update kes-go dependency to v0.2.0 (minio#399)

This commit updates the Go SDK used to implement the CLI to v0.2.0. This mainly includes changes to listing via the `kes.ListIter[T]` and switching to `kes.Rule` based `kes.Policy` type. Signed-off-by: Andreas Auernhammer <[email protected]>
vadmeste · Oct 3, 2023 · 9d1b5ad · 9d1b5ad
1 parent ce9a9b1
commit 9d1b5ad
Show file tree

Hide file tree

Showing 28 changed files with 245 additions and 1,057 deletions.
diff --git a/cmd/kes/gateway.go b/cmd/kes/gateway.go
@@ -216,9 +216,18 @@ func policySetFromConfig(config *edge.ServerConfig) (auth.PolicySet, error) {
 			return nil, fmt.Errorf("policy %q already exists", name)
 		}
 
+		allow := make(map[string]kes.Rule, len(policy.Allow))
+		for _, pattern := range policy.Allow {
+			allow[pattern] = kes.Rule{}
+		}
+		deny := make(map[string]kes.Rule, len(policy.Deny))
+		for _, pattern := range policy.Deny {
+			deny[pattern] = kes.Rule{}
+		}
+
 		policies.policies[name] = &auth.Policy{
-			Allow:     policy.Allow,
-			Deny:      policy.Deny,
+			Allow:     allow,
+			Deny:      deny,
 			CreatedAt: time.Now().UTC(),
 			CreatedBy: config.Admin,
 		}
@@ -593,9 +602,9 @@ func newGatewayConfig(ctx context.Context, config *edge.ServerConfig, tlsConfig
 	for _, k := range config.Keys {
 		var algorithm kes.KeyAlgorithm
 		if fips.Enabled || cpu.HasAESGCM() {
-			algorithm = kes.AES256_GCM_SHA256
+			algorithm = kes.AES256
 		} else {
-			algorithm = kes.XCHACHA20_POLY1305
+			algorithm = kes.ChaCha20
 		}
 
 		key, err := key.Random(algorithm, config.Admin)

diff --git a/cmd/kes/identity.go b/cmd/kes/identity.go
@@ -11,13 +11,15 @@ import (
 	"crypto/sha256"
 	"crypto/x509"
 	"encoding/hex"
+	"encoding/json"
 	"encoding/pem"
 	"errors"
 	"fmt"
+	"io"
 	"net"
 	"os"
 	"os/signal"
-	"sort"
+	"slices"
 	"strings"
 	"time"
 
@@ -416,8 +418,8 @@ func infoIdentityCmd(args []string) {
 			fmt.Println(faint.Render(fmt.Sprintf("%-11s", "Created By")), info.CreatedBy)
 		}
 		if info.Policy != "" {
-			year, month, day := policy.Info.CreatedAt.Date()
-			hour, min, sec := policy.Info.CreatedAt.Clock()
+			year, month, day := policy.CreatedAt.Date()
+			hour, min, sec := policy.CreatedAt.Clock()
 
 			fmt.Println()
 			fmt.Println(faint.Render(fmt.Sprintf("%-11s", "Policy")), policyStyle.Render(info.Policy))
@@ -513,71 +515,47 @@ func lsIdentityCmd(args []string) {
 		cli.Fatal("too many arguments. See 'kes identity ls --help'")
 	}
 
-	pattern := "*"
+	var prefix string
 	if cmd.NArg() == 1 {
-		pattern = cmd.Arg(0)
+		prefix = cmd.Arg(0)
 	}
 
 	ctx, cancelCtx := signal.NotifyContext(context.Background(), os.Interrupt, os.Kill)
 	defer cancelCtx()
 
 	enclave := newEnclave(enclaveName, insecureSkipVerify)
-	identities, err := enclave.ListIdentities(ctx, pattern)
-	if err != nil {
-		if errors.Is(err, context.Canceled) {
-			os.Exit(1)
-		}
-		cli.Fatalf("failed to list identities: %v", err)
+	iter := &kes.ListIter[kes.Identity]{
+		NextFunc: enclave.ListIdentities,
 	}
-	defer identities.Close()
 
