-
Notifications
You must be signed in to change notification settings - Fork 8.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Allow encrypted saved-object properties to be accessed by end-users (#…
…64941) Co-authored-by: kobelb <[email protected]>
- Loading branch information
Showing
18 changed files
with
1,710 additions
and
336 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
113 changes: 113 additions & 0 deletions
113
...gins/encrypted_saved_objects/server/crypto/encrypted_saved_object_type_definition.test.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { EncryptedSavedObjectTypeRegistration } from './encrypted_saved_objects_service'; | ||
| import { EncryptedSavedObjectAttributesDefinition } from './encrypted_saved_object_type_definition'; | ||
|
|
||
| it('correctly determines attribute properties', () => { | ||
| const attributes = ['attr#1', 'attr#2', 'attr#3', 'attr#4']; | ||
| const cases: Array<[ | ||
| EncryptedSavedObjectTypeRegistration, | ||
| { | ||
| shouldBeEncrypted: boolean[]; | ||
| shouldBeExcludedFromAAD: boolean[]; | ||
| shouldBeStripped: boolean[]; | ||
| } | ||
| ]> = [ | ||
| [ | ||
| { | ||
| type: 'so-type', | ||
| attributesToEncrypt: new Set(['attr#1', 'attr#2', 'attr#3', 'attr#4']), | ||
| }, | ||
| { | ||
| shouldBeEncrypted: [true, true, true, true], | ||
| shouldBeExcludedFromAAD: [true, true, true, true], | ||
| shouldBeStripped: [true, true, true, true], | ||
| }, | ||
| ], | ||
| [ | ||
| { | ||
| type: 'so-type', | ||
| attributesToEncrypt: new Set(['attr#1', 'attr#2']), | ||
| }, | ||
| { | ||
| shouldBeEncrypted: [true, true, false, false], | ||
| shouldBeExcludedFromAAD: [true, true, false, false], | ||
| shouldBeStripped: [true, true, false, false], | ||
| }, | ||
| ], | ||
| [ | ||
| { | ||
| type: 'so-type', | ||
| attributesToEncrypt: new Set([{ key: 'attr#1' }, { key: 'attr#2' }]), | ||
| }, | ||
| { | ||
| shouldBeEncrypted: [true, true, false, false], | ||
| shouldBeExcludedFromAAD: [true, true, false, false], | ||
| shouldBeStripped: [true, true, false, false], | ||
| }, | ||
| ], | ||
| [ | ||
| { | ||
| type: 'so-type', | ||
| attributesToEncrypt: new Set(['attr#1', 'attr#2']), | ||
| attributesToExcludeFromAAD: new Set(['attr#3']), | ||
| }, | ||
| { | ||
| shouldBeEncrypted: [true, true, false, false], | ||
| shouldBeExcludedFromAAD: [true, true, true, false], | ||
| shouldBeStripped: [true, true, false, false], | ||
| }, | ||
| ], | ||
| [ | ||
| { | ||
| type: 'so-type', | ||
| attributesToEncrypt: new Set([ | ||
| 'attr#1', | ||
| 'attr#2', | ||
| { key: 'attr#4', dangerouslyExposeValue: true }, | ||
| ]), | ||
| attributesToExcludeFromAAD: new Set(['attr#3']), | ||
| }, | ||
| { | ||
| shouldBeEncrypted: [true, true, false, true], | ||
| shouldBeExcludedFromAAD: [true, true, true, true], | ||
| shouldBeStripped: [true, true, false, false], | ||
| }, | ||
| ], | ||
| [ | ||
| { | ||
| type: 'so-type', | ||
| attributesToEncrypt: new Set([ | ||
| { key: 'attr#1', dangerouslyExposeValue: true }, | ||
| 'attr#2', | ||
| { key: 'attr#4', dangerouslyExposeValue: true }, | ||
| ]), | ||
| attributesToExcludeFromAAD: new Set(['some-other-attribute']), | ||
| }, | ||
| { | ||
| shouldBeEncrypted: [true, true, false, true], | ||
| shouldBeExcludedFromAAD: [true, true, false, true], | ||
| shouldBeStripped: [false, true, false, false], | ||
| }, | ||
| ], | ||
| ]; | ||
|
|
||
| for (const [typeRegistration, asserts] of cases) { | ||
| const typeDefinition = new EncryptedSavedObjectAttributesDefinition(typeRegistration); | ||
