Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit383c718

Browse files
johnstcnkylecarbs
andcommitted
feat(coderd): add dbcrypt package
This commit builds upon the previous work in#7959:- Moved dbcrypt package to enterprise/dbcrypt- Modified original dbcrypt behaviour to not delete un-decryptable rows.- Added a table dbcrypt_sentinel used to determine database encryption statusNOTE: This is part 1 of a 2-part PR. This PR focusesmainly on the dbcrypt and database packages. A separatePR will add the required plumbing to integrate this intoenterprise/coderd properly.Co-authored-by: Kyle Carberry <kyle@coder.com>
1 parent16ef97a commit383c718

20 files changed

+1152
-2
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -828,6 +828,13 @@ func (q *querier) GetAuthorizationUserRoles(ctx context.Context, userID uuid.UUI
828828
returnq.db.GetAuthorizationUserRoles(ctx,userID)
829829
}
830830

831+
func (q*querier)GetDBCryptSentinelValue(ctx context.Context) (string,error) {
832+
iferr:=q.authorizeContext(ctx,rbac.ActionRead,rbac.ResourceSystem);err!=nil {
833+
return"",err
834+
}
835+
returnq.db.GetDBCryptSentinelValue(ctx)
836+
}
837+
831838
func (q*querier)GetDERPMeshKey(ctx context.Context) (string,error) {
832839
iferr:=q.authorizeContext(ctx,rbac.ActionRead,rbac.ResourceSystem);err!=nil {
833840
return"",err
@@ -904,6 +911,13 @@ func (q *querier) GetGitAuthLink(ctx context.Context, arg database.GetGitAuthLin
904911
returnfetch(q.log,q.auth,q.db.GetGitAuthLink)(ctx,arg)
905912
}
906913

914+
func (q*querier)GetGitAuthLinksByUserID(ctx context.Context,userID uuid.UUID) ([]database.GitAuthLink,error) {
915+
iferr:=q.authorizeContext(ctx,rbac.ActionRead,rbac.ResourceSystem);err!=nil {
916+
returnnil,err
917+
}
918+
returnq.db.GetGitAuthLinksByUserID(ctx,userID)
919+
}
920+
907921
func (q*querier)GetGitSSHKey(ctx context.Context,userID uuid.UUID) (database.GitSSHKey,error) {
908922
returnfetch(q.log,q.auth,q.db.GetGitSSHKey)(ctx,userID)
909923
}
@@ -1472,6 +1486,13 @@ func (q *querier) GetUserLinkByUserIDLoginType(ctx context.Context, arg database
14721486
returnq.db.GetUserLinkByUserIDLoginType(ctx,arg)
14731487
}
14741488

1489+
func (q*querier)GetUserLinksByUserID(ctx context.Context,userID uuid.UUID) ([]database.UserLink,error) {
1490+
iferr:=q.authorizeContext(ctx,rbac.ActionRead,rbac.ResourceSystem);err!=nil {
1491+
returnnil,err
1492+
}
1493+
returnq.db.GetUserLinksByUserID(ctx,userID)
1494+
}
1495+
14751496
func (q*querier)GetUsers(ctx context.Context,arg database.GetUsersParams) ([]database.GetUsersRow,error) {
14761497
// This does the filtering in SQL.
14771498
prep,err:=prepareSQLFilter(ctx,q.auth,rbac.ActionRead,rbac.ResourceUser.Type)
@@ -2134,6 +2155,13 @@ func (q *querier) RegisterWorkspaceProxy(ctx context.Context, arg database.Regis
21342155
returnupdateWithReturn(q.log,q.auth,fetch,q.db.RegisterWorkspaceProxy)(ctx,arg)
21352156
}
21362157

