Add user-to-user encryption engine with ECDH key exchange and AES-256-GCM

Implements the complete user engine for multi-recipient envelope encryption:
- ECDH key agreement (X25519, P-256, P-384) with HKDF-derived wrapping keys
- Per-message random DEK wrapped individually for each recipient
- 9 operations: register, provision, get-public-key, list-users, encrypt,
  decrypt, re-encrypt, rotate-key, delete-user
- Auto-provisioning of sender and recipients on encrypt
- Role-based authorization (admin-only provision/delete, user-only decrypt)
- gRPC UserService with proto definitions and REST API routes
- 16 comprehensive tests covering lifecycle, crypto roundtrips, multi-recipient,
  key rotation, auth enforcement, and algorithm variants

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
2026-03-16 19:44:11 -07:00
parent ac4577f778
commit be3b9d7fe0
10 changed files with 4004 additions and 1 deletions

1109
gen/metacrypt/v2/user.pb.go Normal file

File diff suppressed because it is too large Load Diff

View File

@@ -0,0 +1,451 @@
// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
// versions:
// - protoc-gen-go-grpc v1.6.1
// - protoc v3.20.3
// source: proto/metacrypt/v2/user.proto
package metacryptv2
import (
context "context"
grpc "google.golang.org/grpc"
codes "google.golang.org/grpc/codes"
status "google.golang.org/grpc/status"
)
// This is a compile-time assertion to ensure that this generated file
// is compatible with the grpc package it is being compiled against.
// Requires gRPC-Go v1.64.0 or later.
const _ = grpc.SupportPackageIsVersion9
const (
UserService_Register_FullMethodName = "/metacrypt.v2.UserService/Register"
UserService_Provision_FullMethodName = "/metacrypt.v2.UserService/Provision"
UserService_GetPublicKey_FullMethodName = "/metacrypt.v2.UserService/GetPublicKey"
UserService_ListUsers_FullMethodName = "/metacrypt.v2.UserService/ListUsers"
UserService_Encrypt_FullMethodName = "/metacrypt.v2.UserService/Encrypt"
UserService_Decrypt_FullMethodName = "/metacrypt.v2.UserService/Decrypt"
UserService_ReEncrypt_FullMethodName = "/metacrypt.v2.UserService/ReEncrypt"
UserService_RotateKey_FullMethodName = "/metacrypt.v2.UserService/RotateKey"
UserService_DeleteUser_FullMethodName = "/metacrypt.v2.UserService/DeleteUser"
)
// UserServiceClient is the client API for UserService service.
//
// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
//
// UserService provides typed, authenticated access to user-to-user encryption
// engine operations. All RPCs require the service to be unsealed and
// authentication.
type UserServiceClient interface {
// Register self-registers the caller, creating a keypair. No-op if exists.
Register(ctx context.Context, in *UserRegisterRequest, opts ...grpc.CallOption) (*UserRegisterResponse, error)
// Provision creates a keypair for a given username. Admin only.
Provision(ctx context.Context, in *UserProvisionRequest, opts ...grpc.CallOption) (*UserProvisionResponse, error)
// GetPublicKey returns the public key for a given username.
GetPublicKey(ctx context.Context, in *UserGetPublicKeyRequest, opts ...grpc.CallOption) (*UserGetPublicKeyResponse, error)
// ListUsers returns all registered usernames.
ListUsers(ctx context.Context, in *UserListUsersRequest, opts ...grpc.CallOption) (*UserListUsersResponse, error)
// Encrypt encrypts plaintext for one or more recipients.
Encrypt(ctx context.Context, in *UserEncryptRequest, opts ...grpc.CallOption) (*UserEncryptResponse, error)
// Decrypt decrypts an envelope addressed to the caller.
Decrypt(ctx context.Context, in *UserDecryptRequest, opts ...grpc.CallOption) (*UserDecryptResponse, error)
// ReEncrypt decrypts and re-encrypts an envelope with current keys.
