+ remove deprecated stuff

+ zeroize secret

.gitignore

@@ -7,5 +7,6 @@
 *.pdf
 target/
 go_client/openapi.json
-
+crates/storage-sled/sled_db
-*.db*
+test.db
+src/storage/database.db

.sqlx/query-047ebbce6fa0073cc810b189e8db3ff5e4eb347f1c1d9e5408220411a9e08b00.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n        UPDATE kv2_secret_version\n        SET deletion_time = $4\n        WHERE engine_path = $1 AND secret_path = $2\n            AND version_number = $3\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 4
-    },
-    "nullable": []
-  },
-  "hash": "047ebbce6fa0073cc810b189e8db3ff5e4eb347f1c1d9e5408220411a9e08b00"
-}

.sqlx/query-0aa5c76c9ea1692da29a0f39998946d230f92a8f252294b25afeabe05749f4ca.json

@@ -1,44 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT service_token.* FROM service_token, service_token_role_membership\n                          WHERE service_token.id = service_token_role_membership.token_id AND\n                                service_token_role_membership.role_name = 'root'\n                          LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "name": "id",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "key",
-        "ordinal": 1,
-        "type_info": "Text"
-      },
-      {
-        "name": "expiry",
-        "ordinal": 2,
-        "type_info": "Integer"
-      },
-      {
-        "name": "parent_id",
-        "ordinal": 3,
-        "type_info": "Text"
-      },
-      {
-        "name": "identity_id",
-        "ordinal": 4,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 0
-    },
-    "nullable": [
-      false,
-      false,
-      true,
-      true,
-      true
-    ]
-  },
-  "hash": "0aa5c76c9ea1692da29a0f39998946d230f92a8f252294b25afeabe05749f4ca"
-}

.sqlx/query-2cbe2fbcd5d8fb6d489f9e3cc7e04182f226964ea9d84219abbe6958dcccfefe.json

@@ -1,44 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT * FROM 'service_token' WHERE key = $1 AND (expiry IS NULL OR expiry > $2) LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "name": "id",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "key",
-        "ordinal": 1,
-        "type_info": "Text"
-      },
-      {
-        "name": "expiry",
-        "ordinal": 2,
-        "type_info": "Integer"
-      },
-      {
-        "name": "parent_id",
-        "ordinal": 3,
-        "type_info": "Text"
-      },
-      {
-        "name": "identity_id",
-        "ordinal": 4,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": [
-      false,
-      false,
-      true,
-      true,
-      true
-    ]
-  },
-  "hash": "2cbe2fbcd5d8fb6d489f9e3cc7e04182f226964ea9d84219abbe6958dcccfefe"
-}

.sqlx/query-36485bb70f499346cd1be569887ea8b6f438f4f845ef883e80d58875b839500a.json

@@ -1,26 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT * FROM 'service_token_role_membership' WHERE token_id = $1",
-  "describe": {
-    "columns": [
-      {
-        "name": "role_name",
-        "ordinal": 0,
-        "type_info": "Text"
-      },
-      {
-        "name": "token_id",
-        "ordinal": 1,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 1
-    },
-    "nullable": [
-      false,
-      false
-    ]
-  },
-  "hash": "36485bb70f499346cd1be569887ea8b6f438f4f845ef883e80d58875b839500a"
-}

.sqlx/query-414c74a3c017bde424fe44bbc251fea384b0dbedd1541900d147e0814c1f33d8.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n        SELECT version_number AS latest_version FROM kv2_secret_version\n        WHERE engine_path = $1 AND secret_path = $2 AND deletion_time IS NULL\n        ORDER BY version_number DESC LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "name": "latest_version",
-        "ordinal": 0,
-        "type_info": "Integer"
-      }
-    ],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "414c74a3c017bde424fe44bbc251fea384b0dbedd1541900d147e0814c1f33d8"
-}

.sqlx/query-5630a591626bd416be0d1ab12fa993055b521e81382897d247ceee1b41f0bf42.json

