mirror of
https://github.com/warmbly/warmbly.git
synced 2026-08-19 16:01:16 +00:00
Matthew Meszaros
a6acb97dea
The /api/v1/internal/dek route parameter is now :orgID to match the org-scoped encryptedkeys store. Workers fetch the organization DEK for the account they are operating on instead of a user DEK.
96 lines
2.5 KiB
Go
96 lines
2.5 KiB
Go
package handler
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/google/uuid"
|
|
"github.com/warmbly/warmbly/internal/infrastructure/encryptedkeys"
|
|
)
|
|
|
|
// Internal endpoints used by workers to fetch/store encrypted DEKs without
|
|
// connecting to Postgres directly. Auth via middleware.InternalAuthMiddleware
|
|
// (static bearer token in INTERNAL_API_TOKEN env var, both sides).
|
|
//
|
|
// Wire format mirrors what encryptedkeys.HTTPStore expects:
|
|
//
|
|
// GET /api/v1/internal/dek/:orgID -> 200 {"encrypted_data_key":"..."} | 404
|
|
// PUT /api/v1/internal/dek/:orgID body: {"encrypted_data_key":"..."}
|
|
// -> 201 | 409 ErrAlreadyExists
|
|
// DELETE /api/v1/internal/dek/:orgID -> 204
|
|
|
|
type dekPayload struct {
|
|
EncryptedDataKey string `json:"encrypted_data_key"`
|
|
}
|
|
|
|
func parseOrgID(c *gin.Context) (uuid.UUID, bool) {
|
|
id, err := uuid.Parse(c.Param("orgID"))
|
|
if err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid orgID"})
|
|
return uuid.Nil, false
|
|
}
|
|
return id, true
|
|
}
|
|
|
|
func (h *Handler) InternalGetDEK(c *gin.Context) {
|
|
id, ok := parseOrgID(c)
|
|
if !ok {
|
|
return
|
|
}
|
|
v, err := h.EncryptedKeys.Get(c.Request.Context(), id)
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
if v == "" {
|
|
c.Status(http.StatusNotFound)
|
|
return
|
|
}
|
|
c.JSON(http.StatusOK, dekPayload{EncryptedDataKey: v})
|
|
}
|
|
|
|
func (h *Handler) InternalPutDEK(c *gin.Context) {
|
|
id, ok := parseOrgID(c)
|
|
if !ok {
|
|
return
|
|
}
|
|
body, err := io.ReadAll(c.Request.Body)
|
|
if err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "read body"})
|
|
return
|
|
}
|
|
var p dekPayload
|
|
if err := json.Unmarshal(body, &p); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "decode body"})
|
|
return
|
|
}
|
|
if p.EncryptedDataKey == "" {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "encrypted_data_key required"})
|
|
return
|
|
}
|
|
err = h.EncryptedKeys.Put(c.Request.Context(), id, p.EncryptedDataKey)
|
|
switch {
|
|
case err == nil:
|
|
c.Status(http.StatusCreated)
|
|
case errors.Is(err, encryptedkeys.ErrAlreadyExists):
|
|
c.Status(http.StatusConflict)
|
|
default:
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
|
}
|
|
}
|
|
|
|
func (h *Handler) InternalDeleteDEK(c *gin.Context) {
|
|
id, ok := parseOrgID(c)
|
|
if !ok {
|
|
return
|
|
}
|
|
if err := h.EncryptedKeys.Delete(c.Request.Context(), id); err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
c.Status(http.StatusNoContent)
|
|
}
|