rotate: 6 service-API drivers (mongo, npm, gcp, twilio, flyio, k8s)

Each driver is real-service code only (no test awareness; tests inject just an HTTPClient/Bin), following the established patterns: - mongo: in-place changeUserPassword over the old connection; no secret on argv (host/db on the URI, both passwords on stdin, output scrubbed). - npm: create token -> /-/whoami -> delete-by-key; blob records the key. - gcp: service-account KEY rotation; mints an RS256 JWT signed with the SA's own private key (crypto/rsa, stdlib) to self-auth the IAM create/verify/delete. - twilio: API Key create -> get -> delete, Basic auth (KeySid/secret). - flyio: GraphQL — a managing token mints/deletes the rotated deploy token. - k8s: create a service-account-token Secret, await the populated token, verify against the SA, delete the old Secret (invalidates the old token). All 6 register their honest proof level (MOCK-ONLY) in proofs.go + ROTATION-PROOFS.md; mongo/npm/k8s are LIVE-VM candidates pending real-target VM POCs. Emulators enforce credential validity (gcp verifies the JWT signature), tests assert Verify(old) fails after revoke + a secret-leak canary. Full suite: 103 green, -race clean on rotate/sink/vault. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-18 15:57:59 -07:00
parent b415c43bff
commit 35f19c007a
15 changed files with 2776 additions and 2 deletions
@@ -0,0 +1,176 @@
+package rotate
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"os/exec"
+	"strings"
+
+	"incredigo/internal/discover"
+	"incredigo/internal/vault"
+)
+
+// Mongo rotates a MongoDB user's password in place, the same in-place pattern as
+// Postgres/MySQL/Redis. The credential's secret is a mongodb URI
+// ("mongodb://user:pw@host:port/db?authSource=admin"); rotation mints a new password
+// and runs, over the OLD (authenticated) connection:
+//
+//	db.getSiblingDB(<authSource>).changeUserPassword(<user>, <newpw>)
+//
+// changeUserPassword is itself the cutover — the old password stops authenticating new
+// connections immediately — so RevokeOld is a no-op and the §3 sealed backup is the
+// recovery path (see docs/ROTATION.md §17).
+//
+// SECURITY (Hard Rule #3): NO secret ever reaches argv. The connection URI passed to
+// mongosh on the command line carries the host/db ONLY — never credentials. The script
+// fed on stdin authenticates with the OLD password (db.auth) and sets the NEW one; both
+// passwords live only in that stdin script (and the vault). The new password is hex
+// ([0-9a-f]) so it cannot break out of the JS string literal. Captured output is
+// scrubbed of both passwords before any error surfaces.
+type Mongo struct {
+	Bin string // mongosh binary; defaults to "mongosh"
+}
+
+// init registers the driver. Registration only makes it available; changing a
+// credential still requires `rotate --execute` AND INCREDIGO_ALLOW_EXECUTE=1.
+func init() { Register(&Mongo{}) }
+
+// Name identifies the driver in plans and audit records.
+func (m *Mongo) Name() string { return "mongo" }
+
+// Detect claims credentials a mongo scanner/seed emitted (Source == "mongo").
+func (m *Mongo) Detect(c discover.Credential) bool { return c.Source == "mongo" }
+
+func (m *Mongo) bin() string {
+	if m.Bin != "" {
+		return m.Bin
+	}
+	return "mongosh"
+}
+
+// authSource returns the DB to authenticate against / change the password in. Mongo
+// stores users in authSource (default "admin" unless the URI overrides it).
+func authSourceOf(u *url.URL) string {
+	if a := u.Query().Get("authSource"); a != "" {
+		return a
+	}
+	return "admin"
+}
+
+// Rotate mints a new password, applies it via changeUserPassword over the existing
+// (old) connection, and returns a vault handle to the rebuilt URI.
+func (m *Mongo) Rotate(ctx context.Context, c discover.Credential, v *vault.Vault) (*vault.Handle, error) {
+	u, err := openMongoURI(v, c.Secret)
+	if err != nil {
+		return nil, err
+	}
+	user := u.User.Username()
+	if user == "" {
+		return nil, fmt.Errorf("mongo: uri has no user")
+	}
+	oldPw, _ := u.User.Password()
+
+	newPw, err := genHex(24)
+	if err != nil {
+		return nil, err
+	}
+	as := authSourceOf(u)
+	// auth with the OLD password, then change to the NEW one — all on stdin.