@@ -1,32 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT encrypted_key, type as protection_type, nonce FROM root_key ORDER BY version LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "name": "encrypted_key",
-        "ordinal": 0,
-        "type_info": "Blob"
-      },
-      {
-        "name": "protection_type",
-        "ordinal": 1,
-        "type_info": "Text"
-      },
-      {
-        "name": "nonce",
-        "ordinal": 2,
-        "type_info": "Blob"
-      }
-    ],
-    "parameters": {
-      "Right": 0
-    },
-    "nullable": [
-      false,
-      false,
-      true
-    ]
-  },
-  "hash": "5630a591626bd416be0d1ab12fa993055b521e81382897d247ceee1b41f0bf42"
-}

.sqlx/query-8f7bfd1840d14efec44c7b59ab10461ff122ead43076ad841883a9dd189a4f37.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\nWITH latest_version AS (\n    SELECT MAX(version_number) AS max_version\n    FROM kv2_secret_version\n    WHERE engine_path = $1 AND secret_path = $2 -- engine_path AND secret_path\n)\nINSERT INTO kv2_secret_version (engine_path, secret_path, nonce, encrypted_data, created_time, version_number)\nVALUES (\n    $1, -- engine_path\n    $2, -- secret_path\n    $3, -- nonce\n    $4, -- encrypted_data\n    $5, -- created_time\n    CASE -- Use provided version if given\n        WHEN $6 IS NOT NULL THEN $6 -- version_number (optional)\n        ELSE COALESCE((SELECT max_version FROM latest_version) + 1, 1) -- otherwise 1\n    END -- version_number logic\n)\nRETURNING version_number;\n",
-  "describe": {
-    "columns": [
-      {
-        "name": "version_number",
-        "ordinal": 0,
-        "type_info": "Integer"
-      }
-    ],
-    "parameters": {
-      "Right": 6
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "8f7bfd1840d14efec44c7b59ab10461ff122ead43076ad841883a9dd189a4f37"
-}

.sqlx/query-9265f0195bbacd15061927c2a6034e3725a25068fd3faa08cc1d02e7c926f1c2.json

@@ -1,20 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT engine_type FROM secret_engines WHERE mount_point = $1",
-  "describe": {
-    "columns": [
-      {
-        "name": "engine_type",
-        "ordinal": 0,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 1
-    },
-    "nullable": [
-      false
-    ]
-  },
-  "hash": "9265f0195bbacd15061927c2a6034e3725a25068fd3faa08cc1d02e7c926f1c2"
-}

.sqlx/query-aa131c57e0e255bfe07488095bdf25ab39e9dee182d0aecf988c9d3c2d04e66d.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n        INSERT INTO root_key (encrypted_key, type, version, nonce)\n        VALUES ($1, $2, 1, $3)\n        ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 3
-    },
-    "nullable": []
-  },
-  "hash": "aa131c57e0e255bfe07488095bdf25ab39e9dee182d0aecf988c9d3c2d04e66d"
-}

.sqlx/query-af57fe92ead35790b02f38f34e1614cd1accb2da61f1d9a07eeefb0fc31ec318.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n        INSERT INTO kv2_metadata (engine_path, secret_path, cas_required, created_time, max_versions, updated_time)\n        VALUES ($1, $2, 0, $3, 100, $3)\n        ON CONFLICT(engine_path, secret_path) DO NOTHING;\n    ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 3
-    },
-    "nullable": []
-  },
-  "hash": "af57fe92ead35790b02f38f34e1614cd1accb2da61f1d9a07eeefb0fc31ec318"
-}

.sqlx/query-b78c62fe22c4e93c54ecbc0c0cdfa31387baf14bea1ac8d27170e8b6cb456114.json

@@ -1,50 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT nonce, encrypted_data, created_time, deletion_time, version_number, secret_path\n            FROM kv2_secret_version WHERE engine_path = $1 AND secret_path = $2 AND deletion_time IS NULL\n            ORDER BY version_number DESC LIMIT 1",
-  "describe": {
-    "columns": [
-      {
-        "name": "nonce",
-        "ordinal": 0,
-        "type_info": "Blob"
-      },
-      {
-        "name": "encrypted_data",
-        "ordinal": 1,
-        "type_info": "Blob"
-      },
-      {
-        "name": "created_time",
-        "ordinal": 2,
-        "type_info": "Datetime"
-      },
-      {
-        "name": "deletion_time",
-        "ordinal": 3,
-        "type_info": "Datetime"
-      },
-      {
-        "name": "version_number",
-        "ordinal": 4,
-        "type_info": "Integer"
-      },
-      {
-        "name": "secret_path",
-        "ordinal": 5,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 2
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true,
-      false,
-      false
-    ]
-  },
-  "hash": "b78c62fe22c4e93c54ecbc0c0cdfa31387baf14bea1ac8d27170e8b6cb456114"
-}

