alien-bindings 3.3.29

Alien direct in-process resource bindings
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131

use super::{encode_context, frame, unframe};
use crate::error::{ErrorData, Result};
use crate::traits::{Binding, Key};
use alien_aws_clients::kms::{DecryptRequest, EncryptRequest, KmsApi};
use alien_error::{Context, IntoAlienError};
use async_trait::async_trait;
use base64::{engine::general_purpose::STANDARD, Engine as _};
use std::collections::BTreeMap;
use std::sync::Arc;

#[derive(Debug)]
pub struct AwsKmsKey {
    client: Arc<dyn KmsApi>,
    key_arn: String,
}

impl AwsKmsKey {
    pub fn new(client: Arc<dyn KmsApi>, key_arn: String) -> Self {
        Self { client, key_arn }
    }
}

impl Binding for AwsKmsKey {}

#[async_trait]
impl Key for AwsKmsKey {
    async fn encrypt(
        &self,
        plaintext: &[u8],
        context: Option<&BTreeMap<String, String>>,
    ) -> Result<Vec<u8>> {
        let canonical = encode_context(context)?;
        let response = self
            .client
            .encrypt(
                EncryptRequest::builder(
                    self.key_arn.clone(),
                    STANDARD.encode(frame(plaintext, &canonical)?),
                )
                .maybe_encryption_context(context.cloned())
                .build(),
            )
            .await
            .context(ErrorData::CloudPlatformError {
                message: "AWS KMS encrypt failed".to_string(),
                resource_id: None,
            })?;
        STANDARD
            .decode(response.ciphertext_blob)
            .into_alien_error()
            .context(ErrorData::CloudPlatformError {
                message: "AWS KMS returned invalid ciphertext encoding".to_string(),
                resource_id: None,
            })
    }

    async fn decrypt(
        &self,
        ciphertext: &[u8],
        context: Option<&BTreeMap<String, String>>,
    ) -> Result<Vec<u8>> {
        let canonical = encode_context(context)?;
        let response = self
            .client
            .decrypt(
                DecryptRequest::builder(self.key_arn.clone(), STANDARD.encode(ciphertext))
                    .maybe_encryption_context(context.cloned())
                    .build(),
            )
            .await
            .context(ErrorData::CloudPlatformError {
                message: "AWS KMS decrypt failed".to_string(),
                resource_id: None,
            })?;
        let framed = STANDARD
            .decode(response.plaintext)
            .into_alien_error()
            .context(ErrorData::KeyCiphertextInvalid {
                reason: "provider plaintext encoding is invalid".to_string(),
            })?;
        unframe(&framed, &canonical)
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use alien_aws_clients::kms::{DecryptResponse, EncryptResponse, MockKmsApi};

    #[tokio::test]
    async fn passes_context_to_kms_and_validates_it_after_decrypt() {
        let context = BTreeMap::from([("tenant".to_string(), "acme".to_string())]);
        let canonical = encode_context(Some(&context)).unwrap();
        let framed = frame(b"root", &canonical).unwrap();
        let expected_context = context.clone();
        let mut client = MockKmsApi::new();
        client
            .expect_encrypt()
            .withf(move |request| {
                request.key_id == "key-arn"
                    && request.encryption_context.as_ref() == Some(&expected_context)
            })
            .returning(|_| {
                Ok(EncryptResponse {
                    ciphertext_blob: STANDARD.encode(b"ciphertext"),
                    key_id: "key-arn".to_string(),
                })
            });
        let decrypt_context = context.clone();
        client
            .expect_decrypt()
            .withf(move |request| {
                request.key_id == "key-arn"
                    && request.ciphertext_blob == STANDARD.encode(b"ciphertext")
                    && request.encryption_context.as_ref() == Some(&decrypt_context)
            })
            .returning(move |_| {
                Ok(DecryptResponse {
                    plaintext: STANDARD.encode(&framed),
                    key_id: "key-arn".to_string(),
                })
            });

        let key = AwsKmsKey::new(Arc::new(client), "key-arn".to_string());
        let ciphertext = key.encrypt(b"root", Some(&context)).await.unwrap();
        assert_eq!(
            key.decrypt(&ciphertext, Some(&context)).await.unwrap(),
            b"root"
        );
    }
}