mirror of
https://github.com/warmbly/warmbly.git
synced 2026-08-19 16:01:16 +00:00
Matthew Meszaros
99226338c9
New encryptedkeys.Store interface with three impls:
postgres - backend default, durable via PG
dynamodb - existing AWS path, also covers Scylla Alternator via
AWS_ENDPOINT_URL_DYNAMODB
http - worker-side adapter that talks to the backend's new
/api/v1/internal/dek/:userID endpoint, so workers never
connect directly to Postgres
The HTTP endpoint sits behind a new InternalAuthMiddleware that does
constant-time bearer-token compare against INTERNAL_API_TOKEN. Fail-
closed if the env var is unset.
cipher.Service now takes an encryptedkeys.Store instead of a Dynamo
repository. The old internal/repository/dynamo_user_encrypted_keys.go
is deleted (the file also had a pre-existing copy-paste bug using
EmailMessageMapTable in Get/Del that's gone with it).
New migration 38 adds user_encrypted_keys (user_id PK, encrypted_data_key,
created_at, updated_at).
20 tests cover HTTP round-trip, conflict semantics, factory selection,
middleware auth (fail-closed / wrong-scheme / timing-safe / happy path),
and DEK handler responses through gin's test harness.
96 lines
2.5 KiB
Go
96 lines
2.5 KiB
Go
package handler
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"io"
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/google/uuid"
|
|
"github.com/warmbly/warmbly/internal/infrastructure/encryptedkeys"
|
|
)
|
|
|
|
// Internal endpoints used by workers to fetch/store encrypted DEKs without
|
|
// connecting to Postgres directly. Auth via middleware.InternalAuthMiddleware
|
|
// (static bearer token in INTERNAL_API_TOKEN env var, both sides).
|
|
//
|
|
// Wire format mirrors what encryptedkeys.HTTPStore expects:
|
|
//
|
|
// GET /api/v1/internal/dek/:userID -> 200 {"encrypted_data_key":"..."} | 404
|
|
// PUT /api/v1/internal/dek/:userID body: {"encrypted_data_key":"..."}
|
|
// -> 201 | 409 ErrAlreadyExists
|
|
// DELETE /api/v1/internal/dek/:userID -> 204
|
|
|
|
type dekPayload struct {
|
|
EncryptedDataKey string `json:"encrypted_data_key"`
|
|
}
|
|
|
|
func parseUserID(c *gin.Context) (uuid.UUID, bool) {
|
|
id, err := uuid.Parse(c.Param("userID"))
|
|
if err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "invalid userID"})
|
|
return uuid.Nil, false
|
|
}
|
|
return id, true
|
|
}
|
|
|
|
func (h *Handler) InternalGetDEK(c *gin.Context) {
|
|
id, ok := parseUserID(c)
|
|
if !ok {
|
|
return
|
|
}
|
|
v, err := h.EncryptedKeys.Get(c.Request.Context(), id)
|
|
if err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
if v == "" {
|
|
c.Status(http.StatusNotFound)
|
|
return
|
|
}
|
|
c.JSON(http.StatusOK, dekPayload{EncryptedDataKey: v})
|
|
}
|
|
|
|
func (h *Handler) InternalPutDEK(c *gin.Context) {
|
|
id, ok := parseUserID(c)
|
|
if !ok {
|
|
return
|
|
}
|
|
body, err := io.ReadAll(c.Request.Body)
|
|
if err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "read body"})
|
|
return
|
|
}
|
|
var p dekPayload
|
|
if err := json.Unmarshal(body, &p); err != nil {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "decode body"})
|
|
return
|
|
}
|
|
if p.EncryptedDataKey == "" {
|
|
c.JSON(http.StatusBadRequest, gin.H{"error": "encrypted_data_key required"})
|
|
return
|
|
}
|
|
err = h.EncryptedKeys.Put(c.Request.Context(), id, p.EncryptedDataKey)
|
|
switch {
|
|
case err == nil:
|
|
c.Status(http.StatusCreated)
|
|
case errors.Is(err, encryptedkeys.ErrAlreadyExists):
|
|
c.Status(http.StatusConflict)
|
|
default:
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
|
}
|
|
}
|
|
|
|
func (h *Handler) InternalDeleteDEK(c *gin.Context) {
|
|
id, ok := parseUserID(c)
|
|
if !ok {
|
|
return
|
|
}
|
|
if err := h.EncryptedKeys.Delete(c.Request.Context(), id); err != nil {
|
|
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
|
return
|
|
}
|
|
c.Status(http.StatusNoContent)
|
|
}
|