Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polishing.

Browse Source 
See gh-661
Original pull request: gh-793
This commit is contained in:
Mark Paluch
2023-06-19 11:24:07 +02:00
parent 92eef9fe68
commit a7984632cd
3 changed files with 194 additions and 171 deletions
Download Patch File Download Diff File Expand all files Collapse all files

302
spring-vault-core/src/main/java/org/springframework/vault/core/VaultTransitTemplate.java
View File

@@ -57,6 +57,7 @@ import java.util.Objects;
* @author Luander Ribeiro
* @author Mikko Koli
* @author My-Lan Aragon
* @author Nanne Baars
*/
public class VaultTransitTemplate implements VaultTransitOperations {
@@ -559,13 +560,19 @@ public class VaultTransitTemplate implements VaultTransitOperations {
@Nullable
private String name;
@JsonProperty("cipher_mode")
private String cipherMode = "";
@JsonProperty("type")
@Nullable
private String type;
@JsonProperty("allow_plaintext_backup")
private boolean allowPlaintextBackup;
@JsonProperty("cipher_mode")
private String cipherMode = "";
@JsonProperty("convergent_encryption_version")
private int convergentVersion;
@JsonProperty("deletion_allowed")
private boolean deletionAllowed;
@@ -584,30 +591,34 @@ public class VaultTransitTemplate implements VaultTransitOperations {
@JsonProperty("min_encryption_version")
private int minEncryptionVersion;
@JsonProperty("convergent_encryption")
private boolean supportsConvergentEncryption;
@JsonProperty("supports_decryption")
private boolean supportsDecryption;
@JsonProperty("supports_encryption")
private boolean supportsEncryption;
@JsonProperty("supports_derivation")
private boolean supportsDerivation;
@JsonProperty("supports_encryption")
private boolean supportsEncryption;
@JsonProperty("supports_signing")
private boolean supportsSigning;
@JsonProperty("allow_plaintext_backup")
private boolean allowPlaintextBackup;
@JsonProperty("convergent_encryption")
private boolean supportsConvergentEncryption;
@JsonProperty("convergent_encryption_version")
private int convergentVersion;
public VaultTransitKeyImpl() {
}
@Override
@Nullable
public String getName() {
return this.name;
}
public void setName(@Nullable String name) {
this.name = name;
}
@Override
public String getType() {
@@ -618,11 +629,125 @@ public class VaultTransitTemplate implements VaultTransitOperations {
return this.cipherMode;
}
public void setType(@Nullable String type) {
this.type = type;
}
@Override
public boolean allowPlaintextBackup() {
return isAllowPlaintextBackup();
}
public boolean isAllowPlaintextBackup() {
return this.allowPlaintextBackup;
}
public String getCipherMode() {
return this.cipherMode;
}
public void setCipherMode(String cipherMode) {
this.cipherMode = cipherMode;
}
@Override
public int getConvergentVersion() {
return this.convergentVersion;
}
@Override
public boolean isDeletionAllowed() {
return this.deletionAllowed;
}
public void setDeletionAllowed(boolean deletionAllowed) {
this.deletionAllowed = deletionAllowed;
}
@Override
public boolean isDerived() {
return this.derived;
}
public void setDerived(boolean derived) {
this.derived = derived;
}
@Override
public boolean isExportable() {
return this.exportable;
}
public void setExportable(boolean exportable) {
this.exportable = exportable;
}
@Override
public Map<String, Object> getKeys() {
return this.keys;
}
public void setKeys(Map<String, Object> keys) {
this.keys = keys;
}
@Override
public int getLatestVersion() {
return this.latestVersion;
}
public void setLatestVersion(int latestVersion) {
this.latestVersion = latestVersion;
}
@Override
public int getMinDecryptionVersion() {
return this.minDecryptionVersion;
}
public void setMinDecryptionVersion(int minDecryptionVersion) {
this.minDecryptionVersion = minDecryptionVersion;
}
public void setSupportsEncryption(boolean supportsEncryption) {
this.supportsEncryption = supportsEncryption;
}
@Override
public int getMinEncryptionVersion() {
return this.minEncryptionVersion;
}
public void setMinEncryptionVersion(int minEncryptionVersion) {
this.minEncryptionVersion = minEncryptionVersion;
}
public boolean isSupportsConvergentEncryption() {
return this.supportsConvergentEncryption;
}
@Override
public boolean supportsConvergentEncryption() {
return isSupportsConvergentEncryption();
}
public boolean isSupportsDecryption() {
return this.supportsDecryption;
}
@Override
public boolean supportsDecryption() {
return isSupportsDecryption();
}
public void setSupportsDecryption(boolean supportsDecryption) {
this.supportsDecryption = supportsDecryption;
}
public boolean isSupportsEncryption() {
return this.supportsEncryption;
}
@Override
public boolean supportsEncryption() {
return isSupportsEncryption();
@@ -633,143 +758,27 @@ public class VaultTransitTemplate implements VaultTransitOperations {
return isSupportsDerivation();
}
@Override
