secrets.rs 90.1%

91 of 101 lines run, 23 of 39 functions · run #537 on main · run missed

//! Secrets for OxygenFlow jobs (hub spec §13.2, oxygenhub#107): named
//! values kept per site, organisation and repository, sealed at rest
//! under `keys/secrets.key`. A job gets only the secrets its pipeline
//! declares with `secret "name" { mount-path … }`, as files Flow mounts
//! (OxygenFlow spec §9), never in the environment; the hub masks each
//! value in the job's log as it arrives. Inner levels override outer by
//! name, as variables do.

use crate::db::{now_ms, Pool};
use crate::levels::{self, Scope};
use crate::Shared;
use sqlx::FromRow;

/// How many a level may hold.
pub const MAX_PER_LEVEL: usize = 100;
/// The longest value, in bytes.
pub const MAX_VALUE: usize = 64 * 1024;
/// Values shorter than this are not masked in logs: too many false hits.
const MIN_MASKED: usize = 4;

#[derive(Clone, Debug, FromRow)]
pub struct Secret {
    pub scope: String,
    pub scope_id: i64,
    pub name: String,
    /// Sealed; `App.secret_key` opens it.
    pub value: Vec<u8>,
    pub updated_ms: i64,
}

/// A secret's name, as a pipeline names it: 1 to 64 of `A-Z a-z 0-9 . _ -`.
pub fn name_ok(name: &str) -> bool {
    !name.is_empty() && name.len() <= 64 && name.bytes().all(|b| b.is_ascii_alphanumeric() || b".-_".contains(&b))
}

pub async fn list(pool: &Pool, scope: Scope) -> sqlx::Result<Vec<Secret>> {
    sqlx::query_as("SELECT * FROM flow_secrets WHERE scope = $1 AND scope_id = $2 ORDER BY name")
        .bind(scope.kind())
        .bind(scope.id())
        .fetch_all(pool)
        .await
}

/// Set a secret at a level, new or changed; `sealed` is the value sealed.
pub async fn set(pool: &Pool, scope: Scope, name: &str, sealed: &[u8]) -> sqlx::Result<()> {
    sqlx::query(
        "INSERT INTO flow_secrets (scope, scope_id, name, value, updated_ms) VALUES ($1, $2, $3, $4, $5) \
         ON CONFLICT (scope, scope_id, name) DO UPDATE SET value = excluded.value, updated_ms = excluded.updated_ms",
    )
    .bind(scope.kind())
    .bind(scope.id())
    .bind(name)
    .bind(sealed)
    .bind(now_ms())
    .execute(pool)
    .await?;
    Ok(())
}

/// Remove a secret from a level; false when it was not there.
pub async fn delete(pool: &Pool, scope: Scope, name: &str) -> sqlx::Result<bool> {
    let r = sqlx::query("DELETE FROM flow_secrets WHERE scope = $1 AND scope_id = $2 AND name = $3")
        .bind(scope.kind())
        .bind(scope.id())
        .bind(name)
        .execute(pool)
        .await?;
    Ok(r.rows_affected() == 1)
}

/// Forget a level's secrets, when the organisation or repository goes.
pub async fn delete_scope(pool: &Pool, scope: Scope) -> sqlx::Result<()> {
    sqlx::query("DELETE FROM flow_secrets WHERE scope = $1 AND scope_id = $2").bind(scope.kind()).bind(scope.id()).execute(pool).await?;
    Ok(())
}

/// A secret as a level sees it: where from, and whether an inner level
/// sets the same name. The value stays sealed.
#[derive(Clone, Debug)]
pub struct Seen {
    pub secret: Secret,
    /// `the site`, `the acme organisation`, or empty for the level's own.
    pub from: String,
    pub overridden: bool,
}

/// Every secret a level sees, outermost first.
pub async fn seen(pool: &Pool, scope: Scope, owner: &str) -> sqlx::Result<Vec<Seen>> {
    let mut lvls = levels::above(pool, scope, owner).await?;
    lvls.push((scope, String::new()));
    let mut out: Vec<Seen> = vec![];
    for (level, from) in lvls {
        for s in list(pool, level).await? {
            for o in out.iter_mut().filter(|o| o.secret.name == s.name) {
                o.overridden = true;
            }
            out.push(Seen { secret: s, from: from.clone(), overridden: false });
        }
    }
    Ok(out)
}

/// The values of the named secrets as a repository's jobs get them:
/// `(name, value)` for each that is set and opens; names not set are
/// left out, as are values sealed under another key.
pub async fn for_job(app: &Shared, repo: &crate::db::repos::RepoRow, names: &[String]) -> sqlx::Result<Vec<(String, String)>> {
    let all = seen(&app.db, Scope::Repo(repo.id), &repo.owner).await?;
    let mut out = vec![];
    for name in names {
        if let Some(s) = all.iter().find(|s| !s.overridden && s.secret.name == *name) {
            if let Some(value) = app.secret_key.open(&s.secret.value) {
                out.push((name.clone(), value));
            }
        }
    }
    Ok(out)
}

