Skip to content

Commit d155fc7

Browse files
strantalisstrantalis
committed
save
1 parent 747fb55 commit d155fc7

File tree

3 files changed

+41
-95
lines changed

3 files changed

+41
-95
lines changed

‎service/integration/attribute_fqns_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ func (s *AttributeFqnSuite) TestGetAttributeByFqn_WithCasingNormalized() {
177177
s.GreaterOrEqual(len(v.GetGrants()), 1)
178178
found := false
179179
for _, g := range v.GetGrants() {
180-
if g.GetId() == kas.GetId() {
180+
if g.GetId() == key.KeyAccessServerID {
181181
found = true
182182
break
183183
}

‎service/policy/db/attribute_fqn.go‎

Lines changed: 17 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,10 @@ package db
22

33
import (
44
"context"
5-
"encoding/base64"
65
"fmt"
76
"strings"
87

98
"github.com/opentdf/platform/protocol/go/common"
10-
"github.com/opentdf/platform/protocol/go/policy"
119
"github.com/opentdf/platform/protocol/go/policy/attributes"
1210
"github.com/opentdf/platform/protocol/go/policy/namespaces"
1311
"github.com/opentdf/platform/service/pkg/db"
@@ -112,102 +110,27 @@ func (c *PolicyDBClient) GetAttributesByValueFqns(ctx context.Context, r *attrib
112110
}
113111
}
114112

115-
// map keys to grants
116113
for _, pair := range list {
117-
if pair == nil {
118-
continue
119-
}
120-
// Loop through all keys in the attribute and create grants
121-
for _, key := range pair.Attribute.GetKasKeys() {
122-
grant := &policy.KeyAccessServer{}
123-
grant.Uri = key.GetKasUri()
124-
125-
kasKeyInfo := key.GetKey() // *policy.KasPublicKeyInfo
126-
// Assuming kasKeyInfo is not nil based on SQL construction and panic location.
127-
// If kasKeyInfo could be nil, an additional check would be needed here.
128-
129-
kasPubKey := &policy.KasPublicKey{
130-
Kid: kasKeyInfo.GetKeyId(),
131-
Alg: policy.KasPublicKeyAlgEnum(kasKeyInfo.GetKeyAlgorithm()),
132-
}
133-
// Check if PublicKeyCtx is available before accessing Pem
134-
if pubKeyCtx := kasKeyInfo.GetPublicKeyCtx(); pubKeyCtx != nil {
135-
// Grant pem isn't expected to be b64 encoded.
136-
pem, err := base64.StdEncoding.DecodeString(pubKeyCtx.GetPem())
137-
if err != nil {
138-
return nil, fmt.Errorf("failed to decode PEM for key %s: %w", kasPubKey.Kid, err)
139-
}
140-
kasPubKey.Pem = string(pem)
141-
}
142-
143-
grant.PublicKey = &policy.PublicKey{
144-
PublicKey: &policy.PublicKey_Cached{
145-
Cached: &policy.KasPublicKeySet{
146-
Keys: []*policy.KasPublicKey{kasPubKey},
147-
},
148-
},
149-
}
150-
pair.Attribute.Grants = append(pair.Attribute.Grants, grant)
151-
}
152-
// Loop through all keys on values and create grants
153-
for _, key := range pair.GetValue().GetKasKeys() {
154-
grant := &policy.KeyAccessServer{}
155-
grant.Uri = key.GetKasUri()
156-
157-
kasKeyInfo := key.GetKey() // *policy.KasPublicKeyInfo
158-
kasPubKey := &policy.KasPublicKey{
159-
Kid: kasKeyInfo.GetKeyId(),
160-
Alg: policy.KasPublicKeyAlgEnum(kasKeyInfo.GetKeyAlgorithm()),
161-
}
162-
// Check if PublicKeyCtx is available before accessing Pem
163-
if pubKeyCtx := kasKeyInfo.GetPublicKeyCtx(); pubKeyCtx != nil {
164-
// Grant pem isn't expected to be b64 encoded.
165-
pem, err := base64.StdEncoding.DecodeString(pubKeyCtx.GetPem())
166-
if err != nil {
167-
return nil, fmt.Errorf("failed to decode PEM for key %s: %w", kasPubKey.Kid, err)
168-
}
169-
kasPubKey.Pem = string(pem)
114+
if pair != nil {
115+
attrGrants, err := mapKasKeysToGrants(pair.GetAttribute().GetKasKeys())
116+
if err != nil {
117+
return nil, fmt.Errorf("could not map KAS attribute keys to grants: %w", err)
170118
}
171-
172-
grant.PublicKey = &policy.PublicKey{
173-
PublicKey: &policy.PublicKey_Cached{
174-
Cached: &policy.KasPublicKeySet{
175-
Keys: []*policy.KasPublicKey{kasPubKey},
176-
},
177-
},
119+
// Update the response map with the attribute grants
120+
pair.GetAttribute().Grants = append(pair.GetAttribute().Grants, attrGrants...)
121+
// Update the value grants
122+
valGrants, err := mapKasKeysToGrants(pair.GetValue().GetKasKeys())
123+
if err != nil {
124+
return nil, fmt.Errorf("could not map KAS value keys to grants: %w", err)
178125
}
179-
pair.Value.Grants = append(pair.Value.Grants, grant)
180-
}
181-
182-
// Map Namespace Keys to Grants
183-
if ns := pair.Attribute.GetNamespace(); ns != nil {
184-
for _, key := range ns.GetKasKeys() {
185-
grant := &policy.KeyAccessServer{}
186-
grant.Uri = key.GetKasUri()
187-
188-
kasKeyInfo := key.GetKey() // *policy.KasPublicKeyInfo
189-
kasPubKey := &policy.KasPublicKey{
190-
Kid: kasKeyInfo.GetKeyId(),
191-
Alg: policy.KasPublicKeyAlgEnum(kasKeyInfo.GetKeyAlgorithm()),
192-
}
193-
// Check if PublicKeyCtx is available before accessing Pem
194-
if pubKeyCtx := kasKeyInfo.GetPublicKeyCtx(); pubKeyCtx != nil {
195-
pem, err := base64.StdEncoding.DecodeString(pubKeyCtx.GetPem())
196-
if err != nil {
197-
return nil, fmt.Errorf("failed to decode PEM for key %s: %w", kasPubKey.Kid, err)
198-
}
199-
kasPubKey.Pem = string(pem)
200-
}
201-
202-
grant.PublicKey = &policy.PublicKey{
203-
PublicKey: &policy.PublicKey_Cached{
204-
Cached: &policy.KasPublicKeySet{
205-
Keys: []*policy.KasPublicKey{kasPubKey},
206-
},
207-
},
208-
}
209-
ns.Grants = append(ns.Grants, grant)
126+
pair.GetValue().Grants = append(pair.GetValue().Grants, valGrants...)
127+
// Update Namespace grants
128+
nsGrants, err := mapKasKeysToGrants(pair.GetAttribute().GetNamespace().GetKasKeys())
129+
if err != nil {
130+
return nil, fmt.Errorf("could not map KAS namespace keys to grants: %w", err)
210131
}
132+
// Update the response map with the namespace grants
133+
pair.GetAttribute().Grants = append(pair.GetAttribute().Grants, nsGrants...)
211134
}
212135
}
213136