.sqlx/query-fa8c74205ae4d497983d394ee04181c08d20cdb4a93bfce3c06a114133cd6619.json

@@ -1,50 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "SELECT nonce, encrypted_data, created_time, deletion_time, version_number, secret_path\n            FROM kv2_secret_version WHERE engine_path = $1 AND secret_path = $2 AND deletion_time IS NULL\n                AND version_number = $3",
-  "describe": {
-    "columns": [
-      {
-        "name": "nonce",
-        "ordinal": 0,
-        "type_info": "Blob"
-      },
-      {
-        "name": "encrypted_data",
-        "ordinal": 1,
-        "type_info": "Blob"
-      },
-      {
-        "name": "created_time",
-        "ordinal": 2,
-        "type_info": "Datetime"
-      },
-      {
-        "name": "deletion_time",
-        "ordinal": 3,
-        "type_info": "Datetime"
-      },
-      {
-        "name": "version_number",
-        "ordinal": 4,
-        "type_info": "Integer"
-      },
-      {
-        "name": "secret_path",
-        "ordinal": 5,
-        "type_info": "Text"
-      }
-    ],
-    "parameters": {
-      "Right": 3
-    },
-    "nullable": [
-      false,
-      false,
-      false,
-      true,
-      false,
-      false
-    ]
-  },
-  "hash": "fa8c74205ae4d497983d394ee04181c08d20cdb4a93bfce3c06a114133cd6619"
-}

.sqlx/query-fe6bf34448b9f9defc27ce30a128935d991cd06e22861086c3b1377916731e57.json

@@ -1,12 +0,0 @@
-{
-  "db_name": "SQLite",
-  "query": "\n                    INSERT INTO service_token (id, key) VALUES ($1, $2);\n                    INSERT INTO service_token_role_membership (token_id, role_name) VALUES ($3, 'root');\n            ",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Right": 3
-    },
-    "nullable": []
-  },
-  "hash": "fe6bf34448b9f9defc27ce30a128935d991cd06e22861086c3b1377916731e57"
-}

Cargo.toml

@@ -1,44 +1,32 @@
 [package]
 name = "rvault-server"
 version = "0.1.0"
-edition = "2024"
+edition = "2021"
-
-[features]
-default = ["shamir"]
-# default = ["insecure-dev-sealing"]
-insecure-dev-sealing = []
-shamir = ["vsss-rs", "p256"]
 
 [dependencies]
-log = "0.4.27"
+log = "0.4.21"
-env_logger = "0.11.7"
+env_logger = "0.11.3"
-zeroize = { version = "1.8.1", features = ["zeroize_derive"] }
+zeroize = { version = "1.7.0", features = ["derive"]}
-time = { version = "0.3.41", features = ["serde", "formatting"]}
+chrono = { version = "0.4.38", features = ["serde"] }
-tokio = { version = "1.44.1", features = ["full"] }
+tokio = { version = "1.37.0", features = ["full"] }
-tower = { version = "0.5.2", features = [] }
+tower = { version = "0.4.13", features = [] }
-axum = "0.8.3"
+axum = "0.7.5"
-serde = "1.0.219"
+serde = "1.0.201"
-serde_json = "1.0.140"
+serde_json = "1.0.117"
-dotenvy = "0.15.7"
+# json-patch = "2.0.0"
-base64 = "0.22.1"
+# serde_with = "3.8.1"
 
 # utoipa = { version = "4.2.0", features = ["axum_extras"] }
-sqlx = { version = "0.8.3", features = [
+sqlx = { version = "0.7.4", features = [
     "sqlite",
     # "postgres",
     # "any",
+    "chrono",
     "macros",
     "runtime-tokio",
     "tls-rustls",
-    "time"
 ] }
 