/// `text` with every secret value (and its standard base64) replaced by
/// `***`, for a job's log.
pub fn mask(text: &str, values: &[String]) -> String {
    let mut out = text.to_string();
    for v in values {
        if v.len() < MIN_MASKED {
            continue;
        }
        out = out.replace(v.as_str(), "***");
        let b64 = base64_standard(v.as_bytes());
        if b64.len() >= MIN_MASKED {
            out = out.replace(&b64, "***");
        }
    }
    out
}

fn base64_standard(bytes: &[u8]) -> String {
    const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);
    for chunk in bytes.chunks(3) {
        let n = chunk.iter().fold(0u32, |acc, b| (acc << 8) | *b as u32) << (8 * (3 - chunk.len()));
        for i in 0..4 {
            if i <= chunk.len() {
                out.push(T[((n >> (18 - 6 * i)) & 63) as usize] as char);
            } else {
                out.push('=');
            }
        }
    }
    out
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn values_and_their_base64_are_masked_in_logs() {
        assert_eq!(base64_standard(b"hunter22"), "aHVudGVyMjI=");
        let line = "token=hunter22 b64=aHVudGVyMjI= short=ab done";
        assert_eq!(mask(line, &["hunter22".into(), "ab".into()]), "token=*** b64=*** short=ab done");
        assert!(name_ok("deploy-token") && name_ok("aws.key_1") && !name_ok("") && !name_ok("a b") && !name_ok(&"x".repeat(65)));
    }
}