ReEncrypt(ctx context.Context, in *UserReEncryptRequest, opts ...grpc.CallOption) (*UserReEncryptResponse, error)
// RotateKey generates a new keypair for the caller, replacing the old one.
RotateKey(ctx context.Context, in *UserRotateKeyRequest, opts ...grpc.CallOption) (*UserRotateKeyResponse, error)
// DeleteUser removes a user's keys. Admin only.
DeleteUser(ctx context.Context, in *UserDeleteUserRequest, opts ...grpc.CallOption) (*UserDeleteUserResponse, error)
}
type userServiceClient struct {
cc grpc.ClientConnInterface
}
func NewUserServiceClient(cc grpc.ClientConnInterface) UserServiceClient {
return &userServiceClient{cc}
}
func (c *userServiceClient) Register(ctx context.Context, in *UserRegisterRequest, opts ...grpc.CallOption) (*UserRegisterResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UserRegisterResponse)
err := c.cc.Invoke(ctx, UserService_Register_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *userServiceClient) Provision(ctx context.Context, in *UserProvisionRequest, opts ...grpc.CallOption) (*UserProvisionResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UserProvisionResponse)
err := c.cc.Invoke(ctx, UserService_Provision_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *userServiceClient) GetPublicKey(ctx context.Context, in *UserGetPublicKeyRequest, opts ...grpc.CallOption) (*UserGetPublicKeyResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UserGetPublicKeyResponse)
err := c.cc.Invoke(ctx, UserService_GetPublicKey_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *userServiceClient) ListUsers(ctx context.Context, in *UserListUsersRequest, opts ...grpc.CallOption) (*UserListUsersResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UserListUsersResponse)
err := c.cc.Invoke(ctx, UserService_ListUsers_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *userServiceClient) Encrypt(ctx context.Context, in *UserEncryptRequest, opts ...grpc.CallOption) (*UserEncryptResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UserEncryptResponse)
err := c.cc.Invoke(ctx, UserService_Encrypt_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *userServiceClient) Decrypt(ctx context.Context, in *UserDecryptRequest, opts ...grpc.CallOption) (*UserDecryptResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UserDecryptResponse)
err := c.cc.Invoke(ctx, UserService_Decrypt_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *userServiceClient) ReEncrypt(ctx context.Context, in *UserReEncryptRequest, opts ...grpc.CallOption) (*UserReEncryptResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UserReEncryptResponse)
err := c.cc.Invoke(ctx, UserService_ReEncrypt_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *userServiceClient) RotateKey(ctx context.Context, in *UserRotateKeyRequest, opts ...grpc.CallOption) (*UserRotateKeyResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UserRotateKeyResponse)
err := c.cc.Invoke(ctx, UserService_RotateKey_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
func (c *userServiceClient) DeleteUser(ctx context.Context, in *UserDeleteUserRequest, opts ...grpc.CallOption) (*UserDeleteUserResponse, error) {
cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
out := new(UserDeleteUserResponse)
err := c.cc.Invoke(ctx, UserService_DeleteUser_FullMethodName, in, out, cOpts...)
if err != nil {
return nil, err
}
return out, nil
}
// UserServiceServer is the server API for UserService service.
// All implementations must embed UnimplementedUserServiceServer
// for forward compatibility.
//
// UserService provides typed, authenticated access to user-to-user encryption
// engine operations. All RPCs require the service to be unsealed and
// authentication.
type UserServiceServer interface {
// Register self-registers the caller, creating a keypair. No-op if exists.
Register(context.Context, *UserRegisterRequest) (*UserRegisterResponse, error)
// Provision creates a keypair for a given username. Admin only.
Provision(context.Context, *UserProvisionRequest) (*UserProvisionResponse, error)
// GetPublicKey returns the public key for a given username.
GetPublicKey(context.Context, *UserGetPublicKeyRequest) (*UserGetPublicKeyResponse, error)
// ListUsers returns all registered usernames.
ListUsers(context.Context, *UserListUsersRequest) (*UserListUsersResponse, error)
// Encrypt encrypts plaintext for one or more recipients.
