Hash SCIM tokens

[smatting]

Currently SCIM tokens are persisted in plain text. Fixes https://github.com/zinfra/backend-issues/issues/1652

With this PR new SCIM tokens will only have their SHA512 hashes persisted.
Existing tokens (still persisted in plaintext) will remain valid, but will be re-persisted with their hash on every validation.

The columns team_provisioning_by_token.token_, team_provisioning_by_team.token_ which contained the plaintext token will be repurposed and also contain the hash value.
To distinguish plaintext from hash values the hash values are prefixed with sha512:. In Haskell these two types are represented as the sum type

data ScimTokenLookupKey
  = ScimTokenLookupKeyHashed ScimTokenHash
  | ScimTokenLookupKeyPlaintext ScimToken
  deriving (Eq, Show)

This way all plaintext tokens which are regularly used should be converted to their hash. The remaining tokens should be converted via batch process or invalidated.

• create follow-up issue for that

[fisx]

👍 (some comments)

[fisx]

Add a roundtrip test, like these?

(I admit that there are more gaps in the roundtrip test coverage, but we might as well start now to patch them...)

[fisx]

(we can also do that in a separate PR)

[smatting]

added roundtrip test

[fisx]

This can return both hashed and unhashed in any order, if both are still in the DB (race condition).

[smatting]

done

[fisx]

Found two things (both harmless). Integration tests pass locally.

[fisx]

Found two things (both harmless). Integration tests pass locally.

That was wrong: the stray delete query risks a race condition where a token that should be available is already gone in unhashed from and not there yet in hashed form. Not very likely to materialize, but please fix it anyway.

[smatting]

1 out of 247 tests failed (356.63s)
The failing test is unrelated to this PR: https://github.com/zinfra/backend-issues/issues/1875