Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6aaa09e

Browse files
committed
chore: shorten provisioner key
1 parent10b09ed commit6aaa09e

File tree

10 files changed

+90
-28
lines changed

10 files changed

+90
-28
lines changed

‎coderd/database/dbauthz/dbauthz.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1680,6 +1680,10 @@ func (q *querier) GetProvisionerJobsCreatedAfter(ctx context.Context, createdAt
16801680
returnq.db.GetProvisionerJobsCreatedAfter(ctx,createdAt)
16811681
}
16821682

1683+
func (q*querier)GetProvisionerKeyByHashedSecret(ctx context.Context,hashedSecret []byte) (database.ProvisionerKey,error) {
1684+
returnfetch(q.log,q.auth,q.db.GetProvisionerKeyByHashedSecret)(ctx,hashedSecret)
1685+
}
1686+
16831687
func (q*querier)GetProvisionerKeyByID(ctx context.Context,id uuid.UUID) (database.ProvisionerKey,error) {
16841688
returnfetch(q.log,q.auth,q.db.GetProvisionerKeyByID)(ctx,id)
16851689
}

‎coderd/database/dbmem/dbmem.go

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3240,6 +3240,19 @@ func (q *FakeQuerier) GetProvisionerJobsCreatedAfter(_ context.Context, after ti
32403240
returnjobs,nil
32413241
}
32423242

3243+
func (q*FakeQuerier)GetProvisionerKeyByHashedSecret(ctx context.Context,hashedSecret []byte) (database.ProvisionerKey,error) {
3244+
q.mutex.RLock()
3245+
deferq.mutex.RUnlock()
3246+
3247+
for_,key:=rangeq.provisionerKeys {
3248+
ifbytes.Equal(key.HashedSecret,hashedSecret) {
3249+
returnkey,nil
3250+
}
3251+
}
3252+
3253+
return database.ProvisionerKey{},sql.ErrNoRows
3254+
}
3255+
32433256
func (q*FakeQuerier)GetProvisionerKeyByID(_ context.Context,id uuid.UUID) (database.ProvisionerKey,error) {
32443257
q.mutex.RLock()
32453258
deferq.mutex.RUnlock()

‎coderd/database/dbmetrics/dbmetrics.go

Lines changed: 7 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/database/dbmock/dbmock.go

Lines changed: 15 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/database/querier.go

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/database/queries.sql.go

Lines changed: 23 additions & 0 deletions
Some generated files are not rendered by default. Learn more aboutcustomizing how changed files appear on GitHub.

‎coderd/database/queries/provisionerkeys.sql

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,14 @@ FROM
1919
WHERE
2020
id= $1;
2121

22+
-- name: GetProvisionerKeyByHashedSecret :one
23+
SELECT
24+
*
25+
FROM
26+
provisioner_keys
27+
WHERE
28+
hashed_secret= $1;
29+
2230
-- name: GetProvisionerKeyByName :one
2331
SELECT
2432
*

‎coderd/httpmw/provisionerdaemon.go

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -71,16 +71,17 @@ func ExtractProvisionerDaemonAuthenticated(opts ExtractProvisionerAuthConfig) fu
7171
return
7272
}
7373

74-
id,keyValue,err:=provisionerkey.Parse(key)
74+
err:=provisionerkey.Validate(key)
7575
iferr!=nil {
76-
handleOptional(http.StatusUnauthorized, codersdk.Response{
76+
handleOptional(http.StatusBadGateway, codersdk.Response{
7777
Message:"provisioner daemon key invalid",
78+
Detail:err.Error(),
7879
})
7980
return
8081
}
81-
82+
hashedKey:=provisionerkey.HashSecret(key)
8283
// nolint:gocritic // System must check if the provisioner key is valid.
83-
pk,err:=opts.DB.GetProvisionerKeyByID(dbauthz.AsSystemRestricted(ctx),id)
84+
pk,err:=opts.DB.GetProvisionerKeyByHashedSecret(dbauthz.AsSystemRestricted(ctx),hashedKey)
8485
iferr!=nil {
8586
ifhttpapi.Is404Error(err) {
8687
handleOptional(http.StatusUnauthorized, codersdk.Response{
@@ -90,12 +91,13 @@ func ExtractProvisionerDaemonAuthenticated(opts ExtractProvisionerAuthConfig) fu
9091
}
9192