Encrypt(context.Context, *UserEncryptRequest) (*UserEncryptResponse, error)
// Decrypt decrypts an envelope addressed to the caller.
Decrypt(context.Context, *UserDecryptRequest) (*UserDecryptResponse, error)
// ReEncrypt decrypts and re-encrypts an envelope with current keys.
ReEncrypt(context.Context, *UserReEncryptRequest) (*UserReEncryptResponse, error)
// RotateKey generates a new keypair for the caller, replacing the old one.
RotateKey(context.Context, *UserRotateKeyRequest) (*UserRotateKeyResponse, error)
// DeleteUser removes a user's keys. Admin only.
DeleteUser(context.Context, *UserDeleteUserRequest) (*UserDeleteUserResponse, error)
mustEmbedUnimplementedUserServiceServer()
}
// UnimplementedUserServiceServer must be embedded to have
// forward compatible implementations.
//
// NOTE: this should be embedded by value instead of pointer to avoid a nil
// pointer dereference when methods are called.
type UnimplementedUserServiceServer struct{}
func (UnimplementedUserServiceServer) Register(context.Context, *UserRegisterRequest) (*UserRegisterResponse, error) {
return nil, status.Error(codes.Unimplemented, "method Register not implemented")
}
func (UnimplementedUserServiceServer) Provision(context.Context, *UserProvisionRequest) (*UserProvisionResponse, error) {
return nil, status.Error(codes.Unimplemented, "method Provision not implemented")
}
func (UnimplementedUserServiceServer) GetPublicKey(context.Context, *UserGetPublicKeyRequest) (*UserGetPublicKeyResponse, error) {
return nil, status.Error(codes.Unimplemented, "method GetPublicKey not implemented")
}
func (UnimplementedUserServiceServer) ListUsers(context.Context, *UserListUsersRequest) (*UserListUsersResponse, error) {
return nil, status.Error(codes.Unimplemented, "method ListUsers not implemented")
}
func (UnimplementedUserServiceServer) Encrypt(context.Context, *UserEncryptRequest) (*UserEncryptResponse, error) {
return nil, status.Error(codes.Unimplemented, "method Encrypt not implemented")
}
func (UnimplementedUserServiceServer) Decrypt(context.Context, *UserDecryptRequest) (*UserDecryptResponse, error) {
return nil, status.Error(codes.Unimplemented, "method Decrypt not implemented")
}
func (UnimplementedUserServiceServer) ReEncrypt(context.Context, *UserReEncryptRequest) (*UserReEncryptResponse, error) {
return nil, status.Error(codes.Unimplemented, "method ReEncrypt not implemented")
}
func (UnimplementedUserServiceServer) RotateKey(context.Context, *UserRotateKeyRequest) (*UserRotateKeyResponse, error) {
return nil, status.Error(codes.Unimplemented, "method RotateKey not implemented")
}
func (UnimplementedUserServiceServer) DeleteUser(context.Context, *UserDeleteUserRequest) (*UserDeleteUserResponse, error) {
return nil, status.Error(codes.Unimplemented, "method DeleteUser not implemented")
}
func (UnimplementedUserServiceServer) mustEmbedUnimplementedUserServiceServer() {}
func (UnimplementedUserServiceServer) testEmbeddedByValue() {}
// UnsafeUserServiceServer may be embedded to opt out of forward compatibility for this service.
// Use of this interface is not recommended, as added methods to UserServiceServer will
// result in compilation errors.
type UnsafeUserServiceServer interface {
mustEmbedUnimplementedUserServiceServer()
}
func RegisterUserServiceServer(s grpc.ServiceRegistrar, srv UserServiceServer) {
// If the following call panics, it indicates UnimplementedUserServiceServer was
// embedded by pointer and is nil. This will cause panics if an
// unimplemented method is ever invoked, so we test this at initialization
// time to prevent it from happening at runtime later due to I/O.
