🎩 What? Why?

The authorization metadata can contain sensitive personal information and it should be therefore encrypted.

This PR implements a new concern that provides automated encryption for active record attributes so that they will be stored encrypted in the database but when accessed through the code, they are available as plain text.

This is applied to the metadata attributes in the Decidim::Authorization record.

The change is transparent and should not affect any Decidim APIs or code relying on the metadata. The only implication to existing code can be if the JSON object has been queried directly through the database. Now that the values are encrypted in the database, these kinds of queries no longer work.

Testing

• Create a new authorization from the rails console, e.g. Decidim::Authorization.create!(name: "testing", metadata: { foo: "bar" }, decidim_user_id: 1, unique_id: "uniqid", granted_at: DateTime.now)
• Fetch that record and display it in the console to see that the metadata values are encrypted Decidim::Authorization.last
• Access the record's metadata in order to verify it is decrypted through the accessor method Decidim::Authorization.last.metadata

📋 Checklist

🚨 Please review the guidelines for contributing to this repository.

• ❓ CONSIDER adding a unit test if your PR resolves an issue.
• ✔️ DO check open PR's to avoid duplicates.
• ✔️ DO keep pull requests small so they can be easily reviewed.
• ✔️ DO build locally before pushing.
• ✔️ DO make sure tests pass.
• ✔️ DO make sure any new changes are documented in docs/.
• ✔️ DO add and modify seeds if necessary.
• ✔️ DO add CHANGELOG upgrade notes if required.
• ✔️ DO add to GraphQL API if there are new public fields.
• ✔️ DO add link to MetaDecidim if it's a new feature.
• ❌AVOID breaking the continuous integration build.
• ❌AVOID making significant changes to the overall architecture.