Jim
f63ca1313c
* feature (db): Add the ability to enable debug output for a connection * refactor: Use scope.Global instead of "global" * feature (db/migrations): Add kms audit keys Add schema changes to support a new DEK for audit crypto operations. * feature (kms/audit): Add audit key type All the bits required to define a new DEK concrete type for operating on audit entries. * refactor (db): Remove deprecated migration unit tests. We added a new audit DEK to kms.CreateKeysTx(...). Unfortunately, unit tests like TestMigrations_UserDimension, Test_PrimaryAuthMethodChanges and TestMigrations_CredentialDimension have an indirect dependency on a specific historical set of DEKs via an indirect call kms.CreateKeysTx. This of course fails because the new DEK's tables is not a part of pinned migration versions that these tests depend on.
118 lines
2.8 KiB
Go
118 lines
2.8 KiB
Go
package kms
|
|
|
|
// KeyPurpose allows an application to specify the reason they need a key; this
|
|
// is used to select which DEK to return
|
|
type KeyPurpose uint
|
|
|
|
const (
|
|
// KeyPurposeUnknown is the default, and indicates that a correct purpose
|
|
// wasn't specified
|
|
KeyPurposeUnknown KeyPurpose = iota
|
|
|
|
// KeyPurposeDatabase is used for general encryption needs for most values
|
|
// in the database, excluding the oplog
|
|
KeyPurposeDatabase
|
|
|
|
// KeyPurposeOplog is used for oplogs
|
|
KeyPurposeOplog
|
|
|
|
// KeyPurposeRecovery is used for recovery access
|
|
KeyPurposeRecovery
|
|
|
|
// KeyPurposeTokens is used for token encryption
|
|
KeyPurposeTokens
|
|
|
|
// KeyPurposeSessions is used as a base key to derive session-specific encryption keys
|
|
KeyPurposeSessions
|
|
|
|
// KeyPurposeOidc is used for encrypting oidc states included in
|
|
// authentication URLs
|
|
KeyPurposeOidc
|
|
|
|
// KeyPurposeAudit is used for audit operations
|
|
KeyPurposeAudit
|
|
)
|
|
|
|
// String returns the key purpose cast as a string, just so it can be called as
|
|
// a function instead of direct casting elsewhere, yw
|
|
func (k KeyPurpose) String() string {
|
|
switch k {
|
|
case KeyPurposeDatabase:
|
|
return "database"
|
|
case KeyPurposeOplog:
|
|
return "oplog"
|
|
case KeyPurposeRecovery:
|
|
return "recovery"
|
|
case KeyPurposeTokens:
|
|
return "tokens"
|
|
case KeyPurposeSessions:
|
|
return "sessions"
|
|
case KeyPurposeOidc:
|
|
return "oidc"
|
|
case KeyPurposeAudit:
|
|
return "audit"
|
|
default:
|
|
return "unknown"
|
|
}
|
|
}
|
|
|
|
// KeyType allows the kms repo to return a map[KeyType]Key which can be easily
|
|
// used without type casting.
|
|
type KeyType uint
|
|
|
|
const (
|
|
KeyTypeUnknown KeyType = iota
|
|
KeyTypeRootKey
|
|
KeyTypeRootKeyVersion
|
|
KeyTypeDatabaseKey
|
|
KeyTypeDatabaseKeyVersion
|
|
KeyTypeOplogKey
|
|
KeyTypeOplogKeyVersion
|
|
KeyTypeTokenKey
|
|
KeyTypeTokenKeyVersion
|
|
KeyTypeSessionKey
|
|
KeyTypeSessionKeyVersion
|
|
KeyTypeOidcKey
|
|
KeyTypeOidcKeyVersion
|
|
KeyTypeAuditKey
|
|
KeyTypeAuditKeyVersion
|
|
)
|
|
|
|
// String returns the key type cast as a string, just so it can be called as
|
|
// a function instead of direct casting elsewhere, yw
|
|
func (k KeyType) String() string {
|
|
switch k {
|
|
case KeyTypeRootKey:
|
|
return "rootKey"
|
|
case KeyTypeRootKeyVersion:
|
|
return "rootKeyVersion"
|
|
case KeyTypeDatabaseKey:
|
|
return "databaseKey"
|
|
case KeyTypeDatabaseKeyVersion:
|
|
return "databaseKeyVersion"
|
|
case KeyTypeOplogKey:
|
|
return "oplogKey"
|
|
case KeyTypeOplogKeyVersion:
|
|
return "oplogKeyVersion"
|
|
case KeyTypeTokenKey:
|
|
return "tokenKey"
|
|
case KeyTypeTokenKeyVersion:
|
|
return "tokenKeyVersion"
|
|
case KeyTypeSessionKey:
|
|
return "sessionKey"
|
|
case KeyTypeSessionKeyVersion:
|
|
return "sessionKeyVersion"
|
|
case KeyTypeOidcKey:
|
|
return "oidcKey"
|
|
case KeyTypeOidcKeyVersion:
|
|
return "oidcKeyVersion"
|
|
case KeyTypeAuditKey:
|
|
return "auditKey"
|
|
case KeyTypeAuditKeyVersion:
|
|
return "auditKeyVersion"
|
|
|
|
default:
|
|
return "unknown"
|
|
}
|
|
}
|