Kyle Isom
64d921827e
Implement a two-level key hierarchy: the MEK now wraps per-engine DEKs stored in a new barrier_keys table, rather than encrypting all barrier entries directly. A v2 ciphertext format (0x02) embeds the key ID so the barrier can resolve which DEK to use on decryption. v1 ciphertext remains supported for backward compatibility. Key changes: - crypto: EncryptV2/DecryptV2/ExtractKeyID for v2 ciphertext with key IDs - barrier: key registry (CreateKey, RotateKey, ListKeys, MigrateToV2, ReWrapKeys) - seal: RotateMEK re-wraps DEKs without re-encrypting data - engine: Mount auto-creates per-engine DEK - REST + gRPC: barrier/keys, barrier/rotate-mek, barrier/rotate-key, barrier/migrate - proto: BarrierService (v1 + v2) with ListKeys, RotateMEK, RotateKey, Migrate - db: migration v2 adds barrier_keys table Also includes: security audit report, CSRF protection, engine design specs (sshca, transit, user), path-bound AAD migration tool, policy engine enhancements, and ARCHITECTURE.md updates. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
45 lines
1.0 KiB
Go
45 lines
1.0 KiB
Go
package db
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestOpenAndMigrate(t *testing.T) {
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "test.db")
|
|
|
|
database, err := Open(path)
|
|
if err != nil {
|
|
t.Fatalf("Open: %v", err)
|
|
}
|
|
defer func() { _ = database.Close() }()
|
|
|
|
if err := Migrate(database); err != nil {
|
|
t.Fatalf("Migrate: %v", err)
|
|
}
|
|
|
|
// Verify tables exist.
|
|
tables := []string{"seal_config", "barrier_entries", "schema_migrations", "barrier_keys"}
|
|
for _, table := range tables {
|
|
var name string
|
|
err := database.QueryRow(
|
|
"SELECT name FROM sqlite_master WHERE type='table' AND name=?", table).Scan(&name)
|
|
if err != nil {
|
|
t.Errorf("table %q not found: %v", table, err)
|
|
}
|
|
}
|
|
|
|
// Migration should be idempotent.
|
|
if err := Migrate(database); err != nil {
|
|
t.Fatalf("second Migrate: %v", err)
|
|
}
|
|
|
|
// Check migration version.
|
|
var version int
|
|
_ = database.QueryRow("SELECT MAX(version) FROM schema_migrations").Scan(&version)
|
|
if version != 2 {
|
|
t.Errorf("migration version: got %d, want 2", version)
|
|
}
|
|
}
|