cosmian_kms_cli 5.20.0

Command Line Interface used to manage the KMS server If any assistance is needed, please either visit the Cosmian technical documentation at https://docs.cosmian.com or contact the Cosmian support team on Discord https://discord.com/invite/7kPMNtHpnz
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103

use std::path::PathBuf;

use test_kms_server::start_default_test_kms_server;

use crate::{
    actions::kms::cover_crypt::keys::{
        create_key_pair::CreateMasterKeyPairAction, create_user_key::CreateUserKeyAction,
    },
    error::result::KmsCliResult,
};

#[tokio::test]
pub(crate) async fn test_user_decryption_key() -> KmsCliResult<()> {
    let ctx = start_default_test_kms_server().await;

    // generate a new master key pair
    let (master_secret_key_id, _) = {
        let action = CreateMasterKeyPairAction {
            specification: PathBuf::from("../../test_data/access_structure_specifications.json"),
            tags: vec![],
            sensitive: false,
            wrapping_key_id: None,
        };
        let key_ids = Box::pin(action.run(ctx.get_owner_client())).await?;
        (key_ids.0.to_string(), key_ids.1.to_string())
    };

    // and a user key
    let user_key_id = CreateUserKeyAction {
        master_secret_key_id: master_secret_key_id.clone(),
        access_policy: "(Department::MKG || Department::FIN) && Security Level::Top Secret"
            .to_string(),
        tags: vec![],
        sensitive: false,
        wrapping_key_id: None,
    }
    .run(ctx.get_owner_client())
    .await?
    .to_string();
    assert!(!user_key_id.is_empty());

    Ok(())
}

#[tokio::test]
pub(crate) async fn test_user_decryption_key_error() -> KmsCliResult<()> {
    let ctx = start_default_test_kms_server().await;

    // generate a new master key pair
    let (master_secret_key_id, _) = {
        let action = CreateMasterKeyPairAction {
            specification: PathBuf::from("../../test_data/access_structure_specifications.json"),
            tags: vec![],
            sensitive: false,
            wrapping_key_id: None,
        };
        let key_ids = Box::pin(action.run(ctx.get_owner_client())).await?;
        (key_ids.0.to_string(), key_ids.1.to_string())
    };

    // bad attributes
    let err = CreateUserKeyAction {
        master_secret_key_id: master_secret_key_id.clone(),
        access_policy: "(Department::MKG || Department::FIN) && Security Level::Top SecretZZZZZZ"
            .to_string(),
        tags: vec![],
        sensitive: false,
        wrapping_key_id: None,
    }
    .run(ctx.get_owner_client())
    .await
    .err()
    .unwrap();
    assert!(
        err.to_string().contains("REST Response Conversion Failed")
            || err
                .to_string()
                .contains("attribute not found: Top SecretZZZZZZ")
    );

    // bad master secret key
    let err = CreateUserKeyAction {
        master_secret_key_id: "BAD_KEY".to_string(),
        access_policy: "(Department::MKG || Department::FIN) && Security Level::Top SecretZZZZZZ"
            .to_string(),
        tags: vec![],
        sensitive: false,
        wrapping_key_id: None,
    }
    .run(ctx.get_owner_client())
    .await
    .err()
    .unwrap();
    // Both cases currently return REST deserialization errors
    assert!(
        err.to_string().contains("REST Response Conversion Failed")
            || err
                .to_string()
                .contains("no Covercrypt master secret key found for: BAD_KEY")
            || err.to_string().contains("Object not found")
    );
    Ok(())
}