k2safe/orbit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: let administrators view and copy encrypted integration credentials

Browse Source
This commit is contained in:
k2safe
2026-09-27 13:48:26 +08:00
parent 5555a7b342
commit d54bdd9847
38 changed files with 905 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
cmd/orbit-admin/credentials.go
View File

@@ -13,6 +13,7 @@ import (
"time"
"git.yuntuo.hk/k2safe/orbit/internal/config"
"git.yuntuo.hk/k2safe/orbit/internal/credentialvault"
"git.yuntuo.hk/k2safe/orbit/internal/storage/mysql"
core "git.yuntuo.hk/k2safe/orbit/model"
)
@@ -112,7 +113,11 @@ func runCredentialChange(args []string, action string) error {
if err := writePrivateOperation(output, op); err != nil {
return err
}
receipt, err := mysql.ApplyCredentialOperation(ctx, db, op)
vault, err := credentialvault.LoadFile(os.Getenv("ORBIT_CREDENTIAL_KEY_FILE"))
if err != nil {
return err
}
receipt, err := mysql.ApplyCredentialOperation(ctx, db, op, vault)
if err != nil {
return errors.New("credential operation was not confirmed; the private operation file was retained for reconciliation")
}
@@ -138,7 +143,11 @@ func runCredentialApply(args []string) error {
return err
}
defer closeDB()
receipt, err := mysql.ApplyCredentialOperation(ctx, db, op)
vault, err := credentialvault.LoadFile(os.Getenv("ORBIT_CREDENTIAL_KEY_FILE"))
if err != nil {
return err
}
receipt, err := mysql.ApplyCredentialOperation(ctx, db, op, vault)
if err != nil {
return errors.New("credential operation was not confirmed; retry with the same private operation file")
}

9
cmd/orbit-admin/main.go
View File

@@ -15,6 +15,7 @@ import (
"git.yuntuo.hk/k2safe/orbit/internal/buildinfo"
"git.yuntuo.hk/k2safe/orbit/internal/config"
"git.yuntuo.hk/k2safe/orbit/internal/credentialvault"
"git.yuntuo.hk/k2safe/orbit/internal/storage/mysql"
core "git.yuntuo.hk/k2safe/orbit/model"
)
@@ -306,6 +307,10 @@ func runBootstrap(args []string) error {
if err != nil {
return err
}
vault, err := credentialvault.LoadFile(cfg.CredentialKeyFile)
if err != nil {
return err
}
file, err := os.OpenFile(output, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600)
if err != nil {
return errors.New("cannot create new private output file (existing files are never overwritten)")
@@ -345,14 +350,14 @@ func runBootstrap(args []string) error {
}
delivered = true
return nil
})
}, vault)
if err != nil {
if delivered {
return errors.New("bootstrap commit could not be confirmed; private output was retained; verify its credential before retrying")
}
return errors.New("bootstrap failed before credential delivery; check schema, names and database access")
}
fmt.Println("Bootstrap committed. Credentials saved in the requested private file; valid for 30 days.")
fmt.Println("Bootstrap committed. Credentials saved in the requested private file; expiry follows --valid-for (default: permanent).")
return nil
}

10
cmd/orbit/main.go
View File

@@ -12,6 +12,7 @@ import (
"time"
"git.yuntuo.hk/k2safe/orbit/internal/config"
"git.yuntuo.hk/k2safe/orbit/internal/credentialvault"
"git.yuntuo.hk/k2safe/orbit/internal/observability"
"git.yuntuo.hk/k2safe/orbit/internal/retention"
"git.yuntuo.hk/k2safe/orbit/internal/storage/mysql"
@@ -41,6 +42,13 @@ func run() error {
if err != nil {
return err
}
vault, err := credentialvault.LoadFile(cfg.CredentialKeyFile)
if err != nil {
return err
}
if cfg.ConsoleApplicationAdmin != "" && vault == nil {
return errors.New("ORBIT_CREDENTIAL_KEY_FILE is required for console application administration")
}
root, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
defer stop()
startup, cancel := context.WithTimeout(root, 10*time.Second)
@@ -125,7 +133,7 @@ func run() error {
httpserver.RegisterWorkflows(server, instance.New(mysql.NewWorkflowInstanceStore(db)), control.New(mysql.NewWorkflowControlStore(db)), weavesignal.New(mysql.NewWorkflowSignalStore(db)), recovery.New(mysql.NewWorkflowRecoveryStore(db)))
httpserver.RegisterConsoleRetention(server, consoleAuth, retentionStore, retentionStore)
httpserver.RegisterConsoleArchiveJobs(server, consoleAuth, retentionStore, cfg.ArchiveStorageID)
consoleApplications := mysql.NewConsoleApplicationStore(db, cfg.ConsoleApplicationAdmin)
consoleApplications := mysql.NewConsoleApplicationStore(db, cfg.ConsoleApplicationAdmin, vault)
httpserver.RegisterConsoleApplications(server, consoleAuth, consoleApplications)
httpserver.RegisterConsoleScopes(server, consoleApplications)
httpserver.WrapConsoleAuth(server, consoleAuth, consoleApplications)