‎service/policy/db/attributes.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -291,12 +291,34 @@ func (c PolicyDBClient) ListAttributesByFqns(ctx context.Context, fqns []string)
291291
}
292292

293293
var keys []*policy.KasKey
294+
var attrGrants []*policy.KeyAccessServer
294295
if len(attr.Keys) > 0 {
295296
keys, err = db.KasKeysProtoJSON(attr.Keys)
296297
if err != nil {
297298
return nil, fmt.Errorf("failed to unmarshal keys [%s]: %w", string(attr.Keys), err)
298299
}
300+
attrGrants, err = mapKasKeysToGrants(keys)
301+
if err != nil {
302+
return nil, fmt.Errorf("could not map KAS attribute keys to grants: %w", err)
303+
}
304+
}
305+
306+
for _, val := range values {
307+
if val.GetKasKeys() != nil {
308+
valGrants, err := mapKasKeysToGrants(val.GetKasKeys())
309+
if err != nil {
310+
return nil, fmt.Errorf("could not map KAS value keys to grants: %w", err)
311+
}
312+
val.Grants = append(val.Grants, valGrants...)
313+
}
314+
}
315+
316+
// Update Namespace grants
317+
nsGrants, err := mapKasKeysToGrants(ns.GetKasKeys())
318+
if err != nil {
319+
return nil, fmt.Errorf("could not map KAS namespace keys to grants: %w", err)
299320
}
321+
ns.Grants = append(ns.Grants, nsGrants...)
300322

301323
attrs[i] = &policy.Attribute{
302324
Id: attr.ID,
@@ -305,6 +327,7 @@ func (c PolicyDBClient) ListAttributesByFqns(ctx context.Context, fqns []string)
305327
Fqn: attr.Fqn,
306328
Active: &wrapperspb.BoolValue{Value: attr.Active},
307329
Namespace: ns,
330+
Grants: attrGrants,
308331
Values: values,
309332
KasKeys: keys,
310333
}

0 commit comments

Comments
 (0)