alien-bindings 3.3.28

Alien direct in-process resource bindings
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

use super::{encode_context, frame, unframe};
use crate::error::{ErrorData, Result};
use crate::traits::{Binding, Key};
use alien_azure_clients::keyvault::{KeyOperationRequest, KeyVaultKeysApi};
use alien_error::{Context, IntoAlienError};
use async_trait::async_trait;
use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
use std::collections::BTreeMap;
use std::sync::Arc;

#[derive(Debug)]
pub struct AzureKeyVaultKey {
    client: Arc<dyn KeyVaultKeysApi>,
    key_id: String,
}

impl AzureKeyVaultKey {
    pub fn new(client: Arc<dyn KeyVaultKeysApi>, key_id: String) -> Self {
        Self { client, key_id }
    }
}

impl Binding for AzureKeyVaultKey {}

#[async_trait]
impl Key for AzureKeyVaultKey {
    async fn encrypt(
        &self,
        plaintext: &[u8],
        context: Option<&BTreeMap<String, String>>,
    ) -> Result<Vec<u8>> {
        let canonical = encode_context(context)?;
        let response = self
            .client
            .encrypt(
                &self.key_id,
                KeyOperationRequest {
                    alg: "RSA-OAEP-256".to_string(),
                    value: URL_SAFE_NO_PAD.encode(frame(plaintext, &canonical)?),
                },
            )
            .await
            .context(ErrorData::CloudPlatformError {
                message: "Azure Key Vault encrypt failed".to_string(),
                resource_id: None,
            })?;
        URL_SAFE_NO_PAD
            .decode(response.value)
            .into_alien_error()
            .context(ErrorData::CloudPlatformError {
                message: "Azure Key Vault returned invalid ciphertext encoding".to_string(),
                resource_id: None,
            })
    }

    async fn decrypt(
        &self,
        ciphertext: &[u8],
        context: Option<&BTreeMap<String, String>>,
    ) -> Result<Vec<u8>> {
        let canonical = encode_context(context)?;
        let response = self
            .client
            .decrypt(
                &self.key_id,
                KeyOperationRequest {
                    alg: "RSA-OAEP-256".to_string(),
                    value: URL_SAFE_NO_PAD.encode(ciphertext),
                },
            )
            .await
            .context(ErrorData::CloudPlatformError {
                message: "Azure Key Vault decrypt failed".to_string(),
                resource_id: None,
            })?;
        let framed = URL_SAFE_NO_PAD
            .decode(response.value)
            .into_alien_error()
            .context(ErrorData::KeyCiphertextInvalid {
                reason: "provider plaintext encoding is invalid".to_string(),
            })?;
        unframe(&framed, &canonical)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use alien_azure_clients::keyvault::{KeyOperationResponse, MockKeyVaultKeysApi};

    #[tokio::test]
    async fn binds_context_inside_the_portable_frame() {
        let context = BTreeMap::from([("tenant".to_string(), "acme".to_string())]);
        let canonical = encode_context(Some(&context)).unwrap();
        let framed = frame(b"root", &canonical).unwrap();
        let mut client = MockKeyVaultKeysApi::new();
        client.expect_encrypt().returning(|key_id, request| {
            assert_eq!(key_id, "versioned-key-id");
            assert_eq!(request.alg, "RSA-OAEP-256");
            Ok(KeyOperationResponse {
                kid: key_id.to_string(),
                value: URL_SAFE_NO_PAD.encode(b"ciphertext"),
            })
        });
        client
            .expect_decrypt()
            .times(2)
            .returning(move |key_id, request| {
                assert_eq!(key_id, "versioned-key-id");
                assert_eq!(request.alg, "RSA-OAEP-256");
                Ok(KeyOperationResponse {
                    kid: key_id.to_string(),
                    value: URL_SAFE_NO_PAD.encode(&framed),
                })
            });

        let key = AzureKeyVaultKey::new(Arc::new(client), "versioned-key-id".to_string());
        let ciphertext = key.encrypt(b"root", Some(&context)).await.unwrap();
        assert_eq!(
            key.decrypt(&ciphertext, Some(&context)).await.unwrap(),
            b"root"
        );
        assert!(key.decrypt(&ciphertext, None).await.is_err());
    }
}