-
Notifications
You must be signed in to change notification settings - Fork 23
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(prism-agent): introduce generic secret store for CD (#727)
Signed-off-by: Pat Losoponkul <[email protected]>
- Loading branch information
patlo-iog
authored
Sep 20, 2023
1 parent
2c5bc51
commit 3d4aacd
Showing
27 changed files
with
536 additions
and
174 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
15 changes: 15 additions & 0 deletions
15
prism-agent/service/wallet-api/src/main/resources/sql/agent/V12__generic_secret.sql
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| ALTER TABLE public.peer_did_rand_key DROP COLUMN "schema_id"; | ||
|
|
||
| CREATE TABLE public.generic_secret ( | ||
| "key" TEXT NOT NULL, | ||
| "payload" TEXT NOT NULL, | ||
| "created_at" TIMESTAMP WITH TIME ZONE NOT NULL, | ||
| "wallet_id" UUID REFERENCES public.wallet ("wallet_id") NOT NULL, | ||
| CONSTRAINT unique_key_wallet UNIQUE ("key", "wallet_id") | ||
| ); | ||
|
|
||
| ALTER TABLE public.generic_secret ENABLE ROW LEVEL SECURITY; | ||
|
|
||
| CREATE POLICY generic_secret_wallet_isolation | ||
| ON public.generic_secret | ||
| USING (wallet_id = current_setting('app.current_wallet_id')::UUID); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
60 changes: 60 additions & 0 deletions
60
...pi/src/main/scala/io/iohk/atala/agent/walletapi/memory/GenericSecretStorageInMemory.scala
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| package io.iohk.atala.agent.walletapi.memory | ||
|
|
||
| import io.iohk.atala.agent.walletapi.storage.GenericSecret | ||
| import io.iohk.atala.agent.walletapi.storage.GenericSecretStorage | ||
| import io.iohk.atala.shared.models.WalletAccessContext | ||
| import io.iohk.atala.shared.models.WalletId | ||
| import zio.* | ||
| import zio.json.ast.Json | ||
|
|
||
| class GenericSecretStorageInMemory(walletRefs: Ref[Map[WalletId, Ref[Map[String, Json]]]]) | ||
| extends GenericSecretStorage { | ||
|
|
||
| private def walletStoreRef: URIO[WalletAccessContext, Ref[Map[String, Json]]] = | ||
| for { | ||
| walletId <- ZIO.serviceWith[WalletAccessContext](_.walletId) | ||
| refs <- walletRefs.get | ||
| maybeWalletRef = refs.get(walletId) | ||
| walletRef <- maybeWalletRef | ||
| .fold { | ||
| for { | ||
| ref <- Ref.make(Map.empty[String, Json]) | ||
| _ <- walletRefs.set(refs.updated(walletId, ref)) | ||
| } yield ref | ||
| }(ZIO.succeed) | ||
| } yield walletRef | ||
|
|
||
| override def set[K, V](key: K, secret: V)(implicit ev: GenericSecret[K, V]): RIO[WalletAccessContext, Unit] = { | ||
| for { | ||
| storeRef <- walletStoreRef | ||
| _ <- storeRef.modify { store => | ||
| val keyPath = ev.keyPath(key) | ||
| if (store.contains(keyPath)) | ||
| ( | ||
| ZIO.fail(Exception(s"Unique constaint violation, key $key already exists.")), | ||
| store | ||
| ) | ||
| else (ZIO.unit, store.updated(keyPath, ev.encodeValue(secret))) | ||
| }.flatten | ||
| } yield () | ||
| } | ||
|
|
||
| override def get[K, V](key: K)(implicit ev: GenericSecret[K, V]): RIO[WalletAccessContext, Option[V]] = { | ||
| val keyPath = ev.keyPath(key) | ||
| for { | ||
| storeRef <- walletStoreRef | ||
| json <- storeRef.get.map(_.get(keyPath)) | ||
| result <- json.fold(ZIO.none)(json => ZIO.fromTry(ev.decodeValue(json)).asSome) | ||
| } yield result | ||
| } | ||
|
|
||
| } | ||
|
|
||
| object GenericSecretStorageInMemory { | ||
| val layer: ULayer[GenericSecretStorage] = | ||
| ZLayer.fromZIO( | ||
| Ref | ||
| .make(Map.empty[WalletId, Ref[Map[String, Json]]]) | ||
| .map(GenericSecretStorageInMemory(_)) | ||
| ) | ||
| } |
Oops, something went wrong.