9293
handleOptional(http.StatusInternalServerError, codersdk.Response{
93-
Message:"get provisioner daemon key: "+err.Error(),
94+
Message:"get provisioner daemon key",
95+
Detail:err.Error(),
9496
})
9597
return
9698
}
9799

98-
ifprovisionerkey.Compare(pk.HashedSecret,provisionerkey.HashSecret(keyValue)) {
100+
ifprovisionerkey.Compare(pk.HashedSecret,hashedKey) {
99101
handleOptional(http.StatusUnauthorized, codersdk.Response{
100102
Message:"provisioner daemon key invalid",
101103
})

‎coderd/provisionerkey/provisionerkey.go

Lines changed: 9 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ package provisionerkey
33
import (
44
"crypto/sha256"
55
"crypto/subtle"
6-
"fmt"
7-
"strings"
86

97
"github.com/google/uuid"
108
"golang.org/x/xerrors"
@@ -15,40 +13,31 @@ import (
1513
)
1614

1715
funcNew(organizationID uuid.UUID,namestring,tagsmap[string]string) (database.InsertProvisionerKeyParams,string,error) {
18-
id:=uuid.New()
19-
secret,err:=cryptorand.HexString(64)
16+
secret,err:=cryptorand.String(64)
2017
iferr!=nil {
21-
return database.InsertProvisionerKeyParams{},"",xerrors.Errorf("generatetoken: %w",err)
18+
return database.InsertProvisionerKeyParams{},"",xerrors.Errorf("generatesecret: %w",err)
2219
}
23-
hashedSecret:=HashSecret(secret)
24-
token:=fmt.Sprintf("%s:%s",id,secret)
2520

2621
iftags==nil {
2722
tags=map[string]string{}
2823
}
2924

3025
return database.InsertProvisionerKeyParams{
31-
ID:id,
26+
ID:uuid.New(),
3227
CreatedAt:dbtime.Now(),
3328
OrganizationID:organizationID,
3429
Name:name,
35-
HashedSecret:hashedSecret,
30+
HashedSecret:HashSecret(secret),
3631
Tags:tags,
37-
},token,nil
32+
},secret,nil
3833
}
3934

40-
funcParse(tokenstring) (uuid.UUID,string,error) {
41-
parts:=strings.Split(token,":")
42-
iflen(parts)!=2 {
43-
return uuid.UUID{},"",xerrors.Errorf("invalid token format")
35+
funcValidate(tokenstring)error {
36+
iflen(token)!=64 {
37+
returnxerrors.Errorf("must be 64 characters")
4438
}
4539

46-
id,err:=uuid.Parse(parts[0])
47-
iferr!=nil {
48-
return uuid.UUID{},"",xerrors.Errorf("parse id: %w",err)
49-
}
50-
51-
returnid,parts[1],nil
40+
returnnil
5241
}
5342

5443
funcHashSecret(secretstring) []byte {

‎enterprise/cli/provisionerdaemonstart.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -122,9 +122,9 @@ func (r *RootCmd) provisionerDaemonStart() *serpent.Command {
122122
iflen(rawTags)>0 {
123123
returnxerrors.New("cannot provide tags when using provisioner key")
124124
}
125-
_,_,err:=provisionerkey.Parse(provisionerKey)
125+
err=provisionerkey.Validate(provisionerKey)
126126
iferr!=nil {
127-
returnxerrors.Errorf("parse provisioner key: %w",err)
127+
returnxerrors.Errorf("validate provisioner key: %w",err)
128128
}
129129
}
130130

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp