hasn't seen the completed
        # file-reencryption process, but we might not see that checkpoint here,
        # which means that we would never update the content of that checkpoint
        # to the new encryption key.
        logger.info("Re-encrypting files for %s", user_id)
        for (file_id,) in select_file_ids(db, user_id):
            reencrypt_row_content(
                db,
                files,
                file_id,
                old_decrypt_func,
                new_encrypt_func,
                logger,
            )

        logger.info("Re-encrypting checkpoints for %s", user_id)
        for (cp_id,) in select_remote_checkpoint_ids(db, user_id):
            reencrypt_row_content(
                db,
                remote_checkpoints,
                cp_id,
                old_decrypt_func,
                new_encrypt_func,
                logger,
            )
    logger.info("Finished re-encryption for user %s", user_id)
def reencrypt_user_content(engine,
                           user_id,
                           old_decrypt_func,
                           new_encrypt_func,
                           logger):
    """
    Re-encrypt all of the files and checkpoints for a single user.
    """
    logger.info("Begin re-encryption for user %s", user_id)
    with engine.begin() as db:
        # NOTE: Doing both of these operations in one transaction depends for
        # correctness on the fact that the creation of new checkpoints always
        # involves writing new data into the database from Python, rather than
        # simply copying data inside the DB.

        # If we change checkpoint creation so that it does an in-database copy,
        # then we need to split this transaction to ensure that
        # file-reencryption is complete before checkpoint-reencryption starts.

        # If that doesn't happen, it will be possible for a user to create a
        # new checkpoint in a transaction that hasn't seen the completed
        # file-reencryption process, but we might not see that checkpoint here,
        # which means that we would never update the content of that checkpoint
        # to the new encryption key.
        logger.info("Re-encrypting files for %s", user_id)
        for (file_id,) in select_file_ids(db, user_id):
            reencrypt_row_content(
                db,
                files,
                file_id,
                old_decrypt_func,
                new_encrypt_func,
                logger,
            )

        logger.info("Re-encrypting checkpoints for %s", user_id)
        for (cp_id,) in select_remote_checkpoint_ids(db, user_id):
            reencrypt_row_content(
                db,
                remote_checkpoints,
                cp_id,
                old_decrypt_func,
                new_encrypt_func,
                logger,
            )
    logger.info("Finished re-encryption for user %s", user_id)
Re-encrypt all of the files and checkpoints for a single user.