public boolean supportsSigning() {
return isSupportsSigning();
}
@Override
public boolean allowPlaintextBackup() {
return isAllowPlaintextBackup();
}
@Override
public boolean supportsConvergentEncryption() {
return isSupportsConvergentEncryption();
}
@Override
public int getConvergentVersion() {
return this.convergentVersion;
}
@Nullable
public String getName() {
return this.name;
}
public String getCipherMode() {
return this.cipherMode;
}
public boolean isDeletionAllowed() {
return this.deletionAllowed;
}
public boolean isDerived() {
return this.derived;
}
public boolean isExportable() {
return this.exportable;
}
public Map<String, Object> getKeys() {
return this.keys;
}
public int getLatestVersion() {
return this.latestVersion;
}
public int getMinDecryptionVersion() {
return this.minDecryptionVersion;
}
public int getMinEncryptionVersion() {
return this.minEncryptionVersion;
}
public boolean isAllowPlaintextBackup() {
return this.allowPlaintextBackup;
}
public boolean isSupportsDecryption() {
return this.supportsDecryption;
}
public boolean isSupportsEncryption() {
return this.supportsEncryption;
}
public boolean isSupportsDerivation() {
return this.supportsDerivation;
}
public boolean isSupportsSigning() {
return this.supportsSigning;
}
public boolean isSupportsConvergentEncryption() {
return this.supportsConvergentEncryption;
}
public void setName(@Nullable String name) {
this.name = name;
}
public void setCipherMode(String cipherMode) {
this.cipherMode = cipherMode;
}
public void setType(@Nullable String type) {
this.type = type;
}
public void setDeletionAllowed(boolean deletionAllowed) {
this.deletionAllowed = deletionAllowed;
}
public void setDerived(boolean derived) {
this.derived = derived;
}
public void setExportable(boolean exportable) {
this.exportable = exportable;
}
public void setKeys(Map<String, Object> keys) {
this.keys = keys;
}
public void setLatestVersion(int latestVersion) {
this.latestVersion = latestVersion;
}
public void setMinDecryptionVersion(int minDecryptionVersion) {
this.minDecryptionVersion = minDecryptionVersion;
}
public void setMinEncryptionVersion(int minEncryptionVersion) {
this.minEncryptionVersion = minEncryptionVersion;
}
public void setSupportsDecryption(boolean supportsDecryption) {
this.supportsDecryption = supportsDecryption;
}
public void setSupportsEncryption(boolean supportsEncryption) {
this.supportsEncryption = supportsEncryption;
}
public void setSupportsDerivation(boolean supportsDerivation) {
this.supportsDerivation = supportsDerivation;
}
public boolean isSupportsSigning() {
return this.supportsSigning;
}
public void setSupportsSigning(boolean supportsSigning) {
this.supportsSigning = supportsSigning;
}
@Override
public boolean supportsSigning() {
return isSupportsSigning();
}
@Override
public boolean equals(Object o) {
if (this == o)
@@ -777,7 +786,8 @@ public class VaultTransitTemplate implements VaultTransitOperations {
if (!(o instanceof VaultTransitKeyImpl))
return false;
VaultTransitKeyImpl that = (VaultTransitKeyImpl) o;
return this.deletionAllowed == that.deletionAllowed && this.derived == that.derived
return this.allowPlaintextBackup == that.allowPlaintextBackup
&& this.deletionAllowed == that.deletionAllowed && this.derived == that.derived
&& this.exportable == that.exportable && this.latestVersion == that.latestVersion
&& this.minDecryptionVersion == that.minDecryptionVersion
&& this.minEncryptionVersion == that.minEncryptionVersion
@@ -786,17 +796,15 @@ public class VaultTransitTemplate implements VaultTransitOperations {
&& this.supportsDerivation == that.supportsDerivation
&& this.supportsSigning == that.supportsSigning && Objects.equals(this.name, that.name)
&& this.cipherMode.equals(that.cipherMode) && Objects.equals(this.type, that.type)
&& this.allowPlaintextBackup == that.allowPlaintextBackup
&& this.supportsConvergentEncryption == that.supportsConvergentEncryption;
}
@Override
public int hashCode() {
return Objects.hash(this.name, this.cipherMode, this.type, this.deletionAllowed, this.derived,
this.exportable, this.keys, this.latestVersion, this.minDecryptionVersion,
return Objects.hash(this.allowPlaintextBackup, this.name, this.cipherMode, this.type, this.deletionAllowed,
this.derived, this.exportable, this.keys, this.latestVersion, this.minDecryptionVersion,
this.minEncryptionVersion, this.supportsDecryption, this.supportsEncryption,
this.supportsDerivation, this.supportsSigning, this.allowPlaintextBackup,
this.supportsConvergentEncryption);
this.supportsDerivation, this.supportsSigning, this.supportsConvergentEncryption);
}
}
@@ -811,10 +819,12 @@ public class VaultTransitTemplate implements VaultTransitOperations {
public RawTransitKeyImpl() {
}
@Override
public Map<String, String> getKeys() {
return this.keys;
}
@Override
@Nullable
public String getName() {
return this.name;

