From f7aad2e0c88c044e592c09431cdf5e74eb087226 Mon Sep 17 00:00:00 2001 From: Jim Date: Tue, 26 Jan 2021 14:37:10 -0500 Subject: [PATCH] add a new oidc key+ key version for encrypting oidc state payloads returned in auth URLs. (#884) --- Makefile | 3 +- .../migrations/postgres/dev/82_kms.down.sql | 2 + .../migrations/postgres/dev/82_kms.up.sql | 65 ++++ internal/db/schema/postgres_migration.gen.go | 69 +++- internal/kms/const.go | 12 + internal/kms/ids.go | 20 + internal/kms/ids_test.go | 10 + internal/kms/immutable_fields_test.go | 98 +++++ internal/kms/oidc_key.go | 83 ++++ internal/kms/oidc_key_test.go | 206 ++++++++++ internal/kms/oidc_key_version.go | 122 ++++++ internal/kms/oidc_key_version_test.go | 249 ++++++++++++ internal/kms/repository.go | 11 + internal/kms/repository_oidc_key.go | 160 ++++++++ internal/kms/repository_oidc_key_test.go | 297 ++++++++++++++ internal/kms/repository_oidc_key_version.go | 173 +++++++++ .../kms/repository_oidc_key_version_test.go | 367 ++++++++++++++++++ internal/kms/repository_test.go | 13 + internal/kms/store/oidc_key.pb.go | 329 ++++++++++++++++ internal/kms/testing.go | 34 ++ .../storage/kms/store/v1/oidc_key.proto | 53 +++ 21 files changed, 2374 insertions(+), 2 deletions(-) create mode 100644 internal/db/schema/migrations/postgres/dev/82_kms.down.sql create mode 100644 internal/db/schema/migrations/postgres/dev/82_kms.up.sql create mode 100644 internal/kms/oidc_key.go create mode 100644 internal/kms/oidc_key_test.go create mode 100644 internal/kms/oidc_key_version.go create mode 100644 internal/kms/oidc_key_version_test.go create mode 100644 internal/kms/repository_oidc_key.go create mode 100644 internal/kms/repository_oidc_key_test.go create mode 100644 internal/kms/repository_oidc_key_version.go create mode 100644 internal/kms/repository_oidc_key_version_test.go create mode 100644 internal/kms/store/oidc_key.pb.go create mode 100644 internal/proto/local/controller/storage/kms/store/v1/oidc_key.proto diff --git a/Makefile b/Makefile index d5166c6b8..bbe9194e9 100644 --- a/Makefile +++ b/Makefile @@ -126,7 +126,8 @@ protobuild: @protoc-go-inject-tag -input=./internal/kms/store/database_key.pb.go @protoc-go-inject-tag -input=./internal/kms/store/oplog_key.pb.go @protoc-go-inject-tag -input=./internal/kms/store/token_key.pb.go - @protoc-go-inject-tag -input=./internal/kms/store/session_key.pb.go + @protoc-go-inject-tag -input=./internal/kms/store/session_key.pb.go + @protoc-go-inject-tag -input=./internal/kms/store/oidc_key.pb.go @protoc-go-inject-tag -input=./internal/target/store/target.pb.go @rm -R ${TMP_DIR} diff --git a/internal/db/schema/migrations/postgres/dev/82_kms.down.sql b/internal/db/schema/migrations/postgres/dev/82_kms.down.sql new file mode 100644 index 000000000..26104d89a --- /dev/null +++ b/internal/db/schema/migrations/postgres/dev/82_kms.down.sql @@ -0,0 +1,2 @@ +begin; +commit; \ No newline at end of file diff --git a/internal/db/schema/migrations/postgres/dev/82_kms.up.sql b/internal/db/schema/migrations/postgres/dev/82_kms.up.sql new file mode 100644 index 000000000..3935fb539 --- /dev/null +++ b/internal/db/schema/migrations/postgres/dev/82_kms.up.sql @@ -0,0 +1,65 @@ +begin; + +-- kms_oidc_key entries are DEKs for encrypting oidc entries. +create table kms_oidc_key ( + private_id wt_private_id primary key, + root_key_id wt_private_id not null unique -- there can be only one oidc dek per root key + references kms_root_key(private_id) + on delete cascade + on update cascade, + create_time wt_timestamp +); + + -- define the immutable fields for kms_oidc_key (all of them) +create trigger + immutable_columns +before +update on kms_oidc_key + for each row execute procedure immutable_columns('private_id', 'root_key_id', 'create_time'); + +-- define the value of kms_oidc_key's create_time +create trigger + default_create_time_column +before +insert on kms_oidc_key + for each row execute procedure default_create_time(); + +-- kms_oidc_key_version entries are version of DEK keys used to encrypt oidc +-- entries. +create table kms_oidc_key_version ( + private_id wt_private_id primary key, + oidc_key_id wt_private_id not null + references kms_oidc_key(private_id) + on delete cascade + on update cascade, + root_key_version_id wt_private_id not null + references kms_root_key_version(private_id) + on delete cascade + on update cascade, + version wt_version, + key bytea not null, + create_time wt_timestamp, + unique(oidc_key_id, version) +); + + -- define the immutable fields for kms_oidc_key_version (all of them) +create trigger + immutable_columns +before +update on kms_oidc_key_version + for each row execute procedure immutable_columns('private_id', 'oidc_key_id', 'root_key_version_id', 'version', 'key', 'create_time'); + +-- define the value of kms_oidc_key_version's create_time +create trigger + default_create_time_column +before +insert on kms_oidc_key_version + for each row execute procedure default_create_time(); + +-- define the value of kms_oidc_key_version's version column +create trigger + kms_version_column +before insert on kms_oidc_key_version + for each row execute procedure kms_version_column('oidc_key_id'); + +commit; \ No newline at end of file diff --git a/internal/db/schema/postgres_migration.gen.go b/internal/db/schema/postgres_migration.gen.go index 8b679742e..fac16214e 100644 --- a/internal/db/schema/postgres_migration.gen.go +++ b/internal/db/schema/postgres_migration.gen.go @@ -5,7 +5,7 @@ package schema func init() { migrationStates["postgres"] = migrationState{ devMigration: true, - binarySchemaVersion: 1001, + binarySchemaVersion: 1082, upMigrations: map[int][]byte{ 1: []byte(` begin; @@ -4988,6 +4988,73 @@ create table server_tag ( primary key(server_id, key, value) ); +commit; +`), + 1082: []byte(` +begin; + +-- kms_oidc_key entries are DEKs for encrypting oidc entries. +create table kms_oidc_key ( + private_id wt_private_id primary key, + root_key_id wt_private_id not null unique -- there can be only one oidc dek per root key + references kms_root_key(private_id) + on delete cascade + on update cascade, + create_time wt_timestamp +); + + -- define the immutable fields for kms_oidc_key (all of them) +create trigger + immutable_columns +before +update on kms_oidc_key + for each row execute procedure immutable_columns('private_id', 'root_key_id', 'create_time'); + +-- define the value of kms_oidc_key's create_time +create trigger + default_create_time_column +before +insert on kms_oidc_key + for each row execute procedure default_create_time(); + +-- kms_oidc_key_version entries are version of DEK keys used to encrypt oidc +-- entries. +create table kms_oidc_key_version ( + private_id wt_private_id primary key, + oidc_key_id wt_private_id not null + references kms_oidc_key(private_id) + on delete cascade + on update cascade, + root_key_version_id wt_private_id not null + references kms_root_key_version(private_id) + on delete cascade + on update cascade, + version wt_version, + key bytea not null, + create_time wt_timestamp, + unique(oidc_key_id, version) +); + + -- define the immutable fields for kms_oidc_key_version (all of them) +create trigger + immutable_columns +before +update on kms_oidc_key_version + for each row execute procedure immutable_columns('private_id', 'oidc_key_id', 'root_key_version_id', 'version', 'key', 'create_time'); + +-- define the value of kms_oidc_key_version's create_time +create trigger + default_create_time_column +before +insert on kms_oidc_key_version + for each row execute procedure default_create_time(); + +-- define the value of kms_oidc_key_version's version column +create trigger + kms_version_column +before insert on kms_oidc_key_version + for each row execute procedure kms_version_column('oidc_key_id'); + commit; `), }, diff --git a/internal/kms/const.go b/internal/kms/const.go index ad6b4025a..a9641cfdf 100644 --- a/internal/kms/const.go +++ b/internal/kms/const.go @@ -24,6 +24,10 @@ const ( // KeyPurposeSessions is used as a base key to derive session-specific encryption keys KeyPurposeSessions + + // KeyPurposeOidc is used for encrypting oidc states included in + // authentication URLs + KeyPurposeOidc ) // String returns the key purpose cast as a string, just so it can be called as @@ -40,6 +44,8 @@ func (k KeyPurpose) String() string { return "tokens" case KeyPurposeSessions: return "sessions" + case KeyPurposeOidc: + return "oidc" default: return "unknown" } @@ -61,6 +67,8 @@ const ( KeyTypeTokenKeyVersion KeyTypeSessionKey KeyTypeSessionKeyVersion + KeyTypeOidcKey + KeyTypeOidcKeyVersion ) // String returns the key type cast as a string, just so it can be called as @@ -87,6 +95,10 @@ func (k KeyType) String() string { return "sessionKey" case KeyTypeSessionKeyVersion: return "sessionKeyVersion" + case KeyTypeOidcKey: + return "oidcKey" + case KeyTypeOidcKeyVersion: + return "oidcKeyVersion" default: return "unknown" diff --git a/internal/kms/ids.go b/internal/kms/ids.go index f05c6f56d..26c44d22f 100644 --- a/internal/kms/ids.go +++ b/internal/kms/ids.go @@ -16,6 +16,8 @@ const ( TokenKeyVersionPrefix = "ktv" SessionKeyPrefix = "ksk" SessionKeyVersionPrefix = "kskv" + OidcKeyPrefix = "koidck" + OidcKeyVersionPrefix = "koidckv" ) func newRootKeyId() (string, error) { @@ -107,3 +109,21 @@ func newSessionKeyVersionId() (string, error) { } return id, nil } + +func newOidcKeyId() (string, error) { + const op = "kms.newOidcKeyId" + id, err := db.NewPublicId(OidcKeyPrefix) + if err != nil { + return "", errors.Wrap(err, op) + } + return id, nil +} + +func newOidcKeyVersionId() (string, error) { + const op = "kms.newOidcKeyVersionId" + id, err := db.NewPublicId(OidcKeyVersionPrefix) + if err != nil { + return "", errors.Wrap(err, op) + } + return id, nil +} diff --git a/internal/kms/ids_test.go b/internal/kms/ids_test.go index c1d923238..f6c6a750e 100644 --- a/internal/kms/ids_test.go +++ b/internal/kms/ids_test.go @@ -60,4 +60,14 @@ func Test_Ids(t *testing.T) { require.NoError(t, err) assert.True(t, strings.HasPrefix(id, SessionKeyVersionPrefix+"_")) }) + t.Run("koidck", func(t *testing.T) { + id, err := newOidcKeyId() + require.NoError(t, err) + assert.True(t, strings.HasPrefix(id, OidcKeyPrefix+"_")) + }) + t.Run("koidckv", func(t *testing.T) { + id, err := newOidcKeyVersionId() + require.NoError(t, err) + assert.True(t, strings.HasPrefix(id, OidcKeyVersionPrefix+"_")) + }) } diff --git a/internal/kms/immutable_fields_test.go b/internal/kms/immutable_fields_test.go index b702c203f..4662c3fa9 100644 --- a/internal/kms/immutable_fields_test.go +++ b/internal/kms/immutable_fields_test.go @@ -340,3 +340,101 @@ func TestDatabaseKeyVersion_ImmutableFields(t *testing.T) { }) } } + +func TestOidcKeyVersion_ImmutableFields(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + wrapper := db.TestWrapper(t) + rw := db.New(conn) + + ts := timestamp.Timestamp{Timestamp: ×tamppb.Timestamp{Seconds: 0, Nanos: 0}} + + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + dk := kms.TestOidcKey(t, conn, rk.PrivateId) + new := kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("oidc key")) + + tests := []struct { + name string + update *kms.OidcKeyVersion + fieldMask []string + }{ + { + name: "private_id", + update: func() *kms.OidcKeyVersion { + k := new.Clone().(*kms.OidcKeyVersion) + k.PrivateId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"PrivateId"}, + }, + { + name: "create time", + update: func() *kms.OidcKeyVersion { + k := new.Clone().(*kms.OidcKeyVersion) + k.CreateTime = &ts + return k + }(), + fieldMask: []string{"CreateTime"}, + }, + { + name: "oidc_key_id", + update: func() *kms.OidcKeyVersion { + k := new.Clone().(*kms.OidcKeyVersion) + k.OidcKeyId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"RootKeyId"}, + }, + { + name: "root_key_version_id", + update: func() *kms.OidcKeyVersion { + k := new.Clone().(*kms.OidcKeyVersion) + k.RootKeyVersionId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"RootKeyId"}, + }, + { + name: "version", + update: func() *kms.OidcKeyVersion { + k := new.Clone().(*kms.OidcKeyVersion) + k.Version = uint32(22) + return k + }(), + fieldMask: []string{"Version"}, + }, + { + name: "key", + update: func() *kms.OidcKeyVersion { + k := new.Clone().(*kms.OidcKeyVersion) + k.Key = []byte("updated key") + return k + }(), + fieldMask: []string{"CtKey"}, + }, + } + for _, tt := range tests { + tt := tt + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + orig := new.Clone() + err := rw.LookupById(context.Background(), orig) + require.NoError(err) + + err = tt.update.Encrypt(context.Background(), wrapper) + require.NoError(err) + rowsUpdated, err := rw.Update(context.Background(), tt.update, tt.fieldMask, nil, db.WithSkipVetForWrite(true)) + require.Error(err) + assert.Equal(0, rowsUpdated) + + after := new.Clone() + err = rw.LookupById(context.Background(), after) + require.NoError(err) + + assert.True(proto.Equal(orig.(*kms.OidcKeyVersion), after.(*kms.OidcKeyVersion))) + }) + } +} diff --git a/internal/kms/oidc_key.go b/internal/kms/oidc_key.go new file mode 100644 index 000000000..7216ef0f8 --- /dev/null +++ b/internal/kms/oidc_key.go @@ -0,0 +1,83 @@ +package kms + +import ( + "context" + + "github.com/hashicorp/boundary/internal/db" + "github.com/hashicorp/boundary/internal/errors" + "github.com/hashicorp/boundary/internal/kms/store" + "google.golang.org/protobuf/proto" +) + +const ( + DefaultOidcKeyTableName = "kms_oidc_key" +) + +type OidcKey struct { + *store.OidcKey + tableName string `gorm:"-"` +} + +// NewOidcKey creates a new in memory oidc key. This key is used to encrypt +// oidc state before it's included in the oidc auth url. No options are +// currently supported. +func NewOidcKey(rootKeyId string, _ ...Option) (*OidcKey, error) { + const op = "kms.NewOidcKey" + if rootKeyId == "" { + return nil, errors.New(errors.InvalidParameter, op, "missing root key id") + } + c := &OidcKey{ + OidcKey: &store.OidcKey{ + RootKeyId: rootKeyId, + }, + } + return c, nil +} + +// AllocOidcKey will allocate a OidcKey +func AllocOidcKey() OidcKey { + return OidcKey{ + OidcKey: &store.OidcKey{}, + } +} + +// Clone creates a clone of the OidcKey +func (k *OidcKey) Clone() interface{} { + cp := proto.Clone(k.OidcKey) + return &OidcKey{ + OidcKey: cp.(*store.OidcKey), + } +} + +// VetForWrite implements db.VetForWrite() interface and validates the key +// before it's written. +func (k *OidcKey) VetForWrite(ctx context.Context, r db.Reader, opType db.OpType, opt ...db.Option) error { + const op = "kms.(OidcKey).VetForWrite" + if k.PrivateId == "" { + return errors.New(errors.InvalidParameter, op, "missing private id") + } + switch opType { + case db.CreateOp: + if k.RootKeyId == "" { + return errors.New(errors.InvalidParameter, op, "missing root key id") + } + case db.UpdateOp: + return errors.New(errors.InvalidParameter, op, "key is immutable") + } + return nil +} + +// TableName returns the tablename to override the default gorm table name +func (k *OidcKey) TableName() string { + if k.tableName != "" { + return k.tableName + } + return DefaultOidcKeyTableName +} + +// SetTableName sets the tablename and satisfies the ReplayableMessage +// interface. If the caller attempts to set the name to "" the name will be +// reset to the default name. +func (k *OidcKey) SetTableName(n string) { + k.tableName = n +} diff --git a/internal/kms/oidc_key_test.go b/internal/kms/oidc_key_test.go new file mode 100644 index 000000000..9117d63bd --- /dev/null +++ b/internal/kms/oidc_key_test.go @@ -0,0 +1,206 @@ +package kms_test + +import ( + "context" + "testing" + + "github.com/hashicorp/boundary/internal/db" + "github.com/hashicorp/boundary/internal/errors" + "github.com/hashicorp/boundary/internal/iam" + "github.com/hashicorp/boundary/internal/kms" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" +) + +// NOTE: there are no update tests since all the OidcKey attributes are +// immutable and those tests are covered by TestOidcKey_ImmutableFields + +func TestOidcKey_Create(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + wrapper := db.TestWrapper(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + + type args struct { + rootKeyId string + opt []kms.Option + } + tests := []struct { + name string + args args + want *kms.OidcKey + wantErr bool + wantIsErr errors.Code + create bool + wantCreateErr bool + }{ + { + name: "empty-rootKeyId", + args: args{}, + wantErr: true, + wantIsErr: errors.InvalidParameter, + }, + { + name: "valid", + args: args{ + rootKeyId: rk.PrivateId, + }, + want: func() *kms.OidcKey { + k := kms.AllocOidcKey() + k.RootKeyId = rk.PrivateId + return &k + }(), + create: true, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + require.NoError(conn.Where("1=1").Delete(kms.AllocOidcKey()).Error) + got, err := kms.NewOidcKey(tt.args.rootKeyId, tt.args.opt...) + if tt.wantErr { + require.Error(err) + assert.True(errors.Match(errors.T(tt.wantIsErr), err)) + return + } + require.NoError(err) + assert.Equal(tt.want, got) + if tt.create { + id, err := db.NewPublicId(kms.OidcKeyPrefix) + require.NoError(err) + got.PrivateId = id + err = db.New(conn).Create(context.Background(), got) + if tt.wantCreateErr { + assert.Error(err) + return + } else { + assert.NoError(err) + } + } + }) + } +} + +func TestOidcKey_Delete(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + wrapper := db.TestWrapper(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocOidcKey()).Error) + + tests := []struct { + name string + key *kms.OidcKey + wantRowsDeleted int + wantErr bool + wantErrMsg string + }{ + { + name: "valid", + key: kms.TestOidcKey(t, conn, rk.PrivateId), + wantErr: false, + wantRowsDeleted: 1, + }, + { + name: "bad-id", + key: func() *kms.OidcKey { + k := kms.AllocOidcKey() + id, err := db.NewPublicId(kms.OidcKeyPrefix) + require.NoError(t, err) + k.PrivateId = id + k.RootKeyId = rk.PrivateId + return &k + }(), + wantErr: false, + wantRowsDeleted: 0, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + deleteKey := kms.AllocOidcKey() + deleteKey.PrivateId = tt.key.PrivateId + deletedRows, err := rw.Delete(context.Background(), &deleteKey) + if tt.wantErr { + require.Error(err) + return + } + require.NoError(err) + if tt.wantRowsDeleted == 0 { + assert.Equal(tt.wantRowsDeleted, deletedRows) + return + } + assert.Equal(tt.wantRowsDeleted, deletedRows) + foundKey := kms.AllocOidcKey() + foundKey.PrivateId = tt.key.PrivateId + err = rw.LookupById(context.Background(), &foundKey) + require.Error(err) + assert.True(errors.IsNotFoundError(err)) + }) + } +} + +func TestOidcKey_Clone(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + wrapper := db.TestWrapper(t) + t.Run("valid", func(t *testing.T) { + assert := assert.New(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + k := kms.TestOidcKey(t, conn, rk.PrivateId) + cp := k.Clone() + assert.True(proto.Equal(cp.