-aes-gcm-siv = "0.11.1"
-vsss-rs = { version = "5.1.0", optional = true, default-features = false, features = ["zeroize", "std"] }
-p256 = { version = "0.13.2", optional = true, default-features = false, features = ["std", "ecdsa"] }
-rand = "0.8.5"
-uuid = { version = "1.16.0", features = ["v4"] }
-
 [lints]
 workspace = true
 

Containerfile

@@ -1,12 +1,9 @@
-ARG alpine_version=3.22
+FROM docker.io/library/rust:1-alpine3.19 AS builder
-
-FROM docker.io/library/rust:1-alpine${alpine_version} AS builder
 
 WORKDIR /src
 RUN apk add --no-cache musl-dev
 
 RUN cargo install sqlx-cli --no-default-features --features sqlite
-# Required for compile-time schemata checks of migrations
 ENV DATABASE_URL=sqlite:/tmp/rvault.db
 RUN touch /tmp/rvault.db
 
@@ -16,7 +13,6 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
     cargo fetch --locked --target $(rustc -vV | sed -n 's|host: ||p') && \
     rm src/main.rs
 
-# Required for compile-time checks of query - database-schema compatibility 
 COPY migrations migrations
 RUN cargo sqlx migrate run
 
@@ -24,9 +20,9 @@ COPY src src
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     cargo build --release --locked
 
-FROM docker.io/library/alpine:${alpine_version} AS runner
+FROM docker.io/library/alpine:3.19 AS runner
 # FROM scratch AS runner
 
-COPY --from=builder /src/target/release/rvault-server /usr/bin/rvault-server
+COPY --from=builder /src/target/release/rvault-server /usr/local/bin/rvault-server
 
-CMD ["/usr/bin/rvault-server"]
+CMD ["/usr/local/bin/rvault-server"]

Justfile

@@ -1,6 +1,6 @@
 
 build_tests:
-    podman build -t rvault-go-tests -f ./go_tests/Containerfile ./go_tests
+    podman build -t rvault-go-tests -f ./go_client/Containerfile ./go_client
 
 run_tests: build_tests
     podman run --rm -it --net=host rvault-go-tests

README.md

@@ -1,30 +0,0 @@
-
-# rvault
-
-rvault is an open-source implementation of the API of Vault and OpenBao, written in Rust.
-
-## Running
-
-You can run an offline build with `SQLX_OFFLINE=true cargo run` or `build`, respectively.
-An offline build requires an up-to-date SQLx preparation.
-
-An OCI container image can be created using `podman build . -t rvault`.
-
-Furthermore, rvault attempts to read a `.env` file in the current working directory.
-For example, its content could be:
-
-```txt
-DATABASE_URL=sqlite:test.db
-RUST_LOG=debug
-```
-
-## Development
-
-SQLx preparation can be updated with `cargo sqlx prep`.
-Hence, it is not useful for development.
-With `cargo sqlx database reset` the database will be recreated,
-deleting all contents and reapplying migrations.
-This is helpful when changing migrations during development.
-
-When running a normal, not-offline, build, the database must be migrated (e.g. using `cargo sqlx database reset`)
-for compilation of compile-time-checked queries.

go_client/Containerfile

@@ -8,6 +8,7 @@ RUN go mod download
 COPY . .
 # RUN go build -o /app
 RUN go build
+# CMD export GOCACHE=off
 CMD go test tests/*
 
 # FROM docker.io/library/alpine:3.19

go_client/go.mod

@@ -0,0 +1,16 @@
+module github.com/C0ffeeCode/rvault/go_client
+
+go 1.21.9
+
+require github.com/hashicorp/vault-client-go v0.4.3
+
+require (
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.5 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
+	golang.org/x/sys v0.19.0 // indirect
+	golang.org/x/time v0.5.0 // indirect
+)

go_client/go.sum

@@ -0,0 +1,29 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
+github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
+github.com/hashicorp/go-hclog v0.9.2 h1:CG6TE5H9/JXsFWJCfoIVpKFIkFe6ysEuHirp4DxCsHI=
+github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
+github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT9yvm0e+Nd5M=
+github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8=
+github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
+github.com/hashicorp/vault-client-go v0.4.3 h1:zG7STGVgn/VK6rnZc0k8PGbfv2x/sJExRKHSUg3ljWc=
+github.com/hashicorp/vault-client-go v0.4.3/go.mod h1:4tDw7Uhq5XOxS1fO+oMtotHL7j4sB9cp0T7U6m4FzDY=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
+github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