56
spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKey.java
View File

@@ -22,6 +22,7 @@ import java.util.Map;
*
* @author Mark Paluch
* @author Sven Schürmann
* @author Nanne Baars
*/
public interface VaultTransitKey {
@@ -35,6 +36,22 @@ public interface VaultTransitKey {
*/
String getType();
/**
* @return whether the key can be backed up in the plaintext format. Once set, this
* cannot be disabled.
* @since 3.0.3
*/
boolean allowPlaintextBackup();
/**
* @return the version of the convergent nonce to use. Note: since version 3 the
* algorithm used in {@code transit} convergent encryption returns {@code -1} as the
* version is stored with the key. For backwards compatability this field might be
* useful.
* @since 3.0.3
*/
int getConvergentVersion();
/**
* @return {@literal true} if deletion of the key is allowed. Key deletion must be
* turned on to make keys deletable.
@@ -72,47 +89,36 @@ public interface VaultTransitKey {
*/
int getMinEncryptionVersion();
/**
* @return whether the key supports convergent encryption (i.e where the same
* plaintext creates the same ciphertext). Requires {@link #isDerived()} to be set to
* {@code true}.
* @since 3.0.3
*/
boolean supportsConvergentEncryption();
/**
* @return whether the key supports decryption.
* @since 1.1
*/
boolean supportsDecryption();
/**
* @return whether the key supports encryption.
* @since 1.1
*/
boolean supportsEncryption();
/**
* @return whether the key supports derivation.
* @since 1.1
*/
boolean supportsDerivation();
/**
* @return whether the key supports encryption.
* @since 1.1
*/
boolean supportsEncryption();
/**
* @return whether the key supports signing.
* @since 1.1
*/
boolean supportsSigning();
/**
* @return if set, enables taking backup of named key in the plaintext format. Once
* set, this cannot be disabled.
*/
boolean allowPlaintextBackup();
/**
* @return If enabled, the key will support convergent encryption, where the same
* plaintext creates the same ciphertext. This requires 'derived' to be set to true.
*/
boolean supportsConvergentEncryption();
/**
* @return the version of the convergent nonce to use. Note: since version 3 the
* algorithm used in `transit`'s convergent encryption returns -1 since the version is
* stored with the key. For backwards compatability this field might be interesting.
*/
int getConvergentVersion();
}

7
spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java
View File

@@ -166,6 +166,13 @@ public class VaultTransitKeyCreationRequest {
return this;
}
/**
* Configure if the key supports plaintext backups.
* @param allowPlaintextBackup {@literal true} the key supports plaintext backups.
* Defaults to {@literal false}.
* @return {@code this} {@link VaultTransitKeyCreationRequestBuilder}.
* @since 3.0.3
*/
public VaultTransitKeyCreationRequestBuilder allowPlaintextBackup(boolean allowPlaintextBackup) {
this.allowPlaintextBackup = allowPlaintextBackup;