f3911cce66
* Rename path_config -> path_keys_config Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add config/keys to disable upserting Transit would allow anyone with Create permissions on the encryption endpoint to automatically create new encryption keys. This becomes hard to reason about for operators, especially if typos are subtly introduced (e.g., my-key vs my_key) -- there is no way to merge these two keys afterwards. Add the ability to globally disable upserting, so that if the applications using Transit do not need the capability, it can be globally disallowed even under permissive policies. Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add documentation on disabling upsert Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Add changelog entry Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> * Update website/content/api-docs/secret/transit.mdx Co-authored-by: tjperry07 <tjperry07@users.noreply.github.com> * Update website/content/api-docs/secret/transit.mdx Co-authored-by: tjperry07 <tjperry07@users.noreply.github.com> Signed-off-by: Alexander Scheel <alex.scheel@hashicorp.com> Co-authored-by: tjperry07 <tjperry07@users.noreply.github.com>
68 lines
1.5 KiB
Go
68 lines
1.5 KiB
Go
package transit
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/vault/sdk/logical"
|
|
)
|
|
|
|
func TestTransit_ConfigKeys(t *testing.T) {
|
|
b, s := createBackendWithSysView(t)
|
|
|
|
doReq := func(req *logical.Request) *logical.Response {
|
|
resp, err := b.HandleRequest(context.Background(), req)
|
|
if err != nil || (resp != nil && resp.IsError()) {
|
|
t.Fatalf("got err:\n%#v\nreq:\n%#v\n", err, *req)
|
|
}
|
|
return resp
|
|
}
|
|
doErrReq := func(req *logical.Request) {
|
|
resp, err := b.HandleRequest(context.Background(), req)
|
|
if err == nil {
|
|
if resp == nil || !resp.IsError() {
|
|
t.Fatalf("expected error; req:\n%#v\n", *req)
|
|
}
|
|
}
|
|
}
|
|
|
|
// First read the global config
|
|
req := &logical.Request{
|
|
Storage: s,
|
|
Operation: logical.ReadOperation,
|
|
Path: "config/keys",
|
|
}
|
|
resp := doReq(req)
|
|
if resp.Data["disable_upsert"].(bool) != false {
|
|
t.Fatalf("expected disable_upsert to be false; got: %v", resp)
|
|
}
|
|
|
|
// Ensure we can upsert.
|
|
req.Operation = logical.CreateOperation
|
|
req.Path = "encrypt/upsert-1"
|
|
req.Data = map[string]interface{}{
|
|
"plaintext": "aGVsbG8K",
|
|
}
|
|
doReq(req)
|
|
|
|
// Disable upserting.
|
|
req.Operation = logical.UpdateOperation
|
|
req.Path = "config/keys"
|
|
req.Data = map[string]interface{}{
|
|
"disable_upsert": true,
|
|
}
|
|
doReq(req)
|
|
|
|
// Attempt upserting again, it should fail.
|
|
req.Operation = logical.CreateOperation
|
|
req.Path = "encrypt/upsert-2"
|
|
req.Data = map[string]interface{}{
|
|
"plaintext": "aGVsbG8K",
|
|
}
|
|
doErrReq(req)
|
|
|
|
// Redoing this with the first key should succeed.
|
|
req.Path = "encrypt/upsert-1"
|
|
doReq(req)
|
|
}
|