Kyle Isom
bbe382dc10
All import paths updated to git.wntrmute.dev/mc/. Bumps mcdsl to v1.2.0. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
86 lines
2.7 KiB
Go
86 lines
2.7 KiB
Go
package grpcserver
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
|
|
"google.golang.org/grpc/codes"
|
|
"google.golang.org/grpc/status"
|
|
|
|
pb "git.wntrmute.dev/mc/metacrypt/gen/metacrypt/v2"
|
|
"git.wntrmute.dev/mc/metacrypt/internal/barrier"
|
|
"git.wntrmute.dev/mc/metacrypt/internal/seal"
|
|
)
|
|
|
|
type barrierServer struct {
|
|
pb.UnimplementedBarrierServiceServer
|
|
s *GRPCServer
|
|
}
|
|
|
|
func (bs *barrierServer) ListKeys(ctx context.Context, _ *pb.ListKeysRequest) (*pb.ListKeysResponse, error) {
|
|
keys, err := bs.s.sealMgr.Barrier().ListKeys(ctx)
|
|
if err != nil {
|
|
bs.s.logger.Error("grpc: list barrier keys", "error", err)
|
|
return nil, status.Error(codes.Internal, "failed to list keys")
|
|
}
|
|
|
|
resp := &pb.ListKeysResponse{}
|
|
for _, k := range keys {
|
|
resp.Keys = append(resp.Keys, &pb.BarrierKeyInfo{
|
|
KeyId: k.KeyID,
|
|
Version: int32(k.Version),
|
|
CreatedAt: k.CreatedAt,
|
|
RotatedAt: k.RotatedAt,
|
|
})
|
|
}
|
|
return resp, nil
|
|
}
|
|
|
|
func (bs *barrierServer) RotateMEK(ctx context.Context, req *pb.RotateMEKRequest) (*pb.RotateMEKResponse, error) {
|
|
if req.Password == "" {
|
|
return nil, status.Error(codes.InvalidArgument, "password is required")
|
|
}
|
|
|
|
if err := bs.s.sealMgr.RotateMEK(ctx, []byte(req.Password)); err != nil {
|
|
if errors.Is(err, seal.ErrInvalidPassword) {
|
|
return nil, status.Error(codes.Unauthenticated, "invalid password")
|
|
}
|
|
if errors.Is(err, seal.ErrSealed) {
|
|
return nil, status.Error(codes.FailedPrecondition, "sealed")
|
|
}
|
|
bs.s.logger.Error("grpc: rotate MEK", "error", err)
|
|
return nil, status.Error(codes.Internal, "rotation failed")
|
|
}
|
|
|
|
bs.s.logger.Info("audit: MEK rotated")
|
|
return &pb.RotateMEKResponse{Ok: true}, nil
|
|
}
|
|
|
|
func (bs *barrierServer) RotateKey(ctx context.Context, req *pb.RotateKeyRequest) (*pb.RotateKeyResponse, error) {
|
|
if req.KeyId == "" {
|
|
return nil, status.Error(codes.InvalidArgument, "key_id is required")
|
|
}
|
|
|
|
if err := bs.s.sealMgr.Barrier().RotateKey(ctx, req.KeyId); err != nil {
|
|
if errors.Is(err, barrier.ErrKeyNotFound) {
|
|
return nil, status.Error(codes.NotFound, "key not found")
|
|
}
|
|
bs.s.logger.Error("grpc: rotate key", "key_id", req.KeyId, "error", err)
|
|
return nil, status.Error(codes.Internal, "rotation failed")
|
|
}
|
|
|
|
bs.s.logger.Info("audit: DEK rotated", "key_id", req.KeyId)
|
|
return &pb.RotateKeyResponse{Ok: true}, nil
|
|
}
|
|
|
|
func (bs *barrierServer) Migrate(ctx context.Context, _ *pb.MigrateBarrierRequest) (*pb.MigrateBarrierResponse, error) {
|
|
migrated, err := bs.s.sealMgr.Barrier().MigrateToV2(ctx)
|
|
if err != nil {
|
|
bs.s.logger.Error("grpc: barrier migration", "error", err)
|
|
return nil, status.Error(codes.Internal, "migration failed")
|
|
}
|
|
|
|
bs.s.logger.Info("audit: barrier migrated to v2", "entries_migrated", migrated)
|
|
return &pb.MigrateBarrierResponse{Migrated: int32(migrated)}, nil
|
|
}
|