rotate: nine rotation drivers + verify-before-revoke execute spine
Implements the Rotator interface across all four rotation patterns, each a self-contained one-file driver self-registering via init(): in-place DB password postgres, mysql (3-stmt unprivileged fallback), redis local keypair + propagate sshkey (ed25519), wireguard (clamped curve25519) provider-API token gitea PAT, mullvad device key cloud-key self-identifying aws IAM access key (hand-rolled SigV4, no SDK dep) Spine (execute.go) enforces Hard Rule #2: backup -> rotate -> verify(new) -> store -> re-read+verify -> revoke-old; dryrun.go keeps --execute gated. Each driver ships a table-driven test proving real cutover (old secret stops authenticating) and asserting no secret substring leaks to argv/Meta/errors. Promotes golang.org/x/crypto to a direct dependency. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
leetcrypt
@@ -0,0 +1,256 @@
|
||||
package rotate
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"incredigo/internal/discover"
|
||||
"incredigo/internal/vault"
|
||||
)
|
||||
|
||||
// Gitea rotates a Gitea personal access token (PAT) via the Gitea API by
|
||||
// CREATING a new token, verifying it, then DELETING the old one — the canonical
|
||||
// provider-API rotation pattern (create-new → verify → revoke-old), and the first
|
||||
// driver whose RevokeOld is a real destructive API call.
|
||||
//
|
||||
// The credential's secret is a single self-contained line (so it round-trips
|
||||
// through the existing single-line gopass sink unchanged):
|
||||
//
|
||||
// https://<user>:<token>@<host>[:port]/?name=<token-name>[&pw=<mgmt-password>]
|
||||
//
|
||||
// - <token> the PAT being rotated (the userinfo password).
|
||||
// - <user> the Gitea username (userinfo user).
|
||||
// - scheme+host the API base (http for the loopback sandbox; https in prod).
|
||||
// - name= the token's Gitea NAME — required to DELETE it (the API deletes
|
||||
// by name/id, and the token VALUE can't be mapped back to a name).
|
||||
// incredigo writes the new name on every rotation, so the chain is
|
||||
// self-sustaining; a bare discovered token with no name degrades to
|
||||
// the guided worklist for the old-token deletion.
|
||||
// - pw= OPTIONAL Gitea account password. Gitea historically requires
|
||||
// BASIC auth (password) to create/delete tokens; if present it is
|
||||
// used for those management calls. If absent, the driver tries
|
||||
// token auth (works on Gitea versions that allow a scoped token to
|
||||
// manage tokens). Verify always uses the token itself.
|
||||
//
|
||||
// SECURITY: the token (and optional mgmt password) live only in the vault and the
|
||||
// query string of the in-vault secret; they never reach Identity/Meta/logs. HTTP
|
||||
// bodies carrying the new token are drained into the vault, not stringified beyond
|
||||
// the unavoidable JSON decode.
|
||||
type Gitea struct {
|
||||
// HTTPClient is injectable for tests / custom TLS. Defaults to a 15s-timeout
|
||||
// client using http.DefaultTransport.
|
||||
HTTPClient *http.Client
|
||||
}
|
||||
|
||||
// init self-registers the driver. Availability alone changes nothing; the
|
||||
// `rotate --execute` + INCREDIGO_ALLOW_EXECUTE=1 gate still applies.
|
||||
func init() { Register(&Gitea{}) }
|
||||
|
||||
// Name identifies the driver in plans and audit records.
|
||||
func (g *Gitea) Name() string { return "gitea" }
|
||||
|
||||
// Detect claims credentials tagged Source == "gitea".
|
||||
func (g *Gitea) Detect(c discover.Credential) bool { return c.Source == "gitea" }
|
||||
|
||||
func (g *Gitea) client() *http.Client {
|
||||
if g.HTTPClient != nil {
|
||||
return g.HTTPClient
|
||||
}
|
||||
return &http.Client{Timeout: 15 * time.Second}
|
||||
}
|
||||
|
||||
// giteaSecret is the parsed credential blob. None of its fields are ever logged.
