keep/src/Vaults/AbstractVault.php at cdf156bbae03efb1fd26720eb0cf85b1f7ddd31b · stechstudio/keep · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
<?php

namespace STS\Keep\Vaults;

use Exception;
use Illuminate\Support\Str;
use STS\Keep\Data\Collections\FilterCollection;
use STS\Keep\Data\Collections\SecretCollection;
use STS\Keep\Data\Collections\SecretHistoryCollection;
use STS\Keep\Data\Secret;

abstract class AbstractVault
{
    public const string DRIVER = '';

    public const string NAME = '';

    public function __construct(protected string $name, protected array $config, protected string $env) {}

    public function name(): string
    {
        return $this->name;
    }

    public function slug(): string
    {
        return Str::slug($this->name());
    }

    public function env(): string
    {
        return $this->env;
    }

    abstract public function list(): SecretCollection;

    abstract public function has(string $key): bool;

    abstract public function get(string $key): Secret;

    abstract public function set(string $key, string $value, bool $secure = true): Secret;

    abstract public function save(Secret $secret): Secret;

    abstract public function delete(string $key): bool;

    abstract public function history(string $key, FilterCollection $filters, ?int $limit = 10): SecretHistoryCollection;

    public function rename(string $oldKey, string $newKey): Secret
    {
        $oldSecret = $this->get($oldKey);
        if ($this->has($newKey)) {
            throw new \STS\Keep\Exceptions\KeepException(
                sprintf('Cannot rename: secret [%s] already exists', $newKey)
            );
        }

        $newSecret = $this->set($newKey, $oldSecret->value(), $oldSecret->isSecure());

        try {
            $this->delete($oldKey);
        } catch (Exception $e) {
            try {
                $this->delete($newKey);
            } catch (Exception) {
            }

            throw new \STS\Keep\Exceptions\KeepException(
                sprintf('Rename failed: could not delete original secret [%s] after creating [%s]. Rolled back.', $oldKey, $newKey),
            );
        }

        return $newSecret;
    }

    public function testPermissions(): array
    {
        $permissions = [
            'Read' => false,
            'Write' => false,
            'List' => false,
            'Delete' => false,
            'History' => false,
        ];

        $testKey = 'keep-verify-'.bin2hex(random_bytes(4));
        $writeSucceeded = false;
        $existingSecrets = null;

        try {
            $existingSecrets = $this->list();
            $permissions['List'] = true;
        } catch (Exception) {
        }

        try {
            $this->set($testKey, 'test_value');
            $permissions['Write'] = true;
            $writeSucceeded = true;
        } catch (Exception) {
        }

        if ($writeSucceeded) {
            try {
                $secret = $this->get($testKey);
                $permissions['Read'] = ($secret->value() === 'test_value');
            } catch (Exception) {
            }
        } elseif ($permissions['List'] && $existingSecrets && $existingSecrets->count() > 0) {
            try {
                $firstSecret = $existingSecrets->first();
                $this->get($firstSecret->key());
                $permissions['Read'] = true;
            } catch (Exception) {
            }
        }

        if ($writeSucceeded) {
            try {
                $this->history($testKey, new FilterCollection(), 10);
                $permissions['History'] = true;
            } catch (Exception) {
            }
        } elseif ($permissions['List'] && $existingSecrets && $existingSecrets->count() > 0) {
            try {
                $firstSecret = $existingSecrets->first();
                $this->history($firstSecret->key(), new FilterCollection(), 10);
                $permissions['History'] = true;
            } catch (Exception) {
            }
        }

        if ($writeSucceeded) {
            try {
                $this->delete($testKey);
                $permissions['Delete'] = true;
            } catch (Exception $e) {
                error_log("Warning: Failed to clean up verify test key '{$testKey}' in vault '{$this->name()}': ".$e->getMessage());
                $permissions['Delete'] = false;
            }
        }

        return $permissions;
    }
}