2158+
func (q*querier)SetDBCryptSentinelValue(ctx context.Context,valuestring)error {
2159+
iferr:=q.authorizeContext(ctx,rbac.ActionUpdate,rbac.ResourceSystem);err!=nil {
2160+
returnerr
2161+
}
2162+
returnq.db.SetDBCryptSentinelValue(ctx,value)
2163+
}
2164+
21372165
func (q*querier)TryAcquireLock(ctx context.Context,idint64) (bool,error) {
21382166
returnq.db.TryAcquireLock(ctx,id)
21392167
}

‎coderd/database/dbfake/dbfake.go

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ func New() database.Store {
4444
organizationMembers:make([]database.OrganizationMember,0),
4545
organizations:make([]database.Organization,0),
4646
users:make([]database.User,0),
47+
dbcryptSentinelValue:nil,
4748
gitAuthLinks:make([]database.GitAuthLink,0),
4849
groups:make([]database.Group,0),
4950
groupMembers:make([]database.GroupMember,0),
@@ -116,6 +117,7 @@ type data struct {
116117
// New tables
117118
workspaceAgentStats []database.WorkspaceAgentStat
118119
auditLogs []database.AuditLog
120+
dbcryptSentinelValue*string
119121
files []database.File
120122
gitAuthLinks []database.GitAuthLink
121123
gitSSHKey []database.GitSSHKey
@@ -1150,6 +1152,15 @@ func (q *FakeQuerier) GetAuthorizationUserRoles(_ context.Context, userID uuid.U
11501152
},nil
11511153
}
11521154

1155+
func (q*FakeQuerier)GetDBCryptSentinelValue(_ context.Context) (string,error) {
1156+
q.mutex.RLock()
1157+
deferq.mutex.RUnlock()
1158+
ifq.dbcryptSentinelValue==nil {
1159+
return"",sql.ErrNoRows
1160+
}
1161+
return*q.dbcryptSentinelValue,nil
1162+
}
1163+
11531164
func (q*FakeQuerier)GetDERPMeshKey(_ context.Context) (string,error) {
11541165
q.mutex.RLock()
11551166
deferq.mutex.RUnlock()
@@ -1392,6 +1403,18 @@ func (q *FakeQuerier) GetGitAuthLink(_ context.Context, arg database.GetGitAuthL
13921403
return database.GitAuthLink{},sql.ErrNoRows
13931404
}
13941405

1406+
func (q*FakeQuerier)GetGitAuthLinksByUserID(_ context.Context,userID uuid.UUID) ([]database.GitAuthLink,error) {
1407+
q.mutex.RLock()
1408+
deferq.mutex.RUnlock()
1409+
gals:=make([]database.GitAuthLink,0)
1410+
for_,gal:=rangeq.gitAuthLinks {
1411+
ifgal.UserID==userID {
1412+
gals=append(gals,gal)
1413+
}
1414+
}
1415+
returngals,nil
1416+
}
1417+
13951418
func (q*FakeQuerier)GetGitSSHKey(_ context.Context,userID uuid.UUID) (database.GitSSHKey,error) {
13961419
q.mutex.RLock()
13971420
deferq.mutex.RUnlock()
@@ -2832,6 +2855,18 @@ func (q *FakeQuerier) GetUserLinkByUserIDLoginType(_ context.Context, params dat
28322855
return database.UserLink{},sql.ErrNoRows
28332856
}
28342857

2858+
func (q*FakeQuerier)GetUserLinksByUserID(_ context.Context,userID uuid.UUID) ([]database.UserLink,error) {
2859+
q.mutex.RLock()
2860+
deferq.mutex.RUnlock()
2861+
uls:=make([]database.UserLink,0)
2862+
for_,ul:=rangeq.userLinks {
2863+
iful.UserID==userID {
2864+
uls=append(uls,ul)
2865+
}
2866+
}
2867+
returnuls,nil
2868+
}
2869+
28352870
func (q*FakeQuerier)GetUsers(_ context.Context,params database.GetUsersParams) ([]database.GetUsersRow,error) {
28362871
iferr:=validateDatabaseType(params);err!=nil {
28372872
returnnil,err
@@ -4791,6 +4826,13 @@ func (q *FakeQuerier) RegisterWorkspaceProxy(_ context.Context, arg database.Reg
47914826
return database.WorkspaceProxy{},sql.ErrNoRows
47924827
}
47934828

