GitHub Classroom automates repository creation and access control, making it easy for teachers to distribute starter code and collect assignments on GitHub.
We'd like to encrypt the stored tokens at rest. To pursue this we'll be leveraging rbnacl with SimpleBox support. This relies on libsodium and is good. To build this we'll be building custom readers and writers for the token field to allow for versioned token generations and revocation.
We'd like to encrypt the stored tokens at rest. To pursue this we'll be leveraging rbnacl with SimpleBox support. This relies on libsodium and is good. To build this we'll be building custom readers and writers for the token field to allow for versioned token generations and revocation.
https://github.com/RubyCrypto/rbnacl/wiki/SimpleBox
We'll also need to install libsodium on Travis and Heroku (via buildpack)
To deploy this we will need to pursue one of the following strategies:
New field option
Create a new field
crypted_token
Write to both fields:
token
,crypted_token
Run a transition to write legacy encrypted tokens
Read from
crypted_token
Delete
token
Existing field option
Ensure no tokens start with
GH_
, make sure there are no nil tokens (confirmed!)Make a custom writer that writes the
GH_
prefix and encrypted version of the password (check length constraints)Make a custom reader that checks for the
GH_
prefix and if there decrypts the remaining password or returns the token as isMake sure:
token_was
andtoken_changed?
functions still works (inensure_no_token_scope_loss
)Given these two options, we are likely going to choose the existing field option.
cc @JessRudder @education/classroom
https://api.rubyonrails.org/classes/ActiveRecord/Base.html#class-ActiveRecord::Base-label-Overwriting+default+accessors