mirror of
https://github.com/warmbly/warmbly.git
synced 2026-08-23 08:00:28 +00:00
Matthew Meszaros
99226338c9
New encryptedkeys.Store interface with three impls:
postgres - backend default, durable via PG
dynamodb - existing AWS path, also covers Scylla Alternator via
AWS_ENDPOINT_URL_DYNAMODB
http - worker-side adapter that talks to the backend's new
/api/v1/internal/dek/:userID endpoint, so workers never
connect directly to Postgres
The HTTP endpoint sits behind a new InternalAuthMiddleware that does
constant-time bearer-token compare against INTERNAL_API_TOKEN. Fail-
closed if the env var is unset.
cipher.Service now takes an encryptedkeys.Store instead of a Dynamo
repository. The old internal/repository/dynamo_user_encrypted_keys.go
is deleted (the file also had a pre-existing copy-paste bug using
EmailMessageMapTable in Get/Del that's gone with it).
New migration 38 adds user_encrypted_keys (user_id PK, encrypted_data_key,
created_at, updated_at).
20 tests cover HTTP round-trip, conflict semantics, factory selection,
middleware auth (fail-closed / wrong-scheme / timing-safe / happy path),
and DEK handler responses through gin's test harness.
50 lines
891 B
Go
50 lines
891 B
Go
package cipher
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/getsentry/sentry-go"
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
type Cipher struct {
|
|
plainDEK []byte
|
|
}
|
|
|
|
func (s *cipherService) Cipher(ctx context.Context, userID uuid.UUID) (*Cipher, error) {
|
|
key, err := s.getDecryptedKey(ctx, userID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
encDEKB64, err := s.encryptedKeys.Get(ctx, userID)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if encDEKB64 == "" {
|
|
var encryptedDEK string
|
|
key, encryptedDEK, err = s.kms.GenerateDataKey(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
if err := s.encryptedKeys.Put(ctx, userID, encryptedDEK); err != nil {
|
|
return nil, err
|
|
}
|
|
} else {
|
|
key, err = s.kms.GetDecryptedKey(ctx, encDEKB64)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
if err := s.saveDecryptedKey(ctx, userID, key); err != nil {
|
|
sentry.CaptureException(err)
|
|
}
|
|
|
|
return &Cipher{
|
|
plainDEK: key,
|
|
}, nil
|
|
}
|