-	if jsonFlag {
-		if _, err = identities.WriteTo(os.Stdout); err != nil {
-			cli.Fatal(err)
-		}
-		if err = identities.Close(); err != nil {
-			cli.Fatal(err)
-		}
-	} else {
-		sortedInfos, err := identities.Values(0)
+	var ids []kes.Identity
+	for id, err := iter.SeekTo(ctx, prefix); err != io.EOF; id, err = iter.Next(ctx) {
 		if err != nil {
 			cli.Fatalf("failed to list identities: %v", err)
 		}
-		if len(sortedInfos) > 0 {
-			sort.Slice(sortedInfos, func(i, j int) bool {
-				return strings.Compare(sortedInfos[i].Policy, sortedInfos[j].Policy) < 0
-			})
-
-			headerStyle := tui.NewStyle()
-			dateStyle := tui.NewStyle()
-			policyStyle := tui.NewStyle()
-			if colorFlag.Colorize() {
-				const (
-					ColorDate   tui.Color = "#5f8700"
-					ColorPolicy tui.Color = "#2E42D1"
-				)
-				headerStyle = headerStyle.Underline(true).Bold(true)
-				dateStyle = dateStyle.Foreground(ColorDate)
-				policyStyle = policyStyle.Foreground(ColorPolicy)
-			}
+		ids = append(ids, id)
+	}
+	slices.Sort(ids)
 
-			fmt.Printf("%s %s %s\n",
-				headerStyle.Render(fmt.Sprintf("%-19s", "Date Created")),
-				headerStyle.Render(fmt.Sprintf("%-64s", "Identity")),
-				headerStyle.Render("Policy"),
-			)
-			for _, info := range sortedInfos {
-				year, month, day := info.CreatedAt.Local().Date()
-				hour, min, sec := info.CreatedAt.Local().Clock()
-
-				fmt.Printf("%s %s %s\n",
-					dateStyle.Render(fmt.Sprintf("%04d-%02d-%02d %02d:%02d:%02d", year, month, day, hour, min, sec)),
-					fmt.Sprintf("%-64s", info.Identity.String()),
-					policyStyle.Render(fmt.Sprintf("%-15s", info.Policy)),
-				)
-			}
+	if jsonFlag {
+		if err := json.NewEncoder(os.Stdout).Encode(ids); err != nil {
+			cli.Fatalf("failed to list identities: %v", err)
 		}
 	}
+	if len(ids) == 0 {
+		return
+	}
+
+	var (
+		style = tui.NewStyle().Underline(colorFlag.Colorize())
+		buf   = &strings.Builder{}
+	)
+	fmt.Fprintln(buf, style.Render("Identity"))
+	for _, id := range ids {
+		buf.WriteString(id.String())
+		buf.WriteByte('\n')
+	}
+	fmt.Print(buf)
 }
 
 const rmIdentityCmdUsage = `Usage:

diff --git a/cmd/kes/key.go b/cmd/kes/key.go
@@ -10,9 +10,10 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"os/signal"
-	"sort"
+	"slices"
 	"strings"
 
 	tui "github.com/charmbracelet/lipgloss"
@@ -174,7 +175,7 @@ func importKeyCmd(args []string) {
 	defer cancel()
 
 	enclave := newEnclave(enclaveName, insecureSkipVerify)
-	if err = enclave.ImportKey(ctx, name, key); err != nil {
+	if err = enclave.ImportKey(ctx, name, &kes.ImportKeyRequest{Key: key}); err != nil {
 		if errors.Is(err, context.Canceled) {
 			os.Exit(1)
 		}
@@ -248,46 +249,15 @@ func describeKeyCmd(args []string) {
 		return
 	}
 
-	var faint, nameStyle tui.Style
-	if colorFlag.Colorize() {
-		const ColorName tui.Color = "#2e42d1"
-		faint = faint.Faint(true).Bold(true)
-		nameStyle = nameStyle.Foreground(ColorName)
-	}
 	year, month, day := info.CreatedAt.Date()
 	hour, min, sec := info.CreatedAt.Clock()
 
-	fmt.Println(
-		faint.Render(fmt.Sprintf("%-11s", "Name")),
-		nameStyle.Render(info.Name),
-	)
-	if info.ID != "" {
-		fmt.Println(
-			faint.Render(fmt.Sprintf("%-11s", "ID")),
-			info.ID,
-		)
-	}
-	if info.Algorithm != kes.KeyAlgorithmUndefined {
-		fmt.Println(
-			faint.Render(fmt.Sprintf("%-11s", "Algorithm")),
-			info.Algorithm,
-		)
-	}
-	fmt.Println(
-		faint.Render(fmt.Sprintf("%-11s", "Created At")),
-		fmt.Sprintf("%04d-%02d-%02d %02d:%02d:%02d", year, month, day, hour, min, sec),
-	)
-	if info.CreatedBy.IsUnknown() {
-		fmt.Println(
-			faint.Render(fmt.Sprintf("%-11s", "Created By")),
-			"<unknown>",
-		)
-	} else {
-		fmt.Println(
-			faint.Render(fmt.Sprintf("%-11s", "Created By")),
-			info.CreatedBy,
-		)
-	}
+	buf := &strings.Builder{}
+	fmt.Fprintf(buf, "%-11s %s\n", "Name", info.Name)
+	fmt.Fprintf(buf, "%-11s %s\n", "Algorithm", info.Algorithm)
+	fmt.Fprintf(buf, "%-11s %04d-%02d-%02d %02d:%02d:%02d\n", "Date", year, month, day, hour, min, sec)
+	fmt.Fprintf(buf, "%-11s %s", "Owner", info.CreatedBy)
+	fmt.Print(buf)
 }
 