(*kms.OidcKey).OidcKey, k.OidcKey)) + }) + t.Run("not-equal", func(t *testing.T) { + assert := assert.New(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + org2, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + rk2 := kms.TestRootKey(t, conn, org2.PublicId) + k := kms.TestOidcKey(t, conn, rk.PrivateId) + k2 := kms.TestOidcKey(t, conn, rk2.PrivateId) + + cp := k.Clone() + assert.True(!proto.Equal(cp.(*kms.OidcKey).OidcKey, k2.OidcKey)) + }) +} + +func TestOidcKey_SetTableName(t *testing.T) { + t.Parallel() + defaultTableName := kms.DefaultOidcKeyTableName + tests := []struct { + name string + setNameTo string + want string + }{ + { + name: "new-name", + setNameTo: "new-name", + want: "new-name", + }, + { + name: "reset to default", + setNameTo: "", + want: defaultTableName, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + def := kms.AllocOidcKey() + require.Equal(defaultTableName, def.TableName()) + s := kms.AllocOidcKey() + s.SetTableName(tt.setNameTo) + assert.Equal(tt.want, s.TableName()) + }) + } +} diff --git a/internal/kms/oidc_key_version.go b/internal/kms/oidc_key_version.go new file mode 100644 index 000000000..c344d217a --- /dev/null +++ b/internal/kms/oidc_key_version.go @@ -0,0 +1,122 @@ +package kms + +import ( + "context" + + "github.com/hashicorp/boundary/internal/db" + "github.com/hashicorp/boundary/internal/errors" + "github.com/hashicorp/boundary/internal/kms/store" + wrapping "github.com/hashicorp/go-kms-wrapping" + "github.com/hashicorp/go-kms-wrapping/structwrapping" + "google.golang.org/protobuf/proto" +) + +const ( + DefaultOidcKeyVersionTableName = "kms_oidc_key_version" +) + +type OidcKeyVersion struct { + *store.OidcKeyVersion + tableName string `gorm:"-"` +} + +// NewOidcKeyVersion creates a new in memory oidc key version. This key is used +// to encrypt oidc state before it's included in the oidc auth url. No options +// are currently supported. +func NewOidcKeyVersion(oidcKeyId string, key []byte, rootKeyVersionId string, _ ...Option) (*OidcKeyVersion, error) { + const op = "kms.NewOidcKeyVersion" + if oidcKeyId == "" { + return nil, errors.New(errors.InvalidParameter, op, "missing oidc key id") + } + if len(key) == 0 { + return nil, errors.New(errors.InvalidParameter, op, "missing key") + } + if rootKeyVersionId == "" { + return nil, errors.New(errors.InvalidParameter, op, "missing root key version id") + } + + k := &OidcKeyVersion{ + OidcKeyVersion: &store.OidcKeyVersion{ + OidcKeyId: oidcKeyId, + RootKeyVersionId: rootKeyVersionId, + Key: key, + }, + } + return k, nil +} + +// AllocOidcKeyVersion allocates a OidcKeyVersion +func AllocOidcKeyVersion() OidcKeyVersion { + return OidcKeyVersion{ + OidcKeyVersion: &store.OidcKeyVersion{}, + } +} + +// Clone creates a clone of the OidcKeyVersion +func (k *OidcKeyVersion) Clone() interface{} { + cp := proto.Clone(k.OidcKeyVersion) + return &OidcKeyVersion{ + OidcKeyVersion: cp.(*store.OidcKeyVersion), + } +} + +// VetForWrite implements db.VetForWrite() interface and validates the oidc key +// version before it's written. +func (k *OidcKeyVersion) VetForWrite(ctx context.Context, r db.Reader, opType db.OpType, opt ...db.Option) error { + const op = "kms.(OidcKeyVersion).VetForWrite" + if k.PrivateId == "" { + return errors.New(errors.InvalidParameter, op, "missing private id") + } + switch opType { + case db.CreateOp: + if k.CtKey == nil { + return errors.New(errors.InvalidParameter, op, "missing key") + } + if k.OidcKeyId == "" { + return errors.New(errors.InvalidParameter, op, "missing oidc key id") + } + if k.RootKeyVersionId == "" { + return errors.New(errors.InvalidParameter, op, "missing root key version id") + } + case db.UpdateOp: + return errors.New(errors.InvalidParameter, op, "key is immutable") + } + return nil +} + +// TableName returns the tablename to override the default gorm table name +func (k *OidcKeyVersion) TableName() string { + if k.tableName != "" { + return k.tableName + } + return DefaultOidcKeyVersionTableName +} + +// SetTableName sets the tablename and satisfies the ReplayableMessage +// interface. If the caller attempts to set the name to "" the name will be +// reset to the default name. +func (k *OidcKeyVersion) SetTableName(n string) { + k.tableName = n +} + +// Encrypt will encrypt the oidc key version's key +func (k *OidcKeyVersion) Encrypt(ctx context.Context, cipher wrapping.Wrapper) error { + const op = "kms.(OidcKeyVersion).Encrypt" + // structwrapping doesn't support embedding, so we'll pass in the + // store.OidcKeyVersion directly + if err := structwrapping.WrapStruct(ctx, cipher, k.OidcKeyVersion, nil); err != nil { + return errors.Wrap(err, op, errors.WithCode(errors.Encrypt)) + } + return nil +} + +// Decrypt will decrypt the oidc key version's key +func (k *OidcKeyVersion) Decrypt(ctx context.Context, cipher wrapping.Wrapper) error { + const op = "kms.(OidcKeyVersion).Decrypt" + // structwrapping doesn't support embedding, so we'll pass in the + // store.OidcKeyVersion directly + if err := structwrapping.UnwrapStruct(ctx, cipher, k.OidcKeyVersion, nil); err != nil { + return errors.Wrap(err, op, errors.WithCode(errors.Decrypt)) + } + return nil +} diff --git a/internal/kms/oidc_key_version_test.go b/internal/kms/oidc_key_version_test.go new file mode 100644 index 000000000..d1ad93e81 --- /dev/null +++ b/internal/kms/oidc_key_version_test.go @@ -0,0 +1,249 @@ +package kms_test + +import ( + "context" + "testing" + + "github.com/hashicorp/boundary/internal/db" + "github.com/hashicorp/boundary/internal/errors" + "github.com/hashicorp/boundary/internal/iam" + "github.com/hashicorp/boundary/internal/kms" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" +) + +// NOTE: there are no update tests since all the OidcKeyVersion attributes are +// immutable and those tests are covered by TestOidcKey_ImmutableFields + +func TestOidcKeyVersion_Create(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + wrapper := db.TestWrapper(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + rkv, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + + dk := kms.TestOidcKey(t, conn, rk.PrivateId) + + type args struct { + OidcKeyId string + key []byte + rootKeyVersionId string + opt []kms.Option + } + tests := []struct { + name string + args args + want *kms.OidcKeyVersion + wantErr bool + wantIsErr errors.Code + create bool + wantCreateErr bool + }{ + { + name: "empty-oidc-id", + args: args{ + key: []byte("oidc key"), + rootKeyVersionId: rkv.PrivateId, + }, + wantErr: true, + wantIsErr: errors.InvalidParameter, + }, + { + name: "empty-key", + args: args{ + OidcKeyId: dk.PrivateId, + rootKeyVersionId: rkv.PrivateId, + }, + wantErr: true, + wantIsErr: errors.InvalidParameter, + }, + { + name: "empty-root-key-version-id", + args: args{ + OidcKeyId: dk.PrivateId, + key: []byte("oidc key"), + }, + wantErr: true, + wantIsErr: errors.InvalidParameter, + }, + { + name: "valid", + args: args{ + OidcKeyId: dk.PrivateId, + key: []byte("oidc key"), + rootKeyVersionId: rkv.PrivateId, + }, + want: func() *kms.OidcKeyVersion { + k := kms.AllocOidcKeyVersion() + k.RootKeyVersionId = rkv.PrivateId + k.Key = []byte("oidc key") + k.OidcKeyId = dk.PrivateId + return &k + }(), + create: true, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + require.NoError(conn.Where("1=1").Delete(kms.AllocOidcKeyVersion()).Error) + got, err := kms.NewOidcKeyVersion(tt.args.OidcKeyId, tt.args.key, tt.args.rootKeyVersionId, tt.args.opt...) + if tt.wantErr { + require.Error(err) + assert.True(errors.Match(errors.T(tt.wantIsErr), err)) + return + } + require.NoError(err) + assert.Equal(tt.want, got) + if tt.create { + id, err := db.NewPublicId(kms.OidcKeyPrefix) + require.NoError(err) + got.PrivateId = id + err = got.Encrypt(context.Background(), rkvWrapper) + require.NoError(err) + err = db.New(conn).Create(context.Background(), got) + if tt.wantCreateErr { + assert.Error(err) + return + } else { + assert.NoError(err) + } + } + }) + } +} + +func TestOidcKeyVersion_Delete(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + wrapper := db.TestWrapper(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + dk := kms.TestOidcKey(t, conn, rk.PrivateId) + + require.NoError(t, conn.Where("1=1").Delete(kms.AllocOidcKeyVersion()).Error) + + tests := []struct { + name string + key *kms.OidcKeyVersion + wantRowsDeleted int + wantErr bool + wantErrMsg string + }{ + { + name: "valid", + key: kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("oidc key")), + wantErr: false, + wantRowsDeleted: 1, + }, + { + name: "bad-id", + key: func() *kms.OidcKeyVersion { + k := kms.AllocOidcKeyVersion() + id, err := db.NewPublicId(kms.OidcKeyVersionPrefix) + require.NoError(t, err) + k.PrivateId = id + return &k + }(), + wantErr: false, + wantRowsDeleted: 0, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + deleteKey := kms.AllocOidcKeyVersion() + deleteKey.PrivateId = tt.key.PrivateId + deletedRows, err := rw.Delete(context.Background(), &deleteKey) + if tt.wantErr { + require.Error(err) + return + } + require.NoError(err) + if tt.wantRowsDeleted == 0 { + assert.Equal(tt.wantRowsDeleted, deletedRows) + return + } + assert.Equal(tt.wantRowsDeleted, deletedRows) + foundKey := kms.AllocOidcKeyVersion() + foundKey.PrivateId = tt.key.PrivateId + err = rw.LookupById(context.Background(), &foundKey) + require.Error(err) + assert.True(errors.IsNotFoundError(err)) + }) + } +} + +func TestOidcKeyVersion_Clone(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + wrapper := db.TestWrapper(t) + t.Run("valid", func(t *testing.T) { + assert := assert.New(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + + k := kms.TestOidcKey(t, conn, rk.PrivateId) + kv := kms.TestOidcKeyVersion(t, conn, rkvWrapper, k.PrivateId, []byte("test db key")) + cp := kv.Clone() + assert.True(proto.Equal(cp.