+	script := fmt.Sprintf(
+		"db.getSiblingDB(%q).auth(%q,%q); db.getSiblingDB(%q).changeUserPassword(%q,%q); print('ROTATED');",
+		as, user, oldPw, as, user, newPw)
+	out, err := m.mongosh(ctx, u, script, oldPw, newPw)
+	if err != nil {
+		return nil, fmt.Errorf("mongo: changeUserPassword: %w", err)
+	}
+	if !strings.Contains(out, "ROTATED") {
+		return nil, fmt.Errorf("mongo: changeUserPassword: unexpected result")
+	}
+
+	nu := *u
+	nu.User = url.UserPassword(user, newPw)
+	return v.Store([]byte(nu.String())), nil
+}
+
+// Verify proves the freshly minted URI authenticates by db.auth + ping with the new
+// password.
+func (m *Mongo) Verify(ctx context.Context, newSecret *vault.Handle, v *vault.Vault) error {
+	u, err := openMongoURI(v, newSecret)
+	if err != nil {
+		return err
+	}
+	user := u.User.Username()
+	pw, _ := u.User.Password()
+	as := authSourceOf(u)
+	script := fmt.Sprintf(
+		"var ok = db.getSiblingDB(%q).auth(%q,%q); if (ok) { print('AUTH-OK'); } else { print('AUTH-FAIL'); }",
+		as, user, pw)
+	out, err := m.mongosh(ctx, u, script, pw, "")
+	if err != nil {
+		return fmt.Errorf("mongo verify: %w", err)
+	}
+	if !strings.Contains(out, "AUTH-OK") {
+		return fmt.Errorf("mongo verify: new password did not authenticate")
+	}
+	return nil
+}
+
+// RevokeOld is a no-op for an in-place engine: changeUserPassword in Rotate already
+// invalidated the previous password. Defined to satisfy the safety-spine ordering.
+func (m *Mongo) RevokeOld(ctx context.Context, c discover.Credential, v *vault.Vault) error {
+	return nil
+}
+
+// mongosh runs one JS script against the URI's host/port (credentials stripped from
+// the URI before it reaches argv). redactA/redactB, if non-empty, are scrubbed from
+// captured output before it can reach an error string.
+func (m *Mongo) mongosh(ctx context.Context, u *url.URL, script, redactA, redactB string) (string, error) {
+	host := u.Hostname()
+	port := u.Port()
+	if port == "" {
+		port = "27017"
+	}
+	// Credential-free connection target: host:port/db only.
+	target := &url.URL{Scheme: "mongodb", Host: host + ":" + port, Path: u.Path}
+	cmd := exec.CommandContext(ctx, m.bin(), "--quiet", "--norc", target.String())
+	cmd.Env = os.Environ()
+	cmd.Stdin = strings.NewReader(script + "\n")
+	var out, errb bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &errb
+	err := cmd.Run()
+	so, se := out.String(), errb.String()
+	for _, r := range []string{redactA, redactB} {
+		if r != "" {
+			so = strings.ReplaceAll(so, r, "***")
+			se = strings.ReplaceAll(se, r, "***")
+		}
+	}
+	if err != nil {
+		return so, fmt.Errorf("%v: %s", err, strings.TrimSpace(se+" "+so))
+	}
+	return so, nil
+}
+
+// openMongoURI reads a mongodb URI secret from the vault and parses it, accepting the
+// mongodb:// and mongodb+srv:// schemes. The URI string is transient and never persisted.
+func openMongoURI(v *vault.Vault, h *vault.Handle) (*url.URL, error) {
+	buf, err := v.Open(h)
+	if err != nil {
+		return nil, err
+	}
+	u, err := url.Parse(strings.TrimSpace(string(buf.Bytes())))
+	if err != nil {
+		return nil, fmt.Errorf("mongo: parse uri: %w", err)
+	}
+	if u.Scheme != "mongodb" && u.Scheme != "mongodb+srv" {
+		return nil, fmt.Errorf("mongo: unexpected uri scheme %q", u.Scheme)
+	}
+	if u.User == nil {
+		return nil, fmt.Errorf("mongo: uri has no user:password")
+	}
+	return u, nil
+}