novox/mesh-controller
3
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

Recoverable means sealed to the current operator key; recovery names the provider

Browse Source 
From review: the export counted any operator-sealed row as recoverable, so a
secret sealed to a replaced key was reported as openable with the current one;
replacing the key counted orphans in one table of two; and a pair credential
held from two providers was recovered as whichever row came first. The export
now lists what the current key opens, what an earlier key opens, and what has
no copy; `secret recover` takes --provider and refuses ambiguity; files that
must not exist are created exclusively; one constructor builds the export for
the operator's file and the vault's disk alike.
This commit is contained in:
jschoubben
2026-09-21 01:16:32 +02:00
parent 565f144a20
commit 77e6c1a684
9 changed files with 308 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/inventory/secrets.go
+7 -29
View File
@@ -80,18 +80,11 @@ func (i *Inventory) SecretFor(ctx context.Context, name, consumer, consumerModul
if err != nil {
return Secret{}, err
}
var also []string
if operator != "" {
also = append(also, operator)
}
made, more, err := secrets.MakeAlso(consumerKey, providerKey, also...)
made, blob, err := secrets.MakeWithOperator(consumerKey, providerKey, operator)
if err != nil {
return Secret{}, err
}
var forOperator, operatorKey *string
if operator != "" {
forOperator, operatorKey = &more[0], &operator
}
forOperator, operatorKey := operatorColumns(operator, blob)
_, err = i.store.Pool().Exec(ctx,
`insert into secret (name, consumer, consumer_module, provider, for_consumer, for_provider,
consumer_key, provider_key, operator_sealed, operator_key)
@@ -246,21 +239,14 @@ func (i *Inventory) SecretForModule(ctx context.Context, node, module, name stri
if err != nil {
return "", err
}
var also []string
if operator != "" {
also = append(also, operator)
}
made, more, err := secrets.MakeAlso(key, key, also...)
if err != nil {
return "", err
}
// Sealed once to the machine — Make seals to two ends because a provision has two; here both
// are the same machine, and only one copy is kept — and once more to the operator when the
// mesh has one (novox/hq ADR 0085, amended), which is the copy a person can recover from.
var forOperator, operatorKey *string
if operator != "" {
forOperator, operatorKey = &more[0], &operator
made, blob, err := secrets.MakeWithOperator(key, key, operator)
if err != nil {
return "", err
}
forOperator, operatorKey := operatorColumns(operator, blob)
if _, err := i.store.Pool().Exec(ctx,
`insert into module_secret (node, module, name, sealed, node_key, origin, operator_sealed, operator_key)
values ($1, $2, $3, $4, $5, 'made', $6, $7)
@@ -304,18 +290,10 @@ func (i *Inventory) AcceptSecretForModule(ctx context.Context, node, module, nam
}
// And to the operator, when the mesh has one: a value a person supplied is the one a person
// most needs to get back, since the mesh cannot make another (novox/hq ADR 0085, amended).
operator, err := i.OperatorKey(ctx)
forOperator, operatorKey, err := i.operatorSeal(ctx, value)
if err != nil {
return err
}
var forOperator, operatorKey *string
if operator != "" {
blob, err := secrets.Seal(operator, []byte(value))
if err != nil {
return err
}
forOperator, operatorKey = &blob, &operator
}
_, err = i.store.Pool().Exec(ctx,
`insert into module_secret (node, module, name, sealed, node_key, origin, operator_sealed, operator_key)
values ($1, $2, $3, $4, $5, 'accepted', $6, $7)