 const lsKeyCmdUsage = `Usage:
@@ -335,71 +305,47 @@ func lsKeyCmd(args []string) {
 		cli.Fatal("too many arguments. See 'kes key ls --help'")
 	}
 
-	pattern := "*"
+	prefix := "*"
 	if cmd.NArg() == 1 {
-		pattern = cmd.Arg(0)
+		prefix = cmd.Arg(0)
 	}
 
 	ctx, cancelCtx := signal.NotifyContext(context.Background(), os.Interrupt, os.Kill)
 	defer cancelCtx()
 
 	enclave := newEnclave(enclaveName, insecureSkipVerify)
-	iterator, err := enclave.ListKeys(ctx, pattern)
-	if err != nil {
-		if errors.Is(err, context.Canceled) {
-			os.Exit(1)
-		}
-		cli.Fatalf("failed to list keys: %v", err)
+	iter := &kes.ListIter[string]{
+		NextFunc: enclave.ListKeys,
 	}
-	defer iterator.Close()
 
-	if jsonFlag {
-		if _, err = iterator.WriteTo(os.Stdout); err != nil {
-			cli.Fatal(err)
-		}
-		if err = iterator.Close(); err != nil {
-			cli.Fatal(err)
-		}
-	} else {
-		keys, err := iterator.Values(0)
+	var names []string
+	for id, err := iter.SeekTo(ctx, prefix); err != io.EOF; id, err = iter.Next(ctx) {
 		if err != nil {
 			cli.Fatalf("failed to list keys: %v", err)
 		}
-		if err = iterator.Close(); err != nil {
-			cli.Fatalf("failed to list keys: %v", err)
-		}
-
-		if len(keys) > 0 {
-			sort.Slice(keys, func(i, j int) bool {
-				return strings.Compare(keys[i].Name, keys[j].Name) < 0
-			})
-
-			headerStyle := tui.NewStyle()
-			dateStyle := tui.NewStyle()
-			if colorFlag.Colorize() {
-				const ColorDate tui.Color = "#5f8700"
-				headerStyle = headerStyle.Underline(true).Bold(true)
-				dateStyle = dateStyle.Foreground(ColorDate)
-			}
+		names = append(names, id)
+	}
+	slices.Sort(names)
 
-			fmt.Println(
-				headerStyle.Render(fmt.Sprintf("%-19s", "Date Created")),
-				headerStyle.Render("Key"),
-			)
-			for _, key := range keys {
-				var date string
-				if key.CreatedAt.IsZero() {
-					date = fmt.Sprintf("%5s%s%5s", " ", "<unknown>", " ")
-				} else {
-					year, month, day := key.CreatedAt.Local().Date()
-					hour, min, sec := key.CreatedAt.Local().Clock()
-					date = fmt.Sprintf("%04d-%02d-%02d %02d:%02d:%02d", year, month, day, hour, min, sec)
-				}
-				fmt.Printf("%s %s\n", dateStyle.Render(date), key.Name)
-			}
+	if jsonFlag {
+		if err := json.NewEncoder(os.Stdout).Encode(names); err != nil {
+			cli.Fatalf("failed to list keys: %v", err)
 		}
+	}
+	if len(names) == 0 {
+		return
+	}
 
+	var (
+		style = tui.NewStyle().Underline(colorFlag.Colorize())
+		buf   = &strings.Builder{}
+	)
+	fmt.Fprintln(buf, style.Render("Key"))
+	for _, name := range names {
+		buf.WriteString(name)
+		buf.WriteByte('\n')
 	}
+	fmt.Print(buf)
 }
 
 const rmKeyCmdUsage = `Usage:

diff --git a/cmd/kes/main.go b/cmd/kes/main.go
@@ -31,7 +31,6 @@ Commands:
     server                   Start a KES server.
 
     key                      Manage cryptographic keys.
-    secret                   Manage KES secrets.
     policy                   Manage KES policies.
     identity                 Manage KES identities.
 
@@ -60,7 +59,6 @@ func main() {
 		"server": serverCmd,
 
 		"key":      keyCmd,
-		"secret":   secretCmd,
 		"policy":   policyCmd,
 		"identity": identityCmd,