98 lines
2.6 KiB
Go
98 lines
2.6 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
package kms
|
|
|
|
// KeyPurpose allows an application to specify the reason they need a key; this
|
|
// is used to select which DEK to return
|
|
type KeyPurpose uint
|
|
|
|
// ****************************************************************************
|
|
// IMPORTANT: if you're adding a new KeyPurpose, you should consider whether or
|
|
// not existing scopes need this new type of key. If they do, then you may want
|
|
// to add the new key into kms.ReconcileKeys(...)
|
|
// ****************************************************************************
|
|
const (
|
|
// KeyPurposeUnknown is the default, and indicates that a correct purpose
|
|
// wasn't specified
|
|
KeyPurposeUnknown KeyPurpose = iota
|
|
|
|
// KeyPurposeDatabase is used for general encryption needs for most values
|
|
// in the database, excluding the oplog
|
|
KeyPurposeDatabase
|
|
|
|
// KeyPurposeOplog is used for oplogs
|
|
KeyPurposeOplog
|
|
|
|
// KeyPurposeRecovery is used for recovery access
|
|
KeyPurposeRecovery
|
|
|
|
// KeyPurposeWorkerAuth is used for worker auth
|
|
KeyPurposeWorkerAuth
|
|
|
|
// KeyPurposeWorkerAuthStorage is used for worker credential storage
|
|
KeyPurposeWorkerAuthStorage
|
|
|
|
// KeyPurposeTokens is used for token encryption
|
|
KeyPurposeTokens
|
|
|
|
// KeyPurposeSessions is used as a base key to derive session-specific encryption keys
|
|
KeyPurposeSessions
|
|
|
|
// KeyPurposeOidc is used for encrypting oidc states included in
|
|
// authentication URLs
|
|
KeyPurposeOidc
|
|
|
|
// KeyPurposeAudit is used for audit operations
|
|
KeyPurposeAudit
|
|
|
|
// KeyPurposeRootKey is used as the root key
|
|
KeyPurposeRootKey
|
|
|
|
// KeyPurpose is used for wrapping BSR keys
|
|
KeyPurposeBsr
|
|
)
|
|
|
|
// String returns the key purpose cast as a string, just so it can be called as
|
|
// a function instead of direct casting elsewhere, yw
|
|
func (k KeyPurpose) String() string {
|
|
switch k {
|
|
case KeyPurposeDatabase:
|
|
return "database"
|
|
case KeyPurposeOplog:
|
|
return "oplog"
|
|
case KeyPurposeRecovery:
|
|
return "recovery"
|
|
case KeyPurposeWorkerAuth:
|
|
return "workerauth"
|
|
case KeyPurposeWorkerAuthStorage:
|
|
return "workerauthstorage"
|
|
case KeyPurposeTokens:
|
|
return "tokens"
|
|
case KeyPurposeSessions:
|
|
return "sessions"
|
|
case KeyPurposeOidc:
|
|
return "oidc"
|
|
case KeyPurposeAudit:
|
|
return "audit"
|
|
case KeyPurposeRootKey:
|
|
return "rootKey"
|
|
case KeyPurposeBsr:
|
|
return "bsr"
|
|
default:
|
|
return "unknown"
|
|
}
|
|
}
|
|
|
|
// ValidDekPurposes returns the current list of valid DEK key purposes
|
|
func ValidDekPurposes() []KeyPurpose {
|
|
return []KeyPurpose{
|
|
KeyPurposeDatabase,
|
|
KeyPurposeOplog,
|
|
KeyPurposeTokens,
|
|
KeyPurposeSessions,
|
|
KeyPurposeOidc,
|
|
KeyPurposeAudit,
|
|
}
|
|
}
|