(*kms.OidcKeyVersion).OidcKeyVersion, kv.OidcKeyVersion)) + }) + t.Run("not-equal", func(t *testing.T) { + assert := assert.New(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + org2, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + rk2 := kms.TestRootKey(t, conn, org2.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + _, rkvWrapper2 := kms.TestRootKeyVersion(t, conn, wrapper, rk2.PrivateId) + + k := kms.TestOidcKey(t, conn, rk.PrivateId) + k2 := kms.TestOidcKey(t, conn, rk2.PrivateId) + kv := kms.TestOidcKeyVersion(t, conn, rkvWrapper, k.PrivateId, []byte("test db key")) + kv2 := kms.TestOidcKeyVersion(t, conn, rkvWrapper2, k2.PrivateId, []byte("test db key 2")) + + cp := kv.Clone() + assert.True(!proto.Equal(cp.(*kms.OidcKeyVersion).OidcKeyVersion, kv2.OidcKeyVersion)) + }) +} + +func TestOidcKeyVersion_SetTableName(t *testing.T) { + t.Parallel() + defaultTableName := kms.DefaultOidcKeyVersionTableName + tests := []struct { + name string + setNameTo string + want string + }{ + { + name: "new-name", + setNameTo: "new-name", + want: "new-name", + }, + { + name: "reset to default", + setNameTo: "", + want: defaultTableName, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + def := kms.AllocOidcKeyVersion() + require.Equal(defaultTableName, def.TableName()) + s := kms.AllocOidcKeyVersion() + s.SetTableName(tt.setNameTo) + assert.Equal(tt.want, s.TableName()) + }) + } +} diff --git a/internal/kms/repository.go b/internal/kms/repository.go index 51d9946b4..d881424c6 100644 --- a/internal/kms/repository.go +++ b/internal/kms/repository.go @@ -149,6 +149,15 @@ func CreateKeysTx(ctx context.Context, dbReader db.Reader, dbWriter db.Writer, r return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("unable to create token key in scope %s", scopeId))) } + k, err = generateKey(randomReader) + if err != nil { + return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("error generating random bytes for oidc key in scope %s", scopeId))) + } + oidcKey, oidcKeyVersion, err := createOidcKeyTx(ctx, dbReader, dbWriter, rkvWrapper, k) + if err != nil { + return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("unable to create oidc key in scope %s", scopeId))) + } + keys := Keys{ KeyTypeRootKey: rootKey, KeyTypeRootKeyVersion: rootKeyVersion, @@ -160,6 +169,8 @@ func CreateKeysTx(ctx context.Context, dbReader db.Reader, dbWriter db.Writer, r KeyTypeSessionKeyVersion: sessionKeyVersion, KeyTypeTokenKey: tokenKey, KeyTypeTokenKeyVersion: tokenKeyVersion, + KeyTypeOidcKey: oidcKey, + KeyTypeOidcKeyVersion: oidcKeyVersion, } return keys, nil } diff --git a/internal/kms/repository_oidc_key.go b/internal/kms/repository_oidc_key.go new file mode 100644 index 000000000..e282526f2 --- /dev/null +++ b/internal/kms/repository_oidc_key.go @@ -0,0 +1,160 @@ +package kms + +import ( + "context" + "fmt" + "strings" + + "github.com/hashicorp/boundary/internal/db" + "github.com/hashicorp/boundary/internal/errors" + wrapping "github.com/hashicorp/go-kms-wrapping" +) + +// CreateOidcKey inserts into the repository and returns the new oidc key and +// oidc key version. There are no valid options at this time. +func (r *Repository) CreateOidcKey(ctx context.Context, rkvWrapper wrapping.Wrapper, key []byte, _ ...Option) (*OidcKey, *OidcKeyVersion, error) { + const op = "kms.(Repository).CreateOidcKey" + var returnedDk, returnedDv interface{} + _, err := r.writer.DoTx( + ctx, + db.StdRetryCnt, + db.ExpBackoff{}, + func(reader db.Reader, w db.Writer) error { + var err error + if returnedDk, returnedDv, err = createOidcKeyTx(ctx, reader, w, rkvWrapper, key); err != nil { + return errors.Wrap(err, op) + } + return nil + }, + ) + if err != nil { + return nil, nil, errors.Wrap(err, op) + } + return returnedDk.(*OidcKey), returnedDv.(*OidcKeyVersion), nil +} + +// createOidcKeyTx inserts into the db (via db.Writer) and returns the new oidc key +// and oidc key version. This function encapsulates all the work required within +// a db.TxHandler and allows this capability to be shared with the iam repo. +func createOidcKeyTx(ctx context.Context, r db.Reader, w db.Writer, rkvWrapper wrapping.Wrapper, key []byte) (*OidcKey, *OidcKeyVersion, error) { + const op = "kms.createOidcKeyTx" + if rkvWrapper == nil { + return nil, nil, errors.New(errors.InvalidParameter, op, "missing key wrapper") + } + if len(key) == 0 { + return nil, nil, errors.New(errors.InvalidParameter, op, "missing key") + } + rootKeyVersionId := rkvWrapper.KeyID() + switch { + case !strings.HasPrefix(rootKeyVersionId, RootKeyVersionPrefix): + return nil, nil, errors.New(errors.InvalidParameter, op, fmt.Sprintf("root key version id %s doesn't start with prefix %s", rootKeyVersionId, RootKeyVersionPrefix)) + case rootKeyVersionId == "": + return nil, nil, errors.New(errors.InvalidParameter, op, "missing root key version id") + } + rv := AllocRootKeyVersion() + rv.PrivateId = rootKeyVersionId + err := r.LookupById(ctx, &rv) + if err != nil { + return nil, nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("unable to lookup root key version %s", rootKeyVersionId))) + } + + dk := AllocOidcKey() + dv := AllocOidcKeyVersion() + id, err := newOidcKeyId() + if err != nil { + return nil, nil, errors.Wrap(err, op) + } + dk.PrivateId = id + dk.RootKeyId = rv.RootKeyId + + id, err = newOidcKeyVersionId() + if err != nil { + return nil, nil, errors.Wrap(err, op) + } + dv.PrivateId = id + dv.OidcKeyId = dk.PrivateId + dv.RootKeyVersionId = rootKeyVersionId + dv.Key = key + if err := dv.Encrypt(ctx, rkvWrapper); err != nil { + return nil, nil, errors.Wrap(err, op) + } + + // no oplog entries for keys + if err := w.Create(ctx, &dk); err != nil { + return nil, nil, errors.Wrap(err, op, errors.WithMsg("keys create")) + } + // no oplog entries for key versions + if err := w.Create(ctx, &dv); err != nil { + return nil, nil, errors.Wrap(err, op, errors.WithMsg("key versions create")) + } + + return &dk, &dv, nil +} + +// LookupOidcKey will look up a key in the repository. If the key is not +// found, it will return nil, nil. +func (r *Repository) LookupOidcKey(ctx context.Context, privateId string, _ ...Option) (*OidcKey, error) { + const op = "kms.(Repository).LookupOidcKey" + if privateId == "" { + return nil, errors.New(errors.InvalidParameter, op, "missing private id") + } + k := AllocOidcKey() + k.PrivateId = privateId + if err := r.reader.LookupById(ctx, &k); err != nil { + return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId))) + } + return &k, nil +} + +// DeleteOidcKey deletes the key for the provided id from the +// repository returning a count of the number of records deleted. All options +// are ignored. +func (r *Repository) DeleteOidcKey(ctx context.Context, privateId string, _ ...Option) (int, error) { + const op = "kms.(Repository).LookupOidcKey" + if privateId == "" { + return db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing private id") + } + k := AllocOidcKey() + k.PrivateId = privateId + if err := r.reader.LookupById(ctx, &k); err != nil { + return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId))) + } + + var rowsDeleted int + _, err := r.writer.DoTx( + ctx, + db.StdRetryCnt, + db.ExpBackoff{}, + func(_ db.Reader, w db.Writer) (err error) { + dk := k.Clone() + // no oplog entries for root keys + rowsDeleted, err = w.Delete(ctx, dk) + if err != nil { + return errors.Wrap(err, op) + } + if rowsDeleted > 1 { + return errors.New(errors.MultipleRecords, op, "more than 1 resource would have been deleted") + } + return nil + }, + ) + if err != nil { + return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId))) + } + return rowsDeleted, nil +} + +// ListOidcKeys will list the keys. Supports the WithLimit option. +func (r *Repository) ListOidcKeys(ctx context.Context, opt ...Option) ([]Dek, error) { + const op = "kms.