update encryption migration checks and tests

awx/conf/migrations/_reencrypt.py

@@ -9,7 +9,7 @@ from awx.conf import settings_registry
 
 
 __all__ = ['replace_aesecb_fernet', 'get_encryption_key', 'encrypt_field',
-           'decrypt_value', 'decrypt_value']
+           'decrypt_value', 'decrypt_value', 'should_decrypt_field']
 
 
 def replace_aesecb_fernet(apps, schema_editor):
@@ -17,9 +17,8 @@ def replace_aesecb_fernet(apps, schema_editor):
 
     for setting in Setting.objects.filter().order_by('pk'):
         if settings_registry.is_setting_encrypted(setting.key):
-            if setting.value.startswith('$encrypted$AESCBC$'):
-                continue
-            setting.value = decrypt_field(setting, 'value')
+            if should_decrypt_field(setting.value):
+                setting.value = decrypt_field(setting, 'value')
             setting.save()
 
 
@@ -100,3 +99,7 @@ def encrypt_field(instance, field_name, ask=False, subfield=None, skip_utf8=Fals
         # know to decode the data when it's decrypted later
         tokens.insert(1, 'UTF8')
     return '$'.join(tokens)
+
+
+def should_decrypt_field(value):
+    return value.startswith('$encrypted$') and '$AESCBC$' not in value

awx/conf/tests/functional/test_reencrypt_migration.py

@@ -1,3 +1,7 @@
+# -*- coding: utf-8 -*-
+
+# Copyright (c) 2017 Ansible, Inc.
+# All Rights Reserved.
 import pytest
 import mock
 
@@ -12,17 +16,21 @@ from awx.main.utils import decrypt_field as new_decrypt_field
 
 
 @pytest.mark.django_db
-def test_settings():
+@pytest.mark.parametrize("old_enc, new_enc, value", [
+    ('$encrypted$UTF8$AES', '$encrypted$UTF8$AESCBC$', u'Iñtërnâtiônàlizætiøn'),
+    ('$encrypted$AES$', '$encrypted$AESCBC$', 'test'),
+])
+def test_settings(old_enc, new_enc, value):
     with mock.patch('awx.conf.models.encrypt_field', encrypt_field):
         with mock.patch('awx.conf.settings.decrypt_field', decrypt_field):
-            setting = Setting.objects.create(key='SOCIAL_AUTH_GITHUB_SECRET', value='test')
-    assert setting.value.startswith('$encrypted$AES$')
+            setting = Setting.objects.create(key='SOCIAL_AUTH_GITHUB_SECRET', value=value)
+    assert setting.value.startswith(old_enc)
 
     replace_aesecb_fernet(apps, None)
     setting.refresh_from_db()
 
-    assert setting.value.startswith('$encrypted$AESCBC$')
-    assert new_decrypt_field(setting, 'value') == 'test'
+    assert setting.value.startswith(new_enc)
+    assert new_decrypt_field(setting, 'value') == value
 
     # This is here for a side-effect.
     # Exception if the encryption type of AESCBC is not properly skipped, ensures