1		//! Secrets for OxygenFlow jobs (hub spec §13.2, oxygenhub#107): named
2		//! values kept per site, organisation and repository, sealed at rest
3		//! under `keys/secrets.key`. A job gets only the secrets its pipeline
4		//! declares with `secret "name" { mount-path … }`, as files Flow mounts
5		//! (OxygenFlow spec §9), never in the environment; the hub masks each
6		//! value in the job's log as it arrives. Inner levels override outer by
7		//! name, as variables do.
8
9		use crate::db::{now_ms, Pool};
10		use crate::levels::{self, Scope};
11		use crate::Shared;
12		use sqlx::FromRow;
13
14		/// How many a level may hold.
15		pub const MAX_PER_LEVEL: usize = 100;
16		/// The longest value, in bytes.
17		pub const MAX_VALUE: usize = 64 * 1024;
18		/// Values shorter than this are not masked in logs: too many false hits.
19		const MIN_MASKED: usize = 4;
20
21		#[derive(Clone, Debug, FromRow)]
22		pub struct Secret {
23		pub scope: String,
24		pub scope_id: i64,
25		pub name: String,
26		/// Sealed; `App.secret_key` opens it.
27		pub value: Vec<u8>,
28		pub updated_ms: i64,
29		}
30
31		/// A secret's name, as a pipeline names it: 1 to 64 of `A-Z a-z 0-9 . _ -`.
32	8×	pub fn name_ok(name: &str) -> bool {
33	51×	!name.is_empty() && name.len() <= 64 && name.bytes().all(\|b\| b.is_ascii_alphanumeric() \|\| b".-_".contains(&b))
34	8×	}
35
36	759×	pub async fn list(pool: &Pool, scope: Scope) -> sqlx::Result<Vec<Secret>> {
37	759×	sqlx::query_as("SELECT * FROM flow_secrets WHERE scope = $1 AND scope_id = $2 ORDER BY name")
38	759×	.bind(scope.kind())
39	759×	.bind(scope.id())
40	759×	.fetch_all(pool)
41	759×	.await
42	759×	}
43
44		/// Set a secret at a level, new or changed; `sealed` is the value sealed.
45	2×	pub async fn set(pool: &Pool, scope: Scope, name: &str, sealed: &[u8]) -> sqlx::Result<()> {
46	2×	sqlx::query(
47	2×	"INSERT INTO flow_secrets (scope, scope_id, name, value, updated_ms) VALUES ($1, $2, $3, $4, $5) \
48	2×	ON CONFLICT (scope, scope_id, name) DO UPDATE SET value = excluded.value, updated_ms = excluded.updated_ms",
49	2×	)
50	2×	.bind(scope.kind())
51	2×	.bind(scope.id())
52	2×	.bind(name)
53	2×	.bind(sealed)
54	2×	.bind(now_ms())
55	2×	.execute(pool)
56	2×	.await?;
57	2×	Ok(())
58	2×	}
59
60		/// Remove a secret from a level; false when it was not there.
61	0×	pub async fn delete(pool: &Pool, scope: Scope, name: &str) -> sqlx::Result<bool> {
62	0×	let r = sqlx::query("DELETE FROM flow_secrets WHERE scope = $1 AND scope_id = $2 AND name = $3")
63	0×	.bind(scope.kind())
64	0×	.bind(scope.id())
65	0×	.bind(name)
66	0×	.execute(pool)
67	0×	.await?;
68	0×	Ok(r.rows_affected() == 1)
69	0×	}
70
71		/// Forget a level's secrets, when the organisation or repository goes.
72	1×	pub async fn delete_scope(pool: &Pool, scope: Scope) -> sqlx::Result<()> {
73	1×	sqlx::query("DELETE FROM flow_secrets WHERE scope = $1 AND scope_id = $2").bind(scope.kind()).bind(scope.id()).execute(pool).await?;
74	1×	Ok(())
75	1×	}
76
77		/// A secret as a level sees it: where from, and whether an inner level
78		/// sets the same name. The value stays sealed.
79		#[derive(Clone, Debug)]
80		pub struct Seen {
81		pub secret: Secret,
82		/// `the site`, `the acme organisation`, or empty for the level's own.
83		pub from: String,
84		pub overridden: bool,
85		}
86
87		/// Every secret a level sees, outermost first.
88	420×	pub async fn seen(pool: &Pool, scope: Scope, owner: &str) -> sqlx::Result<Vec<Seen>> {
89	420×	let mut lvls = levels::above(pool, scope, owner).await?;
90	420×	lvls.push((scope, String::new()));
91	420×	let mut out: Vec<Seen> = vec![];
92	756×	for (level, from) in lvls {
93	756×	for s in list(pool, level).await? {
94	11×	for o in out.iter_mut().filter(\|o\| o.secret.name == s.name) {
95	4×	o.overridden = true;
96	4×	}
97	11×	out.push(Seen { secret: s, from: from.clone(), overridden: false });
98		}
99		}
100	420×	Ok(out)
101	420×	}
102
103		/// The values of the named secrets as a repository's jobs get them:
104		/// `(name, value)` for each that is set and opens; names not set are
105		/// left out, as are values sealed under another key.
106	160×	pub async fn for_job(app: &Shared, repo: &crate::db::repos::RepoRow, names: &[String]) -> sqlx::Result<Vec<(String, String)>> {
107	160×	let all = seen(&app.db, Scope::Repo(repo.id), &repo.owner).await?;
108	160×	let mut out = vec![];
109	160×	for name in names {
110	8×	if let Some(s) = all.iter().find(\|s\| !s.overridden && s.secret.name == *name) {
111	2×	if let Some(value) = app.secret_key.open(&s.secret.value) {
112	2×	out.push((name.clone(), value));
113	2×	}
114	2×	}
115		}
116	160×	Ok(out)
117	160×	}
118
119		/// `text` with every secret value (and its standard base64) replaced by
120		/// `***`, for a job's log.
121	3×	pub fn mask(text: &str, values: &[String]) -> String {
122	3×	let mut out = text.to_string();
123	4×	for v in values {
124	4×	if v.len() < MIN_MASKED {
125	1×	continue;
126	3×	}
127	3×	out = out.replace(v.as_str(), "***");
128	3×	let b64 = base64_standard(v.as_bytes());
129	3×	if b64.len() >= MIN_MASKED {
130	3×	out = out.replace(&b64, "***");
131	3×	}
132		}
133	3×	out
134	3×	}
135
136	4×	fn base64_standard(bytes: &[u8]) -> String {
137		const T: &[u8; 64] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
138	4×	let mut out = String::with_capacity(bytes.len().div_ceil(3) * 4);
139	20×	for chunk in bytes.chunks(3) {
140	54×	let n = chunk.iter().fold(0u32, \|acc, b\| (acc << 8) \| b as u32) << (8 (3 - chunk.len()));
141	80×	for i in 0..4 {
142	80×	if i <= chunk.len() {
143	74×	out.push(T[((n >> (18 - 6 * i)) & 63) as usize] as char);
144	74×	} else {
145	6×	out.push('=');
146	6×	}
147		}
148		}
149	4×	out
150	4×	}
151
152		#[cfg(test)]
153		mod tests {
154		use super::*;
155
156		#[test]
157	1×	fn values_and_their_base64_are_masked_in_logs() {
158	1×	assert_eq!(base64_standard(b"hunter22"), "aHVudGVyMjI=");
159	1×	let line = "token=hunter22 b64=aHVudGVyMjI= short=ab done";
160	1×	assert_eq!(mask(line, &["hunter22".into(), "ab".into()]), "token=* b64=* short=ab done");
161	1×	assert!(name_ok("deploy-token") && name_ok("aws.key_1") && !name_ok("") && !name_ok("a b") && !name_ok(&"x".repeat(65)));
162	1×	}
163		}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/hub/src/secrets.rs 90.1%

Keyboard