Module: RazorRisk::Cassini::Util::SecretsUtil

Includes:
Pantheios, RazorRisk::Core::Diagnostics::Logger, Xqsr3::Quality::ParameterChecking
Defined in:
lib/razor_risk/cassini/util/secrets_util.rb

Overview

Include-module that introduces the load_secrets function

Instance Method Summary collapse

Instance Method Details

#get_secret_from_hash(h, category, algorithm, **options) ⇒ Object 



126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
 
# File 'lib/razor_risk/cassini/util/secrets_util.rb', line 126

def get_secret_from_hash h, category, algorithm, **options

    trace ParamNames[ :h, :category, :algorithm, :options ], h, category, algorithm, options

    check_parameter h, 'h', type: ::Hash
    check_parameter algorithm, 'algorithm', types: [ ::String, ::Symbol ]
    check_parameter category, 'category', types: [ ::String, ::Symbol ], allow_nil: true

    h           =   h['secrets'] if 1 == h.size && h.has_key?('secrets')

    h           =   h.deep_transform { |k, v| [ k.to_s.downcase, v ] }

    category    ||= 'all'

    category    =   category.downcase
    algorithm   =   algorithm.downcase

    secret      =   nil
    secret      ||= h.dig(category, algorithm) if 'all' != category
    secret      ||= h.dig('all', algorithm)

    secret
end

#get_secret_from_server(secret_server_url, category, algorithm, **options) ⇒ Object

Gets the given secret - category + algorithm - from the given server (+secret_server_url+), according to the given options

Signature

  • Parameters:

    - secret_server_url

    [ ::String, ::URI ] The URI of the secret server

    - category

    [ ::String, ::Symbol ] The secret category. May be nil

    - algorithm

    [ ::String, ::Symbol ] The secret algorithm

NOTE: all algorithm names are converted to lowercase before processing



64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'lib/razor_risk/cassini/util/secrets_util.rb', line 64

def get_secret_from_server secret_server_url, category, algorithm, **options

    trace ParamNames[ :secret_server_url, :category, :algorithm, :options ], secret_server_url, category, algorithm, options

    check_parameter secret_server_url, 'secret_server_url', types: [ ::String, ::URI::Generic ]
    check_parameter algorithm, 'algorithm', types: [ ::String, ::Symbol ]
    check_parameter category, 'category', types: [ ::String, ::Symbol ], allow_nil: true

    uri     =   URI.parse secret_server_url
    host    =   uri.host
    port    =   uri.port

    headers =   {

        'Accept' => 'application/json',
    }

    params  =   { 'algorithm' => algorithm }

    params['category'] = category if category

    headers.reject! { |k, v| ::NilClass === v }

    begin

        # there are issues in sending through a path-less URI to the
        # server, so we step in and assign it (as the root) if it
        # does not exist

        path    =   (uri.path || '').empty? ? '/' : uri.path
        query   =   URI.encode_www_form params

        log :debug0, "host: '#{host}'; port: '#{port}'; path: '#{path}'; query: '#{query}'"

        response = Net::HTTP.start(host, port, :use_ssl => uri.scheme == 'https') do |http|

            full_uri    =   URI::HTTP.build host: host, port: port, path: path, query: query
            full_url    =   full_uri.to_s

            log :debug0, 'issuing request to \'', full_uri, '\'; scheme=\'', uri.scheme, '\''

            request = Net::HTTP::Get.new full_uri, headers

            http.request request
        end

        if '200' != response.code.to_s

            abort "could not obtain secret for algorithm '#{algorithm}' from server '#{secret_server_url}': #{response.code}: #{response.body}"
        end

        j = JSON.parse response.body

        j['secret']
    rescue Errno::ECONNREFUSED

        log :warning, 'failed to contact secret server ', secret_server_url

        return nil
    end
end

#included(receiver) ⇒ Object 



46
47
48
49
 
# File 'lib/razor_risk/cassini/util/secrets_util.rb', line 46

def included receiver

    receiver.extend self
end

#load_secrets(source, *algorithms, **options) ⇒ Object

Loads the secrets for the given algorithms from the given source

Signature

  • Parameters:

    - source

    [::String, ::URI] The source of the secrets, which may be a URI of a secret server, or the path of a YAML file

    - algorithms

    An array of algorithms (::String or ::Symbol), or [ category, algorithm ] tuples

    - options

    Options

  • Options:

    • :source_is:: [::Symbol] If :uri, then source is assumed to be a specified, then source type is inferred from its type and content

Returns

A hash representing the obtained secrets

NOTE: all algorithm names are converted to lowercase before processing

Raises:

  • (ArgumentError) 


170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
 
# File 'lib/razor_risk/cassini/util/secrets_util.rb', line 170

def load_secrets source, *algorithms, **options

    trace ParamNames[ :source, :algorithms, :options ], source, algorithms, options

    check_parameter source, 'source', types: [ ::String, ::URI::Generic ]
    check_parameter algorithms, 'algorithms', types: [ [ ::String, ::Symbol ] ]
    check_option options, :source_is, type: ::Symbol, values: [ :path, :uri ], allow_nil: true

    source_is   =   options[:source_is]

    source_is   ||= :uri if ::URI::Generic === source
    source_is   ||= :path if Recls.stat(source) rescue nil
    source_is   ||= :uri if URI.parse(source) rescue nil

    raise ArgumentError, "could not identify whether source - '#{source}' - is a file-system path or a URI" unless source_is

    acs     =   algorithms.map do |a|

        alg =   nil
        cat =   nil

        case a
        when ::String, ::Symbol

            alg =   a.to_s.downcase
        else

            log :warning, "unexpected element - '#{a}' (#{a.class}) - in array argument"
        end

        [ cat, alg ]
    end.reject { |ar| ar[1].nil? }

    secrets =   {}

    yaml    =   YAML.load_file(source) if :path == source_is

    acs.each do |category, algorithm|

        if :uri == source_is

            secrets[algorithm] = get_secret_from_server source, category, algorithm, **options
        else

            secrets[algorithm] = get_secret_from_hash yaml, category, algorithm, **options
        end
    end

    secrets
end