|
||||
type giteaSecret struct {
|
||||
base string // scheme://host[:port]
|
||||
user string
|
||||
token string
|
||||
name string // token name (for DELETE)
|
||||
pw string // optional mgmt password (basic auth)
|
||||
}
|
||||
|
||||
// parseGiteaSecret reads the single-line blob from the vault and decomposes it.
|
||||
func parseGiteaSecret(v *vault.Vault, h *vault.Handle) (giteaSecret, error) {
|
||||
buf, err := v.Open(h)
|
||||
if err != nil {
|
||||
return giteaSecret{}, err
|
||||
}
|
||||
u, err := url.Parse(strings.TrimSpace(string(buf.Bytes())))
|
||||
if err != nil {
|
||||
return giteaSecret{}, fmt.Errorf("gitea: parse secret url: %w", err)
|
||||
}
|
||||
if u.Scheme != "http" && u.Scheme != "https" {
|
||||
return giteaSecret{}, fmt.Errorf("gitea: unexpected scheme %q", u.Scheme)
|
||||
}
|
||||
if u.User == nil {
|
||||
return giteaSecret{}, fmt.Errorf("gitea: secret has no user:token")
|
||||
}
|
||||
tok, _ := u.User.Password()
|
||||
if tok == "" {
|
||||
return giteaSecret{}, fmt.Errorf("gitea: secret has no token")
|
||||
}
|
||||
q := u.Query()
|
||||
return giteaSecret{
|
||||
base: u.Scheme + "://" + u.Host,
|
||||
user: u.User.Username(),
|
||||
token: tok,
|
||||
name: q.Get("name"),
|
||||
pw: q.Get("pw"),
|
||||
}, nil
|
||||
}
|
||||
|
||||
// build re-encodes a giteaSecret into the single-line blob form.
|
||||
func (s giteaSecret) build() string {
|
||||
u := &url.URL{
|
||||
Scheme: schemeOf(s.base),
|
||||
Host: hostOf(s.base),
|
||||
User: url.UserPassword(s.user, s.token),
|
||||
Path: "/",
|
||||
}
|
||||
q := url.Values{}
|
||||
q.Set("name", s.name)
|
||||
if s.pw != "" {
|
||||
q.Set("pw", s.pw)
|
||||
}
|
||||
u.RawQuery = q.Encode()
|
||||
return u.String()
|
||||
}
|
||||
|
||||
func schemeOf(base string) string {
|
||||
if i := strings.Index(base, "://"); i >= 0 {
|
||||
return base[:i]
|
||||
}
|
||||
return "https"
|
||||
}
|
||||
|
||||
func hostOf(base string) string {
|
||||
if i := strings.Index(base, "://"); i >= 0 {
|
||||
return base[i+3:]
|
||||
}
|
||||
return base
|
||||
}
|
||||
|
||||
// Rotate creates a NEW token at the Gitea API (authenticating with the old token
|
||||
// or, if a mgmt password is present, basic auth), and returns a vault handle to a
|
||||
// rebuilt blob carrying the new token + new name. It does not revoke the old token.