4829+
func (q*FakeQuerier)SetDBCryptSentinelValue(_ context.Context,valuestring)error {
4830+
q.mutex.Lock()
4831+
deferq.mutex.Unlock()
4832+
q.dbcryptSentinelValue=&value
4833+
returnnil
4834+
}
4835+
47944836
func (*FakeQuerier)TryAcquireLock(_ context.Context,_int64) (bool,error) {
47954837
returnfalse,xerrors.New("TryAcquireLock must only be called within a transaction")
47964838
}

‎coderd/database/dbgen/dbgen.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -473,7 +473,7 @@ func UserLink(t testing.TB, db database.Store, orig database.UserLink) database.
473473
LoginType:takeFirst(orig.LoginType,database.LoginTypeGithub),
474474
LinkedID:takeFirst(orig.LinkedID),
475475
OAuthAccessToken:takeFirst(orig.OAuthAccessToken,uuid.NewString()),
476-
OAuthRefreshToken:takeFirst(orig.OAuthAccessToken,uuid.NewString()),
476+
OAuthRefreshToken:takeFirst(orig.OAuthRefreshToken,uuid.NewString()),
477477
OAuthExpiry:takeFirst(orig.OAuthExpiry,database.Now().Add(time.Hour*24)),
478478
})
479479

@@ -486,7 +486,7 @@ func GitAuthLink(t testing.TB, db database.Store, orig database.GitAuthLink) dat
486486
ProviderID:takeFirst(orig.ProviderID,uuid.New().String()),
487487
UserID:takeFirst(orig.UserID,uuid.New()),
488488
OAuthAccessToken:takeFirst(orig.OAuthAccessToken,uuid.NewString()),
489-
OAuthRefreshToken:takeFirst(orig.OAuthAccessToken,uuid.NewString()),
489+
OAuthRefreshToken:takeFirst(orig.OAuthRefreshToken,uuid.NewString()),
490490
OAuthExpiry:takeFirst(orig.OAuthExpiry,database.Now().Add(time.Hour*24)),
491491
CreatedAt:takeFirst(orig.CreatedAt,database.Now()),
492492
UpdatedAt:takeFirst(orig.UpdatedAt,database.Now()),

‎coderd/database/dbmetrics/dbmetrics.go

Lines changed: 28 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/database/dbmock/dbmock.go

Lines changed: 59 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/database/dump.sql

Lines changed: 14 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
DROPTABLE IF EXISTS dbcrypt_sentinel;
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
CREATETABLEIF NOT EXISTS dbcrypt_sentinel (
2+
only_oneinteger GENERATED ALWAYSAS (1) STORED UNIQUE,
3+
valtextNOT NULL DEFAULT''::text
4+
);
5+
6+
COMMENT ON TABLE dbcrypt_sentinel IS'A table used to determine if the database is encrypted';
7+
COMMENT ON COLUMN dbcrypt_sentinel.only_one IS'Ensures that only one row exists in the table.';
8+
COMMENT ON COLUMN dbcrypt_sentinel.val IS'Used to determine if the database is encrypted.';

‎coderd/database/migrations/migrate_test.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,7 @@ func TestMigrateUpWithFixtures(t *testing.T) {
266266
"template_version_parameters",
267267
"workspace_build_parameters",
268268
"template_version_variables",
269+
"dbcrypt_sentinel",// having zero rows is a valid state for this table
269270
}
270271
s:=&tableStats{s:make(map[string]int)}
271272

‎coderd/database/models.go

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/database/querier.go

Lines changed: 4 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp