jschoubben
77e6c1a684
From review: the export counted any operator-sealed row as recoverable, so a secret sealed to a replaced key was reported as openable with the current one; replacing the key counted orphans in one table of two; and a pair credential held from two providers was recovered as whichever row came first. The export now lists what the current key opens, what an earlier key opens, and what has no copy; `secret recover` takes --provider and refuses ambiguity; files that must not exist are created exclusively; one constructor builds the export for the operator's file and the vault's disk alike.
220 lines
8.8 KiB
Go
220 lines
8.8 KiB
Go
package inventory
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/jackc/pgx/v5"
|
|
|
|
"github.com/novox/mesh-controller/internal/catalogue"
|
|
"github.com/novox/mesh-controller/internal/secrets"
|
|
)
|
|
|
|
// The operator's sealing key: the one holder of secrets that is not a node.
|
|
//
|
|
// Every secret a module holds for itself is sealed to the node that uses it, and a node whose key
|
|
// is gone takes its secrets with it — the mesh's root secrets included. novox/hq ADR 0085 (amended)
|
|
// gives them a second recipient: a person, holding a key whose private half never enters the mesh.
|
|
// What is recorded here is the public half, which is all the mesh needs to seal to it; what it
|
|
// yields is one more blob per secret that the mesh cannot open.
|
|
|
|
// operatorColumns is the pair of nullable columns a secret row carries for its operator copy:
|
|
// both null when the mesh has no operator key, so a row says plainly that no such copy exists.
|
|
func operatorColumns(operator, blob string) (sealed, key *string) {
|
|
if operator == "" || blob == "" {
|
|
return nil, nil
|
|
}
|
|
return &blob, &operator
|
|
}
|
|
|
|
// operatorSeal seals a value somebody supplied to the operator key, when the mesh has one.
|
|
func (i *Inventory) operatorSeal(ctx context.Context, value string) (sealed, key *string, err error) {
|
|
operator, err := i.OperatorKey(ctx)
|
|
if err != nil || operator == "" {
|
|
return nil, nil, err
|
|
}
|
|
blob, err := secrets.Seal(operator, []byte(value))
|
|
if err != nil {
|
|
return nil, nil, err
|
|
}
|
|
sealed, key = operatorColumns(operator, blob)
|
|
return sealed, key, nil
|
|
}
|
|
|
|
// OperatorKey is the public key secrets are also sealed to, or empty when the mesh has none.
|
|
func (i *Inventory) OperatorKey(ctx context.Context) (string, error) {
|
|
var key string
|
|
err := i.store.Pool().QueryRow(ctx,
|
|
`select public from operator_key order by made_at desc limit 1`).Scan(&key)
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return "", nil
|
|
}
|
|
return key, err
|
|
}
|
|
|
|
// SetOperatorKey records the operator's public key, replacing any earlier one.
|
|
//
|
|
// **Replacing is said, not silent.** Secrets sealed to the earlier key stay sealed to it: the
|
|
// plaintext is gone, so they cannot be sealed again to the new one until each is issued again. The
|
|
// number of them is returned so the caller can say so — a key swapped with nothing said would look
|
|
// like a mesh with a recovery path and be a mesh without one.
|
|
func (i *Inventory) SetOperatorKey(ctx context.Context, public string) (orphaned int, err error) {
|
|
if public == "" {
|
|
return 0, fmt.Errorf("an operator key is a public key, and this is nothing")
|
|
}
|
|
tx, err := i.store.Pool().Begin(ctx)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
defer tx.Rollback(ctx)
|
|
// Both tables: a module's own secrets and the pair credentials. A count over one of them said
|
|
// "nothing orphaned" about a mesh whose every vault-provided secret had just been.
|
|
if err := tx.QueryRow(ctx,
|
|
`select (select count(*) from module_secret where operator_key is not null and operator_key <> $1)
|
|
+ (select count(*) from secret where operator_key is not null and operator_key <> $1)`,
|
|
public).Scan(&orphaned); err != nil {
|
|
return 0, err
|
|
}
|
|
if _, err := tx.Exec(ctx, `delete from operator_key where public <> $1`, public); err != nil {
|
|
return 0, err
|
|
}
|
|
if _, err := tx.Exec(ctx,
|
|
`insert into operator_key (public) values ($1) on conflict (public) do nothing`, public); err != nil {
|
|
return 0, err
|
|
}
|
|
return orphaned, tx.Commit(ctx)
|
|
}
|
|
|
|
// Kept is the catalogue's: one secret as the operator can recover it.
|
|
type Kept = catalogue.Kept
|
|
|
|
// OperatorExport is the export as the operator and the vault both keep it: every secret sealed to
|
|
// the mesh's current operator key, every one sealed to an earlier key (recoverable with that key,
|
|
// if the person still has it), and every one with no operator copy at all. Nil when the mesh has
|
|
// no operator key. One constructor, so the file `secret export` writes and the file the mesh puts
|
|
// on the vault's disk cannot drift apart.
|
|
func (i *Inventory) OperatorExport(ctx context.Context) (*catalogue.KeptExport, error) {
|
|
operator, err := i.OperatorKey(ctx)
|
|
if err != nil || operator == "" {
|
|
return nil, err
|
|
}
|
|
kept, earlier, unrecoverable, err := i.KeptForOperator(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return &catalogue.KeptExport{
|
|
Export: 1, OperatorKey: operator, Fingerprint: secrets.Fingerprint(operator),
|
|
Kept: kept, EarlierKey: earlier, Unrecoverable: unrecoverable,
|
|
}, nil
|
|
}
|
|
|
|
// KeptForOperator is every secret by what can open it: the mesh's current operator key, an
|
|
// earlier operator key, or nothing.
|
|
//
|
|
// The last two are the honest half. A secret minted before the mesh had an operator key has no
|
|
// operator-sealed copy and cannot get one — the plaintext was discarded; one sealed to a key the
|
|
// mesh has since replaced is not opened by the current key, however the export is labelled. Naming
|
|
// both is what lets an export say what it does not cover, rather than being taken for complete.
|
|
func (i *Inventory) KeptForOperator(ctx context.Context) (kept, earlier, unrecoverable []Kept, err error) {
|
|
current, err := i.OperatorKey(ctx)
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
rows, err := i.store.Pool().Query(ctx,
|
|
`select 'own', n.name, s.module, s.name, '', s.origin, coalesce(s.operator_sealed, ''),
|
|
coalesce(s.operator_key, ''), s.made_at
|
|
from module_secret s join node n on n.id = s.node
|
|
union all
|
|
select 'pair', c.name, s.consumer_module, s.name, p.name, 'made', coalesce(s.operator_sealed, ''),
|
|
coalesce(s.operator_key, ''), s.created_at
|
|
from secret s join node c on c.id = s.consumer join node p on p.id = s.provider
|
|
order by 1, 2, 3, 4`)
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
defer rows.Close()
|
|
for rows.Next() {
|
|
var k Kept
|
|
if err := rows.Scan(&k.Kind, &k.Node, &k.Module, &k.Name, &k.Provider, &k.Origin, &k.Sealed, &k.Key, &k.MadeAt); err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
switch {
|
|
case k.Sealed == "":
|
|
unrecoverable = append(unrecoverable, k)
|
|
case k.Key != current:
|
|
earlier = append(earlier, k)
|
|
default:
|
|
kept = append(kept, k)
|
|
}
|
|
}
|
|
return kept, earlier, unrecoverable, rows.Err()
|
|
}
|
|
|
|
// KeptSecret is one secret's operator-sealed copy, for recovery.
|
|
//
|
|
// An own secret first, then a pair credential by the provision's name — a module whose own secret
|
|
// and requirement share a name is refused at resolution, so the two cannot both answer. A pair
|
|
// credential is keyed by provider as well, and a consumer whose provision moved leaves the old
|
|
// provider's row behind: two rows is refused with both providers named, never answered with
|
|
// whichever came first, unless `provider` says which.
|
|
func (i *Inventory) KeptSecret(ctx context.Context, node, module, name, provider string) (Kept, error) {
|
|
var k Kept
|
|
err := i.store.Pool().QueryRow(ctx,
|
|
`select 'own', n.name, s.module, s.name, '', s.origin, coalesce(s.operator_sealed, ''),
|
|
coalesce(s.operator_key, ''), s.made_at
|
|
from module_secret s join node n on n.id = s.node
|
|
where n.name = $1 and s.module = $2 and s.name = $3`, node, module, name).
|
|
Scan(&k.Kind, &k.Node, &k.Module, &k.Name, &k.Provider, &k.Origin, &k.Sealed, &k.Key, &k.MadeAt)
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
rows, qerr := i.store.Pool().Query(ctx,
|
|
`select 'pair', c.name, s.consumer_module, s.name, p.name, 'made', coalesce(s.operator_sealed, ''),
|
|
coalesce(s.operator_key, ''), s.created_at
|
|
from secret s join node c on c.id = s.consumer join node p on p.id = s.provider
|
|
where c.name = $1 and s.consumer_module = $2 and s.name = $3 and ($4 = '' or p.name = $4)
|
|
order by p.name`, node, module, name, provider)
|
|
if qerr != nil {
|
|
return Kept{}, qerr
|
|
}
|
|
defer rows.Close()
|
|
var found []Kept
|
|
for rows.Next() {
|
|
var row Kept
|
|
if err := rows.Scan(&row.Kind, &row.Node, &row.Module, &row.Name, &row.Provider, &row.Origin, &row.Sealed, &row.Key, &row.MadeAt); err != nil {
|
|
return Kept{}, err
|
|
}
|
|
found = append(found, row)
|
|
}
|
|
if err := rows.Err(); err != nil {
|
|
return Kept{}, err
|
|
}
|
|
switch len(found) {
|
|
case 0:
|
|
err = pgx.ErrNoRows
|
|
case 1:
|
|
k, err = found[0], nil
|
|
default:
|
|
providers := make([]string, 0, len(found))
|
|
for _, f := range found {
|
|
providers = append(providers, f.Provider)
|
|
}
|
|
return Kept{}, fmt.Errorf("%s on %s holds a %q credential from more than one provider (%s); say which with --provider",
|
|
module, node, name, strings.Join(providers, ", "))
|
|
}
|
|
}
|
|
if errors.Is(err, pgx.ErrNoRows) {
|
|
return Kept{}, fmt.Errorf("%s on %s holds nothing called %q — neither a secret of its own nor a credential for a provision", module, node, name)
|
|
}
|
|
if err != nil {
|
|
return Kept{}, err
|
|
}
|
|
if k.Sealed == "" {
|
|
return Kept{}, fmt.Errorf(
|
|
"%s on %s holds %q, but it was made before the mesh had an operator key and so has no "+
|
|
"copy a person can open. Issue it again (secret accept, or let the mesh remake it) "+
|
|
"and it will", module, node, name)
|
|
}
|
|
return k, nil
|
|
}
|