go_client/main.go

@@ -0,0 +1,29 @@
+package main
+
+import (
+	"log"
+	"log/slog"
+	"time"
+
+	"github.com/hashicorp/vault-client-go"
+)
+
+// vault cmd args: >vault server -dev -dev-root-token-id="my-token"
+
+func main() {
+	slog.Info("run tests in tests/ with >go test")
+	// prepare a client with the given base address
+	client, err := vault.New(
+		vault.WithAddress("http://localhost:8200"),
+		vault.WithRequestTimeout(30*time.Second),
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+	log.Println("client prepared")
+
+	// authenticate with a root token (insecure)
+	if err := client.SetToken("my-token"); err != nil {
+		log.Fatal(err)
+	}
+}

go_client/tests/secret_test.go

@@ -0,0 +1,151 @@
+package tests
+
+import (
+	"context"
+	"log"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/hashicorp/vault-client-go"
+	"github.com/hashicorp/vault-client-go/schema"
+)
+
+var client *vault.Client
+var ctx context.Context
+
+// Apparently used as a default if mountpath is an empty string (client library)
+var mountpath = "/kv-v2"
+var mountpath2 = "/some"
+
+func TestMain(m *testing.M) {
+	ctx = context.Background()
+	var err error
+	// prepare a client with the given base address
+	client, err = vault.New(
+		vault.WithAddress("http://localhost:8200"),
+		vault.WithRequestTimeout(30*time.Second),
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+	log.Println("client prepared")
+
+	// authenticate with a root token (insecure)
+	if err := client.SetToken("my-token"); err != nil {
+		log.Fatal(err)
+	}
+
+	exitCode := m.Run() // run all tests and get code
+	os.Exit(exitCode)
+}
+
+// https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#create-update-secret
+func TestWriteSecret(t *testing.T) {
+	// Path foo
+	_, err := client.Secrets.KvV2Write(ctx, "foo", schema.KvV2WriteRequest{
+		Data: map[string]any{
+			"password1": "123abc",
+			"password2": "horse horse horse battery staple correct",
+		}},
+		vault.WithMountPath(mountpath),
+	)
+	if err != nil {
+		log.Fatal("kv2: Failed to write secret:\n\t", err)
+	}
+	log.Println("kv2: Tried to write Secret at foo at mountpath: ", mountpath)
+
+	// Path bar
+	_, err = client.Secrets.KvV2Write(ctx, "bar", schema.KvV2WriteRequest{
+		Data: map[string]any{
+			"password1": "abc123",
+			"password2": "correct horse battery staple",
+		}},
+		vault.WithMountPath(mountpath),
+	)
+	if err != nil {
+		log.Fatal("kv2: Failed to write secret:\n\t", err)
+	}
+	log.Println("kv2: Tried to write Secret at bar at mountpath: ", mountpath)
+}
+
+func TestWriteSecret2(t *testing.T) {
+	// Path foo
+	_, err := client.Secrets.KvV2Write(ctx, "foo", schema.KvV2WriteRequest{
+		Data: map[string]any{
+			"password1": "123abc",
+			"password2": "horse horse horse battery staple correct",
+		}},
+		vault.WithMountPath(mountpath2),
+	)
+	if err != nil {
+		log.Fatal("kv2: Failed to write secret:\n\t", err)
+	}
+	log.Println("kv2: Tried to write Secret at foo at mountpath: ", mountpath2)
+
+	// Path bar
+	_, err = client.Secrets.KvV2Write(ctx, "bar", schema.KvV2WriteRequest{
+		Data: map[string]any{
+			"password1": "abc123",
+			"password2": "correct horse battery staple",
+		}},
+		vault.WithMountPath(mountpath2),
+	)
+	if err != nil {
+		log.Fatal("kv2: Failed to write secret:\n\t", err)
+	}
+	log.Println("kv2: Tried to write Secret at foo at