colinpetruno/portunus

namespace :portunus do
  desc "Rotate KEK keys, reencrypt the deks"
  task rotate_keks: :environment do
    if ENV["FORCE"] == "true"
      scope = ::Portunus::DataEncryptionKey.all
    else
      scope = ::Portunus::DataEncryptionKey.
        where(
          "last_kek_rotation < ? or (created_at < ? and last_kek_rotation is null)", 
          DateTime.now - ::Portunus.configuration.max_key_duration,
          DateTime.now - ::Portunus.configuration.max_key_duration
        )
    end

    scope.in_batches do |relation|
      relation.map do |encryption_key|
        ::Portunus::Rotators::Kek.for(encryption_key)
      end
    end
  end

  desc "Rotate DEK keys, reencrypt the data"
  task rotate_deks: :environment do
    if ENV["FORCE"] == "true"
      scope = ::Portunus::DataEncryptionKey.all
    else
      scope = ::Portunus::DataEncryptionKey.
        where(
          "last_dek_rotation < ? or (created_at < ? and last_dek_rotation is null)", 
          DateTime.now - ::Portunus.configuration.max_key_duration,
          DateTime.now - ::Portunus.configuration.max_key_duration
        )
    end
    scope.in_batches do |relation|
      relation.map do |encryption_key|
        ::Portunus::Rotators::Dek.for(encryption_key)
      end
    end
  end
end