[SPIKE] Ways to Hash Full Rows of Data

[jperson1]

We have an open draft PR for hashing certain parts of our data. We want to include hashes for our internal SingleAuditChecklist and SingleAuditReportFile tables, and for our external dissemination_* tables.

The simplest approach, given the current audit flow, is to add/update the hash every time we update the table. For the external tables, this is only on dissemination. For the SingleAuditReportFile, it's only when that form is uploaded. For the SingleAuditChecklist, it's on every web form and excel file upload. That may get cumbersome to maintain.

Is there an easier way? So that we don't have to invoke the hash update in so many places. Perhaps a generated field on the model in Django. Perhaps something at the DB level. Perhaps even a service that sits on the app or DB (that may be more annoying, actually).

Acceptance criteria:

1. If this way is already the best way, a short writeup as to why. Then, we'll proceed with the draft PR.
2. If this way is not already the best way:
   • A short writeup for the new method
   • If it's simple enough to complete, just Do the Thing
   • Followup tickets as necessary

[phildominguez-gsa]

I haven't officially picked this up, just noting some thoughts:

• Updating hashes within intake_to_dissemination as Matt has makes sense to me
• I think that making the hash calculation resistant to field name changes by strictly hashing values (and not keys) could lead to more problems (via false identical hashes) than it solves. Asking the robot about this, we could hard code keys and really simplify the code:

def calculate_hash(self) -> str:
    # Use permanent integer or string identifiers instead of Python attribute names
    data = {
        "v1": self.title,
        "v2": self.content,
        "v3": self.status,
    }
    serialized = json.dumps(data, sort_keys=True, default=str)
    return hashlib.sha256(serialized.encode("utf-8")).hexdigest()

• SingleAuditChecklist and SingleAuditReportFile can have their hashes recalculated within their save()s so we shouldn't have to do it in a bunch of places
• Instead of specifying every field to hash, would it be easier to specify fields NOT to hash?