|
||||
func (g *Gitea) Rotate(ctx context.Context, c discover.Credential, v *vault.Vault) (*vault.Handle, error) {
|
||||
s, err := parseGiteaSecret(v, c.Secret)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
newName := fmt.Sprintf("incredigo-rotated-%d", time.Now().Unix())
|
||||
body, _ := json.Marshal(map[string]any{
|
||||
"name": newName,
|
||||
"scopes": []string{"write:user", "read:user"}, // enough to manage tokens on Gitea ≥1.19; ignored by older
|
||||
})
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodPost,
|
||||
s.base+"/api/v1/users/"+url.PathEscape(s.user)+"/tokens", bytes.NewReader(body))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
g.authManage(req, s)
|
||||
|
||||
resp, err := g.client().Do(req)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("gitea: create token: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK {
|
||||
return nil, fmt.Errorf("gitea: create token: unexpected status %s", resp.Status)
|
||||
}
|
||||
var created struct {
|
||||
Name string `json:"name"`
|
||||
SHA1 string `json:"sha1"`
|
||||
}
|
||||
if err := json.NewDecoder(resp.Body).Decode(&created); err != nil {
|
||||
return nil, fmt.Errorf("gitea: decode created token: %w", err)
|
||||
}
|
||||
if created.SHA1 == "" {
|
||||
return nil, fmt.Errorf("gitea: create token: empty token in response")
|
||||
}
|
||||
|
||||
ns := s // carry base/user/pw forward
|
||||
ns.token = created.SHA1
|
||||
ns.name = created.Name
|
||||
if ns.name == "" {
|
||||
ns.name = newName
|
||||
}
|
||||
return v.Store([]byte(ns.build())), nil
|
||||
}
|
||||
|
||||
// Verify proves the newly minted token authenticates by calling GET /api/v1/user
|
||||
// with it and checking the returned login matches.
|
||||
func (g *Gitea) Verify(ctx context.Context, newSecret *vault.Handle, v *vault.Vault) error {
|
||||
s, err := parseGiteaSecret(v, newSecret)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodGet, s.base+"/api/v1/user", nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
req.Header.Set("Authorization", "token "+s.token)
|
||||
resp, err := g.client().Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("gitea verify: %w", err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("gitea verify: GET /user status %s", resp.Status)
|
||||
}
|
||||
var who struct {
|
||||
Login string `json:"login"`
|
||||
}
|
||||
if err := json.NewDecoder(resp.Body).Decode(&who); err != nil {
|
||||
return fmt.Errorf("gitea verify: decode user: %w", err)
|
||||
}
|
||||
if s.user != "" && who.Login != "" && !strings.EqualFold(who.Login, s.user) {
|
||||
return fmt.Errorf("gitea verify: token authenticates as %q, expected %q", who.Login, s.user)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// RevokeOld deletes the OLD token by name. The old token is still valid at this
|
||||
// point (revoke runs only after the new token is stored+verified), so it is used
|
||||
// to authenticate its own deletion unless a mgmt password is configured.
|
||||
func (g *Gitea) RevokeOld(ctx context.Context, c discover.Credential, v *vault.Vault) error {
|
||||
s, err := parseGiteaSecret(v, c.Secret)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if s.name == "" {
|
||||
return fmt.Errorf("gitea revoke: old token has no recorded name — delete it manually (guided)")
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, http.MethodDelete,
|
||||
s.base+"/api/v1/users/"+url.PathEscape(s.user)+"/tokens/"+url.PathEscape(s.name), nil)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
g.authManage(req, s)
|
||||
resp, err := g.client().Do(req)
|
||||
if err != nil {
|
||||
return fmt.Errorf("gitea revoke: %w", err)
|
||||
}
|
||||
defer func() { io.Copy(io.Discard, resp.Body); resp.Body.Close() }()
|
||||
if resp.StatusCode != http.StatusNoContent && resp.StatusCode != http.StatusOK {
|
||||
return fmt.Errorf("gitea revoke: delete token status %s", resp.Status)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// authManage sets auth for token-management calls (create/delete): basic auth with
|
||||
// the mgmt password if present (Gitea's historical requirement), else token auth.
|
||||
func (g *Gitea) authManage(req *http.Request, s giteaSecret) {
|
||||
if s.pw != "" {
|
||||
req.SetBasicAuth(s.user, s.pw)
|
||||
return
|
||||
}
|
||||
req.Header.Set("Authorization", "token "+s.token)
|
||||
}
|
||||
Reference in New Issue
Block a user