Stop querying unused user email columns

app/models/concerns/deprecated_user_attributes.rb

@@ -2,7 +2,7 @@ module DeprecatedUserAttributes
   extend ActiveSupport::Concern
 
   DEPRECATED_ATTRIBUTES = %i[
-    email_fingerprint encrypted_email email confirmed_at
+    email confirmed_at
   ].freeze
 
   def []=(attribute, value)

app/models/concerns/user_encrypted_attribute_overrides.rb

@@ -21,24 +21,4 @@ def find_with_confirmed_email(email)
       email_address&.user
     end
   end
-
-  # Override ActiveModel::Dirty methods in order to
-  # use email_fingerprint_changed? instead of email_changed?
-  # This is necessary because email is no longer an ActiveRecord
-  # attribute and all the *_changed and *_was magic no longer works.
-  def will_save_change_to_email?
-    email_fingerprint_changed?
-  end
-
-  def email_in_database
-    EncryptedAttribute.new(encrypted_email_was).decrypted if encrypted_email_was.present?
-  end
-
-  # Override usual setter method in order to also set fingerprint
-  def email=(email)
-    set_encrypted_attribute(name: :email, value: email)
-    self.email_fingerprint = email.present? ? encrypted_attributes[:email].fingerprint : ''
-    return if email_addresses.empty?
-    email_addresses.take.email = email
-  end
 end

app/models/user.rb

@@ -1,5 +1,5 @@
 class User < ApplicationRecord
-  self.ignored_columns = %w[totp_timestamp]
+  self.ignored_columns = %w[totp_timestamp email_fingerprint encrypted_email]
   include NonNullUuid
 
   include ::NewRelic::Agent::MethodTracer

lib/tasks/dev.rake

@@ -3,18 +3,14 @@ namespace :dev do
   task prime: :environment do
     pw = 'salty pickles'
     %w[test1@test.com test2@test.com admin@gsa.gov].each_with_index do |email, index|
-      ee = EncryptedAttribute.new_from_decrypted(email)
-      User.find_or_create_by!(email_fingerprint: ee.fingerprint) do |user|
-        setup_user(user, ee: ee, pw: pw, num: index)
-      end
+      user = User.find_with_email(email) || User.create!
+      setup_user(user, email: email, pw: pw, num: index)
     end
 
-    ee = EncryptedAttribute.new_from_decrypted('totp@test.com')
-    User.find_or_create_by!(email_fingerprint: ee.fingerprint) do |user|
-      setup_totp_user(user, ee: ee, pw: pw)
-    end
+    user = User.find_with_email('totp@test.com') || User.create!
+    setup_totp_user(user, email: 'totp@test.com', pw: pw)
 
-    ial2_user = User.find_by(email_fingerprint: fingerprint('test2@test.com'))
+    ial2_user = User.find_with_email('test2@test.com')
     profile = Profile.new(user: ial2_user)
     pii = Pii::Attributes.new_from_hash(
       ssn: '660-00-1234',
@@ -57,13 +53,10 @@ namespace :dev do
     User.transaction do
       while num_created < num_users
         email_addr = "testuser#{num_created}@example.com"
-        ee = EncryptedAttribute.new_from_decrypted(email_addr)
-        User.find_or_create_by!(email_fingerprint: ee.fingerprint) do |user|
-          setup_user(user, ee: ee, pw: pw, num: num_created)
-        end
+        user = User.find_with_email(email_addr) || User.create!
+        setup_user(user, email: email_addr, pw: pw, num: num_created)
 
         if ENV['VERIFIED']
-          user = User.find_by(email_fingerprint: ee.fingerprint)
           profile = Profile.new(user: user)
           pii = Pii::Attributes.new_from_hash(
             first_name: 'Test',
@@ -107,18 +100,15 @@ namespace :dev do
     warn "Emails: #{emails.join(', ')}\nPassword: salty pickles"
   end
 
-  # rubocop:disable all
   def setup_user(user, args)
-    user.encrypted_email = args[:ee].encrypted
+    EmailAddress.create!(email: args[:email], user: user, confirmed_at: Time.zone.now)
     user.reset_password(args[:pw], args[:pw])
     MfaContext.new(user).phone_configurations.create(phone_configuration_data(user, args))
     Event.create(user_id: user.id, event_type: :account_created)
-    user.email_addresses.update_all(confirmed_at: Time.zone.now)
   end
-  # rubocop:enable all
 
   def setup_totp_user(user, args)
-    user.encrypted_email = args[:ee].encrypted
+    EmailAddress.create!(email: args[:email], user: user, confirmed_at: Time.zone.now)
     user.reset_password(args[:pw], args[:pw])
     Event.create(user_id: user.id, event_type: :account_created)
   end

spec/features/users/sign_in_spec.rb

@@ -432,15 +432,15 @@
         create(:user, :signed_up, email: email, password: password)
 
         user = User.find_with_email(email)
-        encrypted_email = user.encrypted_email
+        encrypted_email = user.confirmed_email_addresses.first.encrypted_email
 
         rotate_attribute_encryption_key_with_invalid_queue
 
         expect { signin(email, password) }.
           to raise_error Encryption::EncryptionError, 'unable to decrypt attribute with any key'
 
         user = user.reload
-        expect(user.encrypted_email).to eq encrypted_email
+        expect(user.confirmed_email_addresses.first.encrypted_email).to eq encrypted_email
       end
     end
 
@@ -452,14 +452,14 @@
         create(:user, :signed_up, email: email, password: password)
 
         user = User.find_with_email(email)
-        encrypted_email = user.encrypted_email
+        encrypted_email = user.confirmed_email_addresses.first.encrypted_email
 
         rotate_attribute_encryption_key_with_invalid_queue
 
         sign_in_user_with_piv(user)
 
         user = user.reload
-        expect(user.encrypted_email).to eq encrypted_email
+        expect(user.confirmed_email_addresses.first.encrypted_email).to eq encrypted_email
       end
     end
   end