103 lines
2.7 KiB
Go
103 lines
2.7 KiB
Go
package secretsserver
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"io"
|
|
"net/http"
|
|
|
|
"git.handmadecities.com/HMC/shhh/pkg/secretsstore"
|
|
)
|
|
|
|
type Server struct {
|
|
store secretsstore.SecretsStore
|
|
}
|
|
|
|
// New creates a new secrets server that auths through mTLS.
|
|
func New(
|
|
store secretsstore.SecretsStore,
|
|
) *Server {
|
|
return &Server{
|
|
store: store,
|
|
}
|
|
}
|
|
|
|
// ListenAndServeTLS binds the server to addr.
|
|
// cert must have been signed by ca, any client cert also
|
|
// signed by ca will be able to call the serice.
|
|
func (s *Server) ListenAndServeTLS(addr, ca, cert, key string) error {
|
|
tlsConfig, err := mTLSConfigFromCA(ca)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
server := &http.Server{
|
|
Addr: addr,
|
|
Handler: s,
|
|
TLSConfig: tlsConfig,
|
|
// TODO: Tune the rest of the server parameters for robustness.
|
|
}
|
|
return server.ListenAndServeTLS(cert, key)
|
|
}
|
|
|
|
func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
|
// All operations are on the root path.
|
|
if r.URL.Path != "" && r.URL.Path != "/" {
|
|
w.WriteHeader(http.StatusBadRequest)
|
|
// TODO: Better handling of `Write` failing.
|
|
w.Write([]byte("requests are only accepted to the root (/) path"))
|
|
return
|
|
}
|
|
|
|
// Decode key from query string parameters.
|
|
b64Key := r.URL.Query().Get("key")
|
|
if b64Key == "" {
|
|
w.WriteHeader(http.StatusBadRequest)
|
|
w.Write([]byte("missing \"key\" query string parameter"))
|
|
return
|
|
}
|
|
key, err := base64.RawURLEncoding.DecodeString(b64Key)
|
|
if err != nil {
|
|
w.WriteHeader(http.StatusBadRequest)
|
|
w.Write([]byte("key was not base64 encoded"))
|
|
return
|
|
}
|
|
|
|
// TODO: Control flow is a little clumsy here, clean it up.
|
|
switch r.Method {
|
|
case http.MethodGet:
|
|
secret, err := s.store.Get(secretsstore.Key(key))
|
|
if err != nil {
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
w.Write([]byte("could not retrieve requested secret: " + err.Error()))
|
|
return
|
|
}
|
|
// We're writing raw bytes.
|
|
w.Header().Add("Content-Type", "application/octet-stream")
|
|
w.Write(secret)
|
|
return
|
|
case http.MethodPut:
|
|
secret, err := io.ReadAll(r.Body)
|
|
if err != nil {
|
|
w.WriteHeader(http.StatusBadRequest)
|
|
w.Write([]byte("could not read secret bytes from request body: " + err.Error()))
|
|
return
|
|
}
|
|
if err := s.store.Put(secretsstore.Key(key), secret); err != nil {
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
w.Write([]byte("could not store secret: " + err.Error()))
|
|
return
|
|
}
|
|
return
|
|
case http.MethodDelete:
|
|
if err := s.store.Delete(secretsstore.Key(key)); err != nil {
|
|
w.WriteHeader(http.StatusInternalServerError)
|
|
w.Write([]byte("could not delete secret: " + err.Error()))
|
|
return
|
|
}
|
|
return
|
|
default:
|
|
w.WriteHeader(http.StatusBadRequest)
|
|
w.Write([]byte(r.Method + " method is not allowd"))
|
|
return
|
|
}
|
|
}
|