(Repository).ListOidcKeys" + var keys []*OidcKey + err := r.list(ctx, &keys, "1=1", nil, opt...) + if err != nil { + return nil, errors.Wrap(err, op) + } + deks := make([]Dek, 0, len(keys)) + for _, key := range keys { + deks = append(deks, key) + } + return deks, nil +} diff --git a/internal/kms/repository_oidc_key_test.go b/internal/kms/repository_oidc_key_test.go new file mode 100644 index 000000000..ce5372789 --- /dev/null +++ b/internal/kms/repository_oidc_key_test.go @@ -0,0 +1,297 @@ +package kms_test + +import ( + "context" + "testing" + "time" + + "github.com/hashicorp/boundary/internal/db" + "github.com/hashicorp/boundary/internal/errors" + "github.com/hashicorp/boundary/internal/iam" + "github.com/hashicorp/boundary/internal/kms" + "github.com/hashicorp/boundary/internal/oplog" + wrapping "github.com/hashicorp/go-kms-wrapping" + "github.com/hashicorp/go-kms-wrapping/wrappers/aead" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" +) + +func TestRepository_CreateOidcKey(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + wrapper := db.TestWrapper(t) + repo, err := kms.NewRepository(rw, rw) + require.NoError(t, err) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + + type args struct { + scopeId string + key []byte + keyWrapper wrapping.Wrapper + opt []kms.Option + } + tests := []struct { + name string + args args + wantErr bool + wantIsError errors.Code + }{ + { + name: "valid-org", + args: args{ + scopeId: org.PublicId, + key: []byte("test key"), + keyWrapper: rkvWrapper, + }, + wantErr: false, + }, + { + name: "nil-key", + args: args{ + scopeId: org.PublicId, + keyWrapper: rkvWrapper, + }, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + { + name: "empty-key", + args: args{ + scopeId: org.PublicId, + keyWrapper: rkvWrapper, + key: []byte(""), + }, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + { + name: "nil-wrapper", + args: args{ + scopeId: org.PublicId, + key: []byte("test key"), + keyWrapper: nil, + }, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + { + name: "not-rkv-wrapper", + args: args{ + scopeId: org.PublicId, + key: []byte("test key"), + keyWrapper: wrapper, + }, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + { + name: "wrapper-missing-id", + args: args{ + scopeId: org.PublicId, + key: []byte("test key"), + keyWrapper: func() wrapping.Wrapper { + w := db.TestWrapper(t) + _, err = w.(*aead.Wrapper).SetConfig(map[string]string{ + "key_id": "", + }) + require.NoError(t, err) + return w + }(), + }, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + dk, dv, err := repo.CreateOidcKey(context.Background(), tt.args.keyWrapper, tt.args.key, tt.args.opt...) + if tt.wantErr { + assert.Error(err) + assert.Nil(dk) + assert.True(errors.Match(errors.T(tt.wantIsError), err)) + return + } + require.NoError(err) + assert.NotNil(dk.CreateTime) + foundKey, err := repo.LookupOidcKey(context.Background(), dk.PrivateId) + assert.NoError(err) + assert.True(proto.Equal(foundKey, dk)) + + // make sure there was no oplog written + err = db.TestVerifyOplog(t, rw, dk.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second)) + assert.Error(err) + assert.True(errors.IsNotFoundError(err)) + + assert.NotNil(dv.CreateTime) + foundKeyVersion, err := repo.LookupOidcKeyVersion(context.Background(), tt.args.keyWrapper, dv.PrivateId) + assert.NoError(err) + assert.True(proto.Equal(foundKeyVersion, dv)) + + // make sure there was no oplog written + err = db.TestVerifyOplog(t, rw, dv.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second)) + assert.Error(err) + assert.True(errors.IsNotFoundError(err)) + }) + } +} + +func TestRepository_DeleteOidcKey(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + wrapper := db.TestWrapper(t) + repo, err := kms.NewRepository(rw, rw) + require.NoError(t, err) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + + type args struct { + key *kms.OidcKey + opt []kms.Option + } + tests := []struct { + name string + args args + wantRowsDeleted int + wantErr bool + wantIsError errors.Code + }{ + { + name: "valid", + args: args{ + key: kms.TestOidcKey(t, conn, rk.PrivateId), + }, + wantRowsDeleted: 1, + wantErr: false, + }, + { + name: "no-private-id", + args: args{ + key: func() *kms.OidcKey { + k := kms.AllocOidcKey() + return &k + }(), + }, + wantRowsDeleted: 0, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + { + name: "not-found", + args: args{ + key: func() *kms.OidcKey { + id, err := db.NewPublicId(kms.RootKeyPrefix) + require.NoError(t, err) + k := kms.AllocOidcKey() + k.PrivateId = id + require.NoError(t, err) + return &k + }(), + }, + wantRowsDeleted: 0, + wantErr: true, + wantIsError: errors.RecordNotFound, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + deletedRows, err := repo.DeleteOidcKey(context.Background(), tt.args.key.PrivateId, tt.args.opt...) + if tt.wantErr { + require.Error(err) + assert.Equal(0, deletedRows) + assert.True(errors.Match(errors.T(tt.wantIsError), err)) + // make sure there was no oplog written + err = db.TestVerifyOplog(t, rw, tt.args.key.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second)) + assert.Error(err) + assert.True(errors.IsNotFoundError(err)) + return + } + require.NoError(err) + assert.Equal(tt.wantRowsDeleted, deletedRows) + foundKey, err := repo.LookupOidcKey(context.Background(), tt.args.key.PrivateId) + assert.Error(err) + assert.Nil(foundKey) + assert.True(errors.IsNotFoundError(err)) + + // make sure there was no oplog written + err = db.TestVerifyOplog(t, rw, tt.args.key.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second)) + assert.Error(err) + assert.True(errors.IsNotFoundError(err)) + }) + } +} + +func TestRepository_ListOidcKeys(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + const testLimit = 10 + rw := db.New(conn) + repo, err := kms.NewRepository(rw, rw, kms.WithLimit(testLimit)) + require.NoError(t, err) + wrapper := db.TestWrapper(t) + + type args struct { + opt []kms.Option + } + tests := []struct { + name string + createCnt int + args args + wantCnt int + wantErr bool + }{ + { + name: "no-limit", + createCnt: repo.DefaultLimit() + 1, + args: args{ + opt: []kms.Option{kms.WithLimit(-1)}, + }, + wantCnt: repo.DefaultLimit() + 1, // org and project both have keys, plus global scope + wantErr: false, + }, + { + name: "default-limit", + createCnt: repo.DefaultLimit() + 1, + args: args{}, + wantCnt: repo.DefaultLimit(), + wantErr: false, + }, + { + name: "custom-limit", + createCnt: repo.DefaultLimit() + 1, + args: args{ + opt: []kms.Option{kms.WithLimit(3)}, + }, + wantCnt: 3, + wantErr: false, + }, + } + for _, tt := range tests { + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + for i := 0; i < tt.createCnt; i++ { + org, proj := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(conn.Where("scope_id in(?)", []interface{}{"global", org.PublicId, proj.PublicId}).Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, proj.PublicId) + kms.TestOidcKey(t, conn, rk.PrivateId) + require.NoError(err) + } + got, err := repo.ListOidcKeys(context.Background(), tt.args.opt...) + if tt.wantErr { + require.Error(err) + return + } + require.NoError(err) + assert.Equal(tt.wantCnt, len(got)) + }) + } +} diff --git a/internal/kms/repository_oidc_key_version.go b/internal/kms/repository_oidc_key_version.go new file mode 100644 index 000000000..249d4001d --- /dev/null +++ b/internal/kms/repository_oidc_key_version.go @@ -0,0 +1,173 @@ +package kms + +import ( + "context" + "fmt" + "strings" + + "github.com/hashicorp/boundary/internal/db" + "github.com/hashicorp/boundary/internal/errors" + wrapping "github.com/hashicorp/go-kms-wrapping" +) + +// CreateOidcKeyVersion inserts into the repository and returns the new key +// version with its PrivateId. There are no valid options at this time. +func (r *Repository) CreateOidcKeyVersion(ctx context.Context, rkvWrapper wrapping.Wrapper, oidcKeyId string, key []byte, _ ...Option) (*OidcKeyVersion, error) { + const op = "kms.(Repository).CreateOidcKeyVersion" + if rkvWrapper == nil { + return nil, errors.New(errors.InvalidParameter, op, "missing root key version wrapper") + } + rootKeyVersionId := rkvWrapper.KeyID() + switch { + case !strings.HasPrefix(rootKeyVersionId, RootKeyVersionPrefix): + return nil, errors.New(errors.InvalidParameter, op, fmt.Sprintf("root key version id %s doesn't start with prefix %s", rootKeyVersionId, RootKeyVersionPrefix)) + case rootKeyVersionId == "": + return nil, errors.New(errors.InvalidParameter, op, "missing root key version id") + } + if oidcKeyId == "" { + return nil, errors.New(errors.InvalidParameter, op, "missing oidc key id") + } + if len(key) == 0 { + return nil, errors.New(errors.InvalidParameter, op, "missing key") + } + kv := AllocOidcKeyVersion() + id, err := newOidcKeyVersionId() + if err != nil { + return nil, errors.Wrap(err, op) + } + kv.PrivateId = id + kv.RootKeyVersionId = rootKeyVersionId + kv.Key = key + kv.OidcKeyId = oidcKeyId + if err := kv.Encrypt(ctx, rkvWrapper); err != nil { + return nil, errors.Wrap(err, op) + } + + var returnedKey interface{} + _, err = r.writer.DoTx( + ctx, + db.StdRetryCnt, + db.ExpBackoff{}, + func(_ db.Reader, w db.Writer) error { + returnedKey = kv.Clone() + // no oplog entries for root key version + if err := w.Create(ctx, returnedKey); err != nil { + return errors.Wrap(err, op) + } + return nil + }, + ) + if err != nil { + return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s oidc key id", kv.OidcKeyId))) + } + return returnedKey.(*OidcKeyVersion), nil +} + +// LookupOidcKeyVersion will look up a key version in the repository. If +// the key version is not found, it will return nil, nil. +func (r *Repository) LookupOidcKeyVersion(ctx context.Context, keyWrapper wrapping.Wrapper, privateId string, _ ...Option) (*OidcKeyVersion, error) { + const op = "kms.(Repository).LookupOidcKeyVersion" + if privateId == "" { + return nil, errors.New(errors.InvalidParameter, op, "missing private id") + } + if keyWrapper == nil { + return nil, errors.New(errors.InvalidParameter, op, "missing key wrapper") + } + k := AllocOidcKeyVersion() + k.PrivateId = privateId + if err := r.reader.LookupById(ctx, &k); err != nil { + return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId))) + } + if err := k.Decrypt(ctx, keyWrapper); err != nil { + return nil, errors.Wrap(err, op) + } + return &k, nil +} + +// DeleteOidcKeyVersion deletes the key version for the provided id from the +// repository returning a count of the number of records deleted. All options +// are ignored. +func (r *Repository) DeleteOidcKeyVersion(ctx context.Context, privateId string, _ ...Option) (int, error) { + const op = "kms.