if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
t.testEmbeddedByValue()
}
s.RegisterService(&UserService_ServiceDesc, srv)
}
func _UserService_Register_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UserRegisterRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(UserServiceServer).Register(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: UserService_Register_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(UserServiceServer).Register(ctx, req.(*UserRegisterRequest))
}
return interceptor(ctx, in, info, handler)
}
func _UserService_Provision_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UserProvisionRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(UserServiceServer).Provision(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: UserService_Provision_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(UserServiceServer).Provision(ctx, req.(*UserProvisionRequest))
}
return interceptor(ctx, in, info, handler)
}
func _UserService_GetPublicKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UserGetPublicKeyRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(UserServiceServer).GetPublicKey(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: UserService_GetPublicKey_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(UserServiceServer).GetPublicKey(ctx, req.(*UserGetPublicKeyRequest))
}
return interceptor(ctx, in, info, handler)
}
func _UserService_ListUsers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UserListUsersRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(UserServiceServer).ListUsers(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: UserService_ListUsers_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(UserServiceServer).ListUsers(ctx, req.(*UserListUsersRequest))
}
return interceptor(ctx, in, info, handler)
}
func _UserService_Encrypt_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UserEncryptRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(UserServiceServer).Encrypt(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: UserService_Encrypt_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(UserServiceServer).Encrypt(ctx, req.(*UserEncryptRequest))
}
return interceptor(ctx, in, info, handler)
}
func _UserService_Decrypt_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UserDecryptRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(UserServiceServer).Decrypt(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: UserService_Decrypt_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(UserServiceServer).Decrypt(ctx, req.(*UserDecryptRequest))
}
return interceptor(ctx, in, info, handler)
}
func _UserService_ReEncrypt_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UserReEncryptRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(UserServiceServer).ReEncrypt(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: UserService_ReEncrypt_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(UserServiceServer).ReEncrypt(ctx, req.(*UserReEncryptRequest))
}
return interceptor(ctx, in, info, handler)
}
func _UserService_RotateKey_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UserRotateKeyRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(UserServiceServer).RotateKey(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: UserService_RotateKey_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(UserServiceServer).RotateKey(ctx, req.(*UserRotateKeyRequest))
}
return interceptor(ctx, in, info, handler)
}
func _UserService_DeleteUser_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
in := new(UserDeleteUserRequest)
if err := dec(in); err != nil {
return nil, err
}
if interceptor == nil {
return srv.(UserServiceServer).DeleteUser(ctx, in)
}
info := &grpc.UnaryServerInfo{
Server: srv,
FullMethod: UserService_DeleteUser_FullMethodName,
}
handler := func(ctx context.Context, req interface{}) (interface{}, error) {
return srv.(UserServiceServer).DeleteUser(ctx, req.(*UserDeleteUserRequest))
}
return interceptor(ctx, in, info, handler)
}
// UserService_ServiceDesc is the grpc.ServiceDesc for UserService service.
// It's only intended for direct use with grpc.RegisterService,
// and not to be introspected or modified (even as a copy)
var UserService_ServiceDesc = grpc.ServiceDesc{
ServiceName: "metacrypt.v2.UserService",
HandlerType: (*UserServiceServer)(nil),
Methods: []grpc.MethodDesc{
{
MethodName: "Register",
Handler: _UserService_Register_Handler,
},
{
MethodName: "Provision",
Handler: _UserService_Provision_Handler,
},
{
MethodName: "GetPublicKey",
Handler: _UserService_GetPublicKey_Handler,
},
{
MethodName: "ListUsers",
Handler: _UserService_ListUsers_Handler,
},
{
MethodName: "Encrypt",
Handler: _UserService_Encrypt_Handler,
},
{
MethodName: "Decrypt",
Handler: _UserService_Decrypt_Handler,
},
{
MethodName: "ReEncrypt",
Handler: _UserService_ReEncrypt_Handler,
},
{
MethodName: "RotateKey",
Handler: _UserService_RotateKey_Handler,
},
{
MethodName: "DeleteUser",
Handler: _UserService_DeleteUser_Handler,
},
},
Streams: []grpc.StreamDesc{},
Metadata: "proto/metacrypt/v2/user.proto",
}