@Override
    public void upgrade() {
        final MongoCollection<Document> collection = mongoConnection.getMongoDatabase().getCollection(AccessTokenImpl.COLLECTION_NAME);

        // We use the absence of the "token_type" field as an indicator to select access tokens that need to be encrypted
        // If we should change the encryption method in the future, we need to adjust the query
        for (final Document document : collection.find(Filters.exists(AccessTokenImpl.TOKEN_TYPE, false))) {
            final String tokenId = document.getObjectId("_id").toHexString();
            final String tokenName = document.getString(AccessTokenImpl.NAME);
            final String tokenUsername = document.getString(AccessTokenImpl.USERNAME);
            final String tokenValue = document.getString(AccessTokenImpl.TOKEN);

            if (isNullOrEmpty(tokenValue)) {
                LOG.warn("Couldn't encrypt empty value for access token <{}/{}> of user <{}>", tokenId, tokenName, tokenUsername);
                continue;
            }

            final Bson query = Filters.eq("_id", document.getObjectId("_id"));
            final Bson updates = Updates.combine(
                    Updates.set(AccessTokenImpl.TOKEN_TYPE, AccessTokenImpl.Type.AES_SIV.getIntValue()),
                    Updates.set(AccessTokenImpl.TOKEN, accessTokenCipher.encrypt(tokenValue))
            );

            LOG.info("Encrypting access token <{}/{}> for user <{}>", tokenId, tokenName, tokenUsername);
            final UpdateResult result = collection.updateOne(query, updates);
            if (result.getModifiedCount() != 1) {
                LOG.warn("Expected to modify one access token, but <{}> have been updated", result.getModifiedCount());
            }
        }
    }
@Test
    @MongoDBFixtures("V20200226181600_EncryptAccessTokensMigrationTest.json")
    public void upgrade() {
        final Document plainToken1 = collection.find(Filters.eq("_id", new ObjectId("54e3deadbeefdeadbeef0001"))).first();
        final Document plainToken2 = collection.find(Filters.eq("_id", new ObjectId("54e3deadbeefdeadbeef0002"))).first();
        final Document plainToken3 = collection.find(Filters.eq("_id", new ObjectId("54e3deadbeefdeadbeef0003"))).first();

        assertThat(plainToken1).isNotNull();
        assertThat(plainToken2).isNotNull();
        assertThat(plainToken3).isNotNull();

        migration.upgrade();

        final Document encryptedToken1 = collection.find(Filters.eq("_id", new ObjectId("54e3deadbeefdeadbeef0001"))).first();
        final Document encryptedToken2 = collection.find(Filters.eq("_id", new ObjectId("54e3deadbeefdeadbeef0002"))).first();
        final Document encryptedToken3 = collection.find(Filters.eq("_id", new ObjectId("54e3deadbeefdeadbeef0003"))).first();

        assertThat(plainToken1).isNotEqualTo(encryptedToken1); // Must be encrypted, so not equal
        assertThat(plainToken2).isEqualTo(encryptedToken2);    // Already was encrypted, migration shouldn't touch it
        assertThat(plainToken3).isNotEqualTo(encryptedToken3); // Must be encrypted, so not equal

        // Newly encrypted token
        assertThat(encryptedToken1).satisfies(t -> {
            final Document token = (Document) t;

            assertThat(token.getString(NAME)).isEqualTo("cli-access");
            assertThat(token.getString(USERNAME)).isEqualTo("jane");
            assertThat(token.getString(TOKEN)).isEqualTo("cc21d0e8fcbf8c28f8fd56c30e81e5f92cf8bcbf846c69cdcc4eec5ffe64f592bf604141be77e46c819a8997d9d245f1bc9f5f60dc44e490ca6ad07b25d45338efb3bad5");
            assertThat(token.getInteger(TOKEN_TYPE)).isEqualTo(AccessTokenImpl.Type.AES_SIV.getIntValue());
            assertThat(token.get(LAST_ACCESS)).isEqualTo(DateTime.parse("2020-02-26T21:50:12.454Z").toDate());
        });

        // Already encrypted token
        assertThat(encryptedToken2).satisfies(t -> {
            final Document token = (Document) t;

            assertThat(token.getString(NAME)).isEqualTo("test-1");
            assertThat(token.getString(USERNAME)).isEqualTo("john");
            assertThat(token.getString(TOKEN)).isEqualTo("d5f6fc27206946c15f183764c32526674108f9f4");
            assertThat(token.getInteger(TOKEN_TYPE)).isEqualTo(AccessTokenImpl.Type.AES_SIV.getIntValue());
            assertThat(token.get(LAST_ACCESS)).isEqualTo(DateTime.parse("2020-01-27T16:23:02.758Z").toDate());
        });

        // Newly encrypted token
        assertThat(encryptedToken3).satisfies(t -> {
            final Document token = (Document) t;

            assertThat(token.getString(NAME)).isEqualTo("test-2");
            assertThat(token.getString(USERNAME)).isEqualTo("john");
            assertThat(token.getString(TOKEN)).isEqualTo("55acb1b25c787ae1bc91e7eb1694b39277881b4e4643369590c49afd18ac745b4b60ad4aab058dfb4b6f00eba8d30a2c4c188cc9b5832cd9d9620aab82281651797ff3");
            assertThat(token.getInteger(TOKEN_TYPE)).isEqualTo(AccessTokenImpl.Type.AES_SIV.getIntValue());
            assertThat(token.get(LAST_ACCESS)).isEqualTo(DateTime.parse("2020-01-27T18:23:02.758Z").toDate());
        });
    }