(Repository).DeleteOidcKeyVersion" + if privateId == "" { + return db.NoRowsAffected, errors.New(errors.InvalidParameter, op, "missing private id") + } + k := AllocOidcKeyVersion() + k.PrivateId = privateId + if err := r.reader.LookupById(ctx, &k); err != nil { + return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId))) + } + + var rowsDeleted int + _, err := r.writer.DoTx( + ctx, + db.StdRetryCnt, + db.ExpBackoff{}, + func(_ db.Reader, w db.Writer) (err error) { + dk := k.Clone() + // no oplog entries for the key version + rowsDeleted, err = w.Delete(ctx, dk) + if err != nil { + return errors.Wrap(err, op) + } + if rowsDeleted > 1 { + return errors.New(errors.MultipleRecords, op, "more than 1 resource would have been deleted") + } + return nil + }, + ) + if err != nil { + return db.NoRowsAffected, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", privateId))) + } + return rowsDeleted, nil +} + +// LatestOidcKeyVersion searches for the key version with the highest +// version number. When no results are found, it returns nil with an +// errors.RecordNotFound error. +func (r *Repository) LatestOidcKeyVersion(ctx context.Context, rkvWrapper wrapping.Wrapper, OidcKeyId string, _ ...Option) (*OidcKeyVersion, error) { + const op = "kms.(Repository).LatestOidcKeyVersion" + if OidcKeyId == "" { + return nil, errors.New(errors.InvalidParameter, op, "missing oidc key id") + } + if rkvWrapper == nil { + return nil, errors.New(errors.InvalidParameter, op, "missing root key version wrapper") + } + var foundKeys []*OidcKeyVersion + if err := r.reader.SearchWhere(ctx, &foundKeys, "oidc_key_id = ?", []interface{}{OidcKeyId}, db.WithLimit(1), db.WithOrder("version desc")); err != nil { + return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("failed for %s", OidcKeyId))) + } + if len(foundKeys) == 0 { + return nil, errors.E(errors.WithCode(errors.RecordNotFound), errors.WithOp(op)) + } + if err := foundKeys[0].Decrypt(ctx, rkvWrapper); err != nil { + return nil, errors.Wrap(err, op) + } + return foundKeys[0], nil +} + +// ListOidcKeyVersions will lists versions of a key. Supports the WithLimit option. +func (r *Repository) ListOidcKeyVersions(ctx context.Context, rkvWrapper wrapping.Wrapper, OidcKeyId string, opt ...Option) ([]DekVersion, error) { + const op = "kms.(Repository).ListOidcKeyVersions" + if OidcKeyId == "" { + return nil, errors.New(errors.InvalidParameter, op, "missing oidc key id") + } + if rkvWrapper == nil { + return nil, errors.New(errors.InvalidParameter, op, "missing root key version wrapper") + } + var versions []*OidcKeyVersion + err := r.list(ctx, &versions, "oidc_key_id = ?", []interface{}{OidcKeyId}, opt...) + if err != nil { + return nil, errors.Wrap(err, op) + } + for i, k := range versions { + if err := k.Decrypt(ctx, rkvWrapper); err != nil { + return nil, errors.Wrap(err, op, errors.WithMsg(fmt.Sprintf("error decrypting key num %d", i))) + } + } + dekVersions := make([]DekVersion, 0, len(versions)) + for _, version := range versions { + dekVersions = append(dekVersions, version) + } + return dekVersions, nil +} diff --git a/internal/kms/repository_oidc_key_version_test.go b/internal/kms/repository_oidc_key_version_test.go new file mode 100644 index 000000000..967dd45b2 --- /dev/null +++ b/internal/kms/repository_oidc_key_version_test.go @@ -0,0 +1,367 @@ +package kms_test + +import ( + "context" + "testing" + "time" + + "github.com/hashicorp/boundary/internal/db" + "github.com/hashicorp/boundary/internal/errors" + "github.com/hashicorp/boundary/internal/iam" + "github.com/hashicorp/boundary/internal/kms" + "github.com/hashicorp/boundary/internal/oplog" + wrapping "github.com/hashicorp/go-kms-wrapping" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "google.golang.org/protobuf/proto" +) + +func TestRepository_CreateOidcKeyVersion(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + wrapper := db.TestWrapper(t) + repo, err := kms.NewRepository(rw, rw) + require.NoError(t, err) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + dk := kms.TestOidcKey(t, conn, rk.PrivateId) + + type args struct { + key []byte + OidcKeyId string + keyWrapper wrapping.Wrapper + opt []kms.Option + } + tests := []struct { + name string + args args + wantErr bool + wantIsError errors.Code + }{ + { + name: "valid", + args: args{ + key: []byte("test key"), + keyWrapper: rkvWrapper, + OidcKeyId: dk.PrivateId, + }, + wantErr: false, + }, + { + name: "invalid-rkv-wrapper", + args: args{ + key: []byte("test key"), + keyWrapper: wrapper, + OidcKeyId: dk.PrivateId, + }, + wantErr: true, + }, + { + name: "empty-key", + args: args{ + key: nil, + keyWrapper: wrapper, + OidcKeyId: dk.PrivateId, + }, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + { + name: "nil-wrapper", + args: args{ + key: []byte("test key"), + keyWrapper: nil, + }, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + k, err := repo.CreateOidcKeyVersion(context.Background(), tt.args.keyWrapper, tt.args.OidcKeyId, tt.args.key, tt.args.opt...) + if tt.wantErr { + assert.Error(err) + assert.Nil(k) + assert.True(errors.Match(errors.T(tt.wantIsError), err)) + return + } + require.NoError(err) + assert.NotNil(k.CreateTime) + foundKey, err := repo.LookupOidcKeyVersion(context.Background(), tt.args.keyWrapper, k.PrivateId) + assert.NoError(err) + assert.True(proto.Equal(foundKey, k)) + + // make sure there was no oplog written + err = db.TestVerifyOplog(t, rw, k.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_CREATE), db.WithCreateNotBefore(10*time.Second)) + assert.Error(err) + assert.True(errors.IsNotFoundError(err)) + }) + } +} + +func TestRepository_DeleteOidcKeyVersion(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + wrapper := db.TestWrapper(t) + repo, err := kms.NewRepository(rw, rw) + require.NoError(t, err) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + dk := kms.TestOidcKey(t, conn, rk.PrivateId) + + type args struct { + key *kms.OidcKeyVersion + opt []kms.Option + } + tests := []struct { + name string + args args + wantRowsDeleted int + wantErr bool + wantIsError errors.Code + }{ + { + name: "valid", + args: args{ + key: kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("oidc key")), + }, + wantRowsDeleted: 1, + wantErr: false, + }, + { + name: "no-private-id", + args: args{ + key: func() *kms.OidcKeyVersion { + k := kms.AllocOidcKeyVersion() + return &k + }(), + }, + wantRowsDeleted: 0, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + { + name: "not-found", + args: args{ + key: func() *kms.OidcKeyVersion { + id, err := db.NewPublicId(kms.OidcKeyPrefix) + require.NoError(t, err) + k := kms.AllocOidcKeyVersion() + k.PrivateId = id + require.NoError(t, err) + return &k + }(), + }, + wantRowsDeleted: 0, + wantErr: true, + wantIsError: errors.RecordNotFound, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + deletedRows, err := repo.DeleteOidcKeyVersion(context.Background(), tt.args.key.PrivateId, tt.args.opt...) + if tt.wantErr { + require.Error(err) + assert.Equal(0, deletedRows) + assert.True(errors.Match(errors.T(tt.wantIsError), err)) + err = db.TestVerifyOplog(t, rw, tt.args.key.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second)) + assert.Error(err) + assert.True(errors.IsNotFoundError(err)) + return + } + require.NoError(err) + assert.Equal(tt.wantRowsDeleted, deletedRows) + foundKey, err := repo.LookupOidcKeyVersion(context.Background(), wrapper, tt.args.key.PrivateId) + assert.Error(err) + assert.Nil(foundKey) + assert.True(errors.IsNotFoundError(err)) + + // make sure there was no oplog written + err = db.TestVerifyOplog(t, rw, tt.args.key.PrivateId, db.WithOperation(oplog.OpType_OP_TYPE_DELETE), db.WithCreateNotBefore(10*time.Second)) + assert.Error(err) + assert.True(errors.IsNotFoundError(err)) + }) + } +} + +func TestRepository_LatestOidcKeyVersion(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + wrapper := db.TestWrapper(t) + repo, err := kms.NewRepository(rw, rw) + require.NoError(t, err) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + dk := kms.TestOidcKey(t, conn, rk.PrivateId) + + tests := []struct { + name string + createCnt int + keyWrapper wrapping.Wrapper + wantVersion uint32 + wantErr bool + wantIsError errors.Code + }{ + { + name: "5", + createCnt: 5, + keyWrapper: rkvWrapper, + wantVersion: 5, + wantErr: false, + }, + { + name: "1", + createCnt: 1, + keyWrapper: rkvWrapper, + wantVersion: 1, + wantErr: false, + }, + { + name: "0", + createCnt: 0, + keyWrapper: rkvWrapper, + wantErr: true, + wantIsError: errors.RecordNotFound, + }, + { + name: "nil-wrapper", + createCnt: 5, + keyWrapper: nil, + wantErr: true, + wantIsError: errors.InvalidParameter, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + require.NoError(conn.Where("1=1").Delete(kms.AllocOidcKeyVersion()).Error) + testKeys := []*kms.OidcKeyVersion{} + for i := 0; i < tt.createCnt; i++ { + k := kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("test oidc key")) + testKeys = append(testKeys, k) + } + assert.Equal(tt.createCnt, len(testKeys)) + got, err := repo.LatestOidcKeyVersion(context.Background(), tt.keyWrapper, dk.PrivateId) + if tt.wantErr { + require.Error(err) + assert.Nil(got) + assert.True(errors.Match(errors.T(tt.wantIsError), err)) + return + } + require.NoError(err) + require.NotNil(got) + assert.Equal(tt.wantVersion, got.Version) + }) + } +} + +func TestRepository_ListOidcKeyVersions(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + const testLimit = 10 + rw := db.New(conn) + wrapper := db.TestWrapper(t) + repo, err := kms.NewRepository(rw, rw, kms.WithLimit(testLimit)) + require.NoError(t, err) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + dk := kms.TestOidcKey(t, conn, rk.PrivateId) + + type args struct { + OidcKeyId string + keyWrapper wrapping.Wrapper + opt []kms.Option + } + tests := []struct { + name string + createCnt int + args args + wantCnt int + wantErr bool + }{ + { + name: "no-limit", + createCnt: repo.DefaultLimit() + 1, + args: args{ + OidcKeyId: dk.PrivateId, + keyWrapper: rkvWrapper, + opt: []kms.Option{kms.WithLimit(-1)}, + }, + wantCnt: repo.DefaultLimit() + 1, + wantErr: false, + }, + { + name: "default-limit", + createCnt: repo.DefaultLimit() + 1, + args: args{ + keyWrapper: rkvWrapper, + OidcKeyId: dk.PrivateId, + }, + wantCnt: repo.DefaultLimit(), + wantErr: false, + }, + { + name: "custom-limit", + createCnt: repo.DefaultLimit() + 1, + args: args{ + keyWrapper: rkvWrapper, + OidcKeyId: dk.PrivateId, + opt: []kms.Option{kms.WithLimit(3)}, + }, + wantCnt: 3, + wantErr: false, + }, + { + name: "bad-org", + createCnt: 1, + args: args{ + keyWrapper: rkvWrapper, + OidcKeyId: "bad-id", + }, + wantCnt: 0, + wantErr: false, + }, + { + name: "nil-wrapper", + createCnt: 1, + args: args{ + keyWrapper: nil, + OidcKeyId: dk.PrivateId, + }, + wantCnt: 0, + wantErr: true, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + require.NoError(conn.Where("1=1").Delete(kms.AllocOidcKeyVersion()).Error) + keyVersions := []*kms.OidcKeyVersion{} + for i := 0; i < tt.createCnt; i++ { + k := kms.TestOidcKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("oidc key")) + keyVersions = append(keyVersions, k) + } + assert.Equal(tt.createCnt, len(keyVersions)) + got, err := repo.ListOidcKeyVersions(context.Background(), tt.args.keyWrapper, tt.args.OidcKeyId, tt.args.opt...) + if tt.wantErr { + require.Error(err) + return + } + require.NoError(err) + assert.Equal(tt.wantCnt, len(got)) + }) + } +} diff --git a/internal/kms/repository_test.go b/internal/kms/repository_test.go index 99d83e62c..553382de7 100644 --- a/internal/kms/repository_test.go +++ b/internal/kms/repository_test.go @@ -244,6 +244,19 @@ func TestCreateKeysTx(t *testing.T) { require.NoError(err) assert.Equal(tk.PrivateId, tkv.TokenKeyId) assert.Equal(rkv.PrivateId, tkv.RootKeyVersionId) + + oidcK := kms.AllocOidcKey() + oidcK.PrivateId = keys[kms.KeyTypeOidcKey].GetPrivateId() + err = rw.LookupById(context.Background(), &oidcK) + require.NoError(err) + assert.Equal(rk.PrivateId, oidcK.RootKeyId) + + oidcKv := kms.AllocOidcKeyVersion() + oidcKv.PrivateId = keys[kms.KeyTypeOidcKeyVersion].GetPrivateId() + err = rw.LookupById(context.Background(), &oidcKv) + require.NoError(err) + assert.Equal(oidcK.PrivateId, oidcKv.OidcKeyId) + assert.Equal(rkv.PrivateId, oidcKv.RootKeyVersionId) }) } } diff --git a/internal/kms/store/oidc_key.pb.go b/internal/kms/store/oidc_key.pb.go new file mode 100644 index 000000000..b9b49f255 --- /dev/null +++ b/internal/kms/store/oidc_key.pb.go @@ -0,0 +1,329 @@ +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.25.0-devel +// protoc v3.12.4 +// source: controller/storage/kms/store/v1/oidc_key.proto + +package store + +import ( + timestamp "github.com/hashicorp/boundary/internal/db/timestamp" + _ "github.com/hashicorp/boundary/internal/gen/controller/protooptions" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + reflect "reflect" + sync "sync" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +type OidcKey struct { + state protoimpl.MessageState + sizeCache protoimpl.SizeCache + unknownFields protoimpl.UnknownFields + + // private_id is used to access the key via an API + // @inject_tag: gorm:"primary_key" + PrivateId string `protobuf:"bytes,10,opt,name=private_id,json=privateId,proto3" json:"private_id,omitempty" gorm:"primary_key"` + // root key id for the key + // @inject_tag: `gorm:"default:null"` + RootKeyId string `protobuf:"bytes,20,opt,name=root_key_id,json=rootKeyId,proto3" json:"root_key_id,omitempty" gorm:"default:null"` + // create_time from the RDBMS + // @inject_tag: `gorm:"default:current_timestamp"` + CreateTime *timestamp.Timestamp `protobuf:"bytes,30,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty" gorm:"default:current_timestamp"` +} + +func (x *OidcKey) Reset() { + *x = OidcKey{} + if protoimpl.UnsafeEnabled { + mi := &file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) + } +} + +func (x *OidcKey) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*OidcKey) ProtoMessage() {} + +func (x *OidcKey) ProtoReflect() protoreflect.Message { + mi := &file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[0] + if protoimpl.UnsafeEnabled && x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use OidcKey.ProtoReflect.Descriptor instead. +func (*OidcKey) Descriptor() ([]byte, []int) { + return file_controller_storage_kms_store_v1_oidc_key_proto_rawDescGZIP(), []int{0} +} + +func (x *OidcKey) GetPrivateId() string { + if x != nil { + return x.PrivateId + } + return "" +} + +func (x *OidcKey) GetRootKeyId() string { + if x != nil { + return x.RootKeyId + } + return "" +} + +func (x *OidcKey) GetCreateTime() *timestamp.Timestamp { + if x != nil { + return x.CreateTime + } + return nil +} + +type OidcKeyVersion struct { + state protoimpl.MessageState + sizeCache protoimpl.SizeCache + unknownFields protoimpl.UnknownFields + + // private_id is used to access the key version via an API + // @inject_tag: gorm:"primary_key" + PrivateId string `protobuf:"bytes,10,opt,name=private_id,json=privateId,proto3" json:"private_id,omitempty" gorm:"primary_key"` + // id for the key version + // @inject_tag: `gorm:"default:null"` + OidcKeyId string `protobuf:"bytes,20,opt,name=oidc_key_id,json=oidcKeyId,proto3" json:"oidc_key_id,omitempty" gorm:"default:null"` + // root_key_version_id of the version of the root key data. + // @inject_tag: `gorm:"default:null"` + RootKeyVersionId string `protobuf:"bytes,30,opt,name=root_key_version_id,json=rootKeyVersionId,proto3" json:"root_key_version_id,omitempty" gorm:"default:null"` + // plain-text of the key data. we are NOT storing this plain-text key + // in the db. + // @inject_tag: `gorm:"-" wrapping:"pt,key_data"` + Key []byte `protobuf:"bytes,40,opt,name=key,proto3" json:"key,omitempty" gorm:"-" wrapping:"pt,key_data"` + // ciphertext key data stored in the database + // @inject_tag: `gorm:"column:key;not_null" wrapping:"ct,key_data"` + CtKey []byte `protobuf:"bytes,50,opt,name=ct_key,json=ctKey,proto3" json:"ct_key,omitempty" gorm:"column:key;not_null" wrapping:"ct,key_data"` + // version of the key data. This is not used for optimistic locking, since + // key versions are immutable. It's just the version of the key. + // @inject_tag: `gorm:"default:null"` + Version uint32 `protobuf:"varint,60,opt,name=version,proto3" json:"version,omitempty" gorm:"default:null"` + // create_time from the RDBMS + // @inject_tag: `gorm:"default:current_timestamp"` + CreateTime *timestamp.Timestamp `protobuf:"bytes,70,opt,name=create_time,json=createTime,proto3" json:"create_time,omitempty" gorm:"default:current_timestamp"` +} + +func (x *OidcKeyVersion) Reset() { + *x = OidcKeyVersion{} + if protoimpl.UnsafeEnabled { + mi := &file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) + } +} + +func (x *OidcKeyVersion) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*OidcKeyVersion) ProtoMessage() {} + +func (x *OidcKeyVersion) ProtoReflect() protoreflect.Message { + mi := &file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[1] + if protoimpl.UnsafeEnabled && x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use OidcKeyVersion.ProtoReflect.Descriptor instead. +func (*OidcKeyVersion) Descriptor() ([]byte, []int) { + return file_controller_storage_kms_store_v1_oidc_key_proto_rawDescGZIP(), []int{1} +} + +func (x *OidcKeyVersion) GetPrivateId() string { + if x != nil { + return x.PrivateId + } + return "" +} + +func (x *OidcKeyVersion) GetOidcKeyId() string { + if x != nil { + return x.OidcKeyId + } + return "" +} + +func (x *OidcKeyVersion) GetRootKeyVersionId() string { + if x != nil { + return x.RootKeyVersionId + } + return "" +} + +func (x *OidcKeyVersion) GetKey() []byte { + if x != nil { + return x.Key + } + return nil +} + +func (x *OidcKeyVersion) GetCtKey() []byte { + if x != nil { + return x.CtKey + } + return nil +} + +func (x *OidcKeyVersion) GetVersion() uint32 { + if x != nil { + return x.Version + } + return 0 +} + +func (x *OidcKeyVersion) GetCreateTime() *timestamp.Timestamp { + if x != nil { + return x.CreateTime + } + return nil +} + +var File_controller_storage_kms_store_v1_oidc_key_proto protoreflect.FileDescriptor + +var file_controller_storage_kms_store_v1_oidc_key_proto_rawDesc = []byte{ + 0x0a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x74, 0x6f, + 0x72, 0x61, 0x67, 0x65, 0x2f, 0x6b, 0x6d, 0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x76, + 0x31, 0x2f, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, + 0x12, 0x1f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, + 0x72, 0x61, 0x67, 0x65, 0x2e, 0x6b, 0x6d, 0x73, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x76, + 0x31, 