k2safe/orbit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: let administrators view and copy encrypted integration credentials

Browse Source
This commit is contained in:
k2safe
2026-09-27 13:48:26 +08:00
parent 5555a7b342
commit d54bdd9847
38 changed files with 905 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
cmd/orbit-admin/credentials.go
View File

@@ -13,6 +13,7 @@ import (
"time"
"git.yuntuo.hk/k2safe/orbit/internal/config"
"git.yuntuo.hk/k2safe/orbit/internal/credentialvault"
"git.yuntuo.hk/k2safe/orbit/internal/storage/mysql"
core "git.yuntuo.hk/k2safe/orbit/model"
)
@@ -112,7 +113,11 @@ func runCredentialChange(args []string, action string) error {
if err := writePrivateOperation(output, op); err != nil {
return err
}
receipt, err := mysql.ApplyCredentialOperation(ctx, db, op)
vault, err := credentialvault.LoadFile(os.Getenv("ORBIT_CREDENTIAL_KEY_FILE"))
if err != nil {
return err
}
receipt, err := mysql.ApplyCredentialOperation(ctx, db, op, vault)
if err != nil {
return errors.New("credential operation was not confirmed; the private operation file was retained for reconciliation")
}
@@ -138,7 +143,11 @@ func runCredentialApply(args []string) error {
return err
}
defer closeDB()
receipt, err := mysql.ApplyCredentialOperation(ctx, db, op)
vault, err := credentialvault.LoadFile(os.Getenv("ORBIT_CREDENTIAL_KEY_FILE"))
if err != nil {
return err
}
receipt, err := mysql.ApplyCredentialOperation(ctx, db, op, vault)
if err != nil {
return errors.New("credential operation was not confirmed; retry with the same private operation file")
}

9
cmd/orbit-admin/main.go
View File

@@ -15,6 +15,7 @@ import (
"git.yuntuo.hk/k2safe/orbit/internal/buildinfo"
"git.yuntuo.hk/k2safe/orbit/internal/config"
"git.yuntuo.hk/k2safe/orbit/internal/credentialvault"
"git.yuntuo.hk/k2safe/orbit/internal/storage/mysql"
core "git.yuntuo.hk/k2safe/orbit/model"
)
@@ -306,6 +307,10 @@ func runBootstrap(args []string) error {
if err != nil {
return err
}
vault, err := credentialvault.LoadFile(cfg.CredentialKeyFile)
if err != nil {
return err
}
file, err := os.OpenFile(output, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0600)
if err != nil {
return errors.New("cannot create new private output file (existing files are never overwritten)")
@@ -345,14 +350,14 @@ func runBootstrap(args []string) error {
}
delivered = true
return nil
})
}, vault)
if err != nil {
if delivered {
return errors.New("bootstrap commit could not be confirmed; private output was retained; verify its credential before retrying")
}
return errors.New("bootstrap failed before credential delivery; check schema, names and database access")
}
fmt.Println("Bootstrap committed. Credentials saved in the requested private file; valid for 30 days.")
fmt.Println("Bootstrap committed. Credentials saved in the requested private file; expiry follows --valid-for (default: permanent).")
return nil
}