| for (const [attributeIndex, attributeName] of attributes.entries()) { | ||
| expect(typeDefinition.shouldBeEncrypted(attributeName)).toBe( | ||
| asserts.shouldBeEncrypted[attributeIndex] | ||
| ); | ||
| expect(typeDefinition.shouldBeStripped(attributeName)).toBe( | ||
| asserts.shouldBeStripped[attributeIndex] | ||
| ); | ||
| expect(typeDefinition.shouldBeExcludedFromAAD(attributeName)).toBe( | ||
| asserts.shouldBeExcludedFromAAD[attributeIndex] | ||
| ); | ||
| } | ||
| } | ||
| }); |
67 changes: 67 additions & 0 deletions
67
...k/plugins/encrypted_saved_objects/server/crypto/encrypted_saved_object_type_definition.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| /* | ||
| * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| * or more contributor license agreements. Licensed under the Elastic License; | ||
| * you may not use this file except in compliance with the Elastic License. | ||
| */ | ||
|
|
||
| import { EncryptedSavedObjectTypeRegistration } from './encrypted_saved_objects_service'; | ||
|
|
||
| /** | ||
| * Represents the definition of the attributes of the specific saved object that are supposed to be | ||
| * encrypted. The definition also dictates which attributes should be excluded from AAD and/or | ||
| * stripped from response. | ||
| */ | ||
| export class EncryptedSavedObjectAttributesDefinition { | ||
| public readonly attributesToEncrypt: ReadonlySet<string>; | ||
| private readonly attributesToExcludeFromAAD: ReadonlySet<string> | undefined; | ||
| private readonly attributesToStrip: ReadonlySet<string>; | ||
|
|
||
| constructor(typeRegistration: EncryptedSavedObjectTypeRegistration) { | ||
| const attributesToEncrypt = new Set<string>(); | ||
| const attributesToStrip = new Set<string>(); | ||
| for (const attribute of typeRegistration.attributesToEncrypt) { | ||
| if (typeof attribute === 'string') { | ||
| attributesToEncrypt.add(attribute); | ||
| attributesToStrip.add(attribute); | ||
| } else { | ||
| attributesToEncrypt.add(attribute.key); | ||
| if (!attribute.dangerouslyExposeValue) { | ||
| attributesToStrip.add(attribute.key); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| this.attributesToEncrypt = attributesToEncrypt; | ||
| this.attributesToStrip = attributesToStrip; | ||
| this.attributesToExcludeFromAAD = typeRegistration.attributesToExcludeFromAAD; | ||
| } | ||
|
|
||
| /** | ||
| * Determines whether particular attribute should be encrypted. Full list of attributes that | ||
| * should be encrypted can be retrieved via `attributesToEncrypt` property. | ||
| * @param attributeName Name of the attribute. | ||
| */ | ||
| public shouldBeEncrypted(attributeName: string) { | ||
| return this.attributesToEncrypt.has(attributeName); | ||
| } | ||
|
|
||
| /** | ||
| * Determines whether particular attribute should be excluded from AAD. | ||
| * @param attributeName Name of the attribute. | ||
| */ | ||
| public shouldBeExcludedFromAAD(attributeName: string) { | ||
| return ( | ||
| this.shouldBeEncrypted(attributeName) || | ||
| (this.attributesToExcludeFromAAD != null && | ||
| this.attributesToExcludeFromAAD.has(attributeName)) | ||
| ); | ||
| } | ||
|
|
||
| /** | ||
| * Determines whether particular attribute should be stripped from the attribute list. | ||
| * @param attributeName Name of the attribute. | ||
| */ | ||
| public shouldBeStripped(attributeName: string) { | ||
| return this.attributesToStrip.has(attributeName); | ||
| } | ||
| } |
Oops, something went wrong.