0x1a, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x73, 0x74, + 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2f, + 0x76, 0x31, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, + 0x74, 0x6f, 0x1a, 0x2a, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2f, 0x63, + 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2f, 0x76, 0x31, + 0x2f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x95, + 0x01, 0x0a, 0x07, 0x4f, 0x69, 0x64, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72, + 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, + 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x49, 0x64, 0x12, 0x1e, 0x0a, 0x0b, 0x72, 0x6f, 0x6f, + 0x74, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, + 0x72, 0x6f, 0x6f, 0x74, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, 0x65, + 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, + 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, 0x72, + 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, 0x31, + 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, 0x61, + 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x22, 0x8e, 0x02, 0x0a, 0x0e, 0x4f, 0x69, 0x64, 0x63, 0x4b, + 0x65, 0x79, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72, 0x69, + 0x76, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, + 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x49, 0x64, 0x12, 0x1e, 0x0a, 0x0b, 0x6f, 0x69, 0x64, 0x63, + 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6f, + 0x69, 0x64, 0x63, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x12, 0x2d, 0x0a, 0x13, 0x72, 0x6f, 0x6f, 0x74, + 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, + 0x1e, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x72, 0x6f, 0x6f, 0x74, 0x4b, 0x65, 0x79, 0x56, 0x65, + 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x28, + 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x15, 0x0a, 0x06, 0x63, 0x74, 0x5f, + 0x6b, 0x65, 0x79, 0x18, 0x32, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x63, 0x74, 0x4b, 0x65, 0x79, + 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x3c, 0x20, 0x01, 0x28, + 0x0d, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x4b, 0x0a, 0x0b, 0x63, 0x72, + 0x65, 0x61, 0x74, 0x65, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x46, 0x20, 0x01, 0x28, 0x0b, 0x32, + 0x2a, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x2e, 0x73, 0x74, 0x6f, + 0x72, 0x61, 0x67, 0x65, 0x2e, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x76, + 0x31, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x63, 0x72, 0x65, + 0x61, 0x74, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x42, 0x38, 0x5a, 0x36, 0x67, 0x69, 0x74, 0x68, 0x75, + 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, + 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x61, 0x72, 0x79, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, + 0x6c, 0x2f, 0x6b, 0x6d, 0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x3b, 0x73, 0x74, 0x6f, 0x72, + 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33, +} + +var ( + file_controller_storage_kms_store_v1_oidc_key_proto_rawDescOnce sync.Once + file_controller_storage_kms_store_v1_oidc_key_proto_rawDescData = file_controller_storage_kms_store_v1_oidc_key_proto_rawDesc +) + +func file_controller_storage_kms_store_v1_oidc_key_proto_rawDescGZIP() []byte { + file_controller_storage_kms_store_v1_oidc_key_proto_rawDescOnce.Do(func() { + file_controller_storage_kms_store_v1_oidc_key_proto_rawDescData = protoimpl.X.CompressGZIP(file_controller_storage_kms_store_v1_oidc_key_proto_rawDescData) + }) + return file_controller_storage_kms_store_v1_oidc_key_proto_rawDescData +} + +var file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes = make([]protoimpl.MessageInfo, 2) +var file_controller_storage_kms_store_v1_oidc_key_proto_goTypes = []interface{}{ + (*OidcKey)(nil), // 0: controller.storage.kms.store.v1.OidcKey + (*OidcKeyVersion)(nil), // 1: controller.storage.kms.store.v1.OidcKeyVersion + (*timestamp.Timestamp)(nil), // 2: controller.storage.timestamp.v1.Timestamp +} +var file_controller_storage_kms_store_v1_oidc_key_proto_depIdxs = []int32{ + 2, // 0: controller.storage.kms.store.v1.OidcKey.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 2, // 1: controller.storage.kms.store.v1.OidcKeyVersion.create_time:type_name -> controller.storage.timestamp.v1.Timestamp + 2, // [2:2] is the sub-list for method output_type + 2, // [2:2] is the sub-list for method input_type + 2, // [2:2] is the sub-list for extension type_name + 2, // [2:2] is the sub-list for extension extendee + 0, // [0:2] is the sub-list for field type_name +} + +func init() { file_controller_storage_kms_store_v1_oidc_key_proto_init() } +func file_controller_storage_kms_store_v1_oidc_key_proto_init() { + if File_controller_storage_kms_store_v1_oidc_key_proto != nil { + return + } + if !protoimpl.UnsafeEnabled { + file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} { + switch v := v.(*OidcKey); i { + case 0: + return &v.state + case 1: + return &v.sizeCache + case 2: + return &v.unknownFields + default: + return nil + } + } + file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} { + switch v := v.(*OidcKeyVersion); i { + case 0: + return &v.state + case 1: + return &v.sizeCache + case 2: + return &v.unknownFields + default: + return nil + } + } + } + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: file_controller_storage_kms_store_v1_oidc_key_proto_rawDesc, + NumEnums: 0, + NumMessages: 2, + NumExtensions: 0, + NumServices: 0, + }, + GoTypes: file_controller_storage_kms_store_v1_oidc_key_proto_goTypes, + DependencyIndexes: file_controller_storage_kms_store_v1_oidc_key_proto_depIdxs, + MessageInfos: file_controller_storage_kms_store_v1_oidc_key_proto_msgTypes, + }.Build() + File_controller_storage_kms_store_v1_oidc_key_proto = out.File + file_controller_storage_kms_store_v1_oidc_key_proto_rawDesc = nil + file_controller_storage_kms_store_v1_oidc_key_proto_goTypes = nil + file_controller_storage_kms_store_v1_oidc_key_proto_depIdxs = nil +} diff --git a/internal/kms/testing.go b/internal/kms/testing.go index 94cb58254..f949622d6 100644 --- a/internal/kms/testing.go +++ b/internal/kms/testing.go @@ -196,3 +196,37 @@ func TestSessionKeyVersion(t *testing.T, conn *gorm.DB, rootKeyVersionWrapper wr require.NoError(err) return k } + +func TestOidcKey(t *testing.T, conn *gorm.DB, rootKeyId string) *OidcKey { + t.Helper() + require := require.New(t) + rw := db.New(conn) + require.NoError(conn.Where("root_key_id = ?", rootKeyId).Delete(AllocOidcKey()).Error) + k, err := NewOidcKey(rootKeyId) + require.NoError(err) + id, err := newOidcKeyId() + require.NoError(err) + k.PrivateId = id + k.RootKeyId = rootKeyId + err = rw.Create(context.Background(), k) + require.NoError(err) + return k +} + +func TestOidcKeyVersion(t *testing.T, conn *gorm.DB, rootKeyVersionWrapper wrapping.Wrapper, oidcKeyId string, key []byte) *OidcKeyVersion { + t.Helper() + require := require.New(t) + rw := db.New(conn) + rootKeyVersionId := rootKeyVersionWrapper.KeyID() + require.NotEmpty(rootKeyVersionId) + k, err := NewOidcKeyVersion(oidcKeyId, key, rootKeyVersionId) + require.NoError(err) + id, err := newDatabaseKeyVersionId() + require.NoError(err) + k.PrivateId = id + err = k.Encrypt(context.Background(), rootKeyVersionWrapper) + require.NoError(err) + err = rw.Create(context.Background(), k) + require.NoError(err) + return k +} diff --git a/internal/proto/local/controller/storage/kms/store/v1/oidc_key.proto b/internal/proto/local/controller/storage/kms/store/v1/oidc_key.proto new file mode 100644 index 000000000..458a04a52 --- /dev/null +++ b/internal/proto/local/controller/storage/kms/store/v1/oidc_key.proto @@ -0,0 +1,53 @@ +syntax = "proto3"; + +package controller.storage.kms.store.v1; +option go_package = "github.com/hashicorp/boundary/internal/kms/store;store"; + +import "controller/storage/timestamp/v1/timestamp.proto"; +import "controller/custom_options/v1/options.proto"; + +message OidcKey { + // private_id is used to access the key via an API + // @inject_tag: gorm:"primary_key" + string private_id = 10; + + // root key id for the key + // @inject_tag: `gorm:"default:null"` + string root_key_id = 20; + + // create_time from the RDBMS + // @inject_tag: `gorm:"default:current_timestamp"` + timestamp.v1.Timestamp create_time = 30; +} + +message OidcKeyVersion { + // private_id is used to access the key version via an API + // @inject_tag: gorm:"primary_key" + string private_id = 10; + + // id for the key version + // @inject_tag: `gorm:"default:null"` + string oidc_key_id = 20; + + // root_key_version_id of the version of the root key data. + // @inject_tag: `gorm:"default:null"` + string root_key_version_id = 30; + + // plain-text of the key data. we are NOT storing this plain-text key + // in the db. + // @inject_tag: `gorm:"-" wrapping:"pt,key_data"` + bytes key = 40; + + // ciphertext key data stored in the database + // @inject_tag: `gorm:"column:key;not_null" wrapping:"ct,key_data"` + bytes ct_key = 50; + + // version of the key data. This is not used for optimistic locking, since + // key versions are immutable. It's just the version of the key. + // @inject_tag: `gorm:"default:null"` + uint32 version = 60; + + // create_time from the RDBMS + // @inject_tag: `gorm:"default:current_timestamp"` + timestamp.v1.Timestamp create_time = 70; +} \ No newline at end of file