Appwrite/appwrite
1
0
Fork 0
mirror of https://github.com/appwrite/appwrite.git synced 2026-05-26 13:51:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

master encryption filter for project

Browse Source
This commit is contained in:
Damodar Lohani
2022-07-20 07:21:28 +00:00
parent 636a46dfe2
commit c55fe632dc
3 changed files with 23 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/config/collections.php
+2 -32
View File
@@ -741,29 +741,7 @@ $collections = [
'name' => 'Secrets',
'attributes' => [
[
'$id' => 'projectInternalId',
'type' => Database::VAR_STRING,
'format' => '',
'size' => Database::LENGTH_KEY,
'signed' => true,
'required' => false,
'default' => null,
'array' => false,
'filters' => [],
],
[
'$id' => 'projectId',
'type' => Database::VAR_STRING,
'format' => '',
'size' => Database::LENGTH_KEY,
'signed' => true,
'required' => false,
'default' => 0,
'array' => false,
'filters' => [],
],
[
'$id' => 'secrets',
'$id' => 'secret',
'type' => Database::VAR_STRING,
'format' => '',
'size' => 16384,
@@ -774,15 +752,7 @@ $collections = [
'filters' => [],
],
],
'indexes' => [
[
'$id' => '_key_project',
'type' => Database::INDEX_KEY,
'attributes' => ['projectInternalId'],
'lengths' => [Database::LENGTH_KEY],
'orders' => [Database::ORDER_ASC],
],
],
'indexes' => [],
],
'platforms' => [
app/controllers/api/projects.php
+18
View File
@@ -84,6 +84,23 @@ App::post('/v1/projects')
throw new Exception("'console' is a reserved project.", 400, Exception::PROJECT_RESERVED_PROJECT);
}
$secret = Authorization::skip(fn() => $dbForConsole->createDocument('secrets', new Document([
'$id' => $dbForConsole->getId(),
'$read' => [],
'$write' => [],
'$collection' => 'secrets',
'secret' => OpenSSL::secretString(),
])));
// create new secret for the project
// project should save keyId
// need setFilter to set instance level filter in dbforconsole
// saving keyId in project doesn't make sense, as we only need the secret to
// read and write the project document
// The problem is we need to know the projectId to set the filter
// but when we get dbForConsole we will never know the project id to work with
$project = $dbForConsole->createDocument('projects', new Document([
'$id' => $projectId,
'$read' => ['team:' . $teamId],
@@ -92,6 +109,7 @@ App::post('/v1/projects')
'teamInternalId' => $team->getInternalId(),
'teamId' => $team->getId(),
'description' => $description,
'keyId' => $secret->getId(),
'logo' => $logo,
'url' => $url,
'version' => APP_VERSION_STABLE,
app/init.php
+3 -3
View File
@@ -380,9 +380,9 @@ Database::addFilter(
Database::addFilter(
'masterEncrypt',
function(mixed $value, Document $document, Database $database) {
$keyId = $document->getAttribute('masterKeyId', '');
$keyId = $document->getAttribute('keyId', '');
$database->setNamespace('_console');
$key = $database->getDocument('secrets', $keyId);
$key = Authorization::skip(fn() => $database->getDocument('secrets', $keyId));
if($key->isEmpty()) {
throw new Exception("Unable to find master key with ID ($keyId} to encrypt.");
}
@@ -405,7 +405,7 @@ Database::addFilter(
$value = json_decode($value, true);
$keyId = $value['version'];
$database->setNamespace('_console');
$key = $database->getDocument('secrets', $keyId);
$key = Authorization::skip(fn() => $database->getDocument('secrets', $keyId));
if($key->isEmpty()) {
throw new Exception("Unable to find master key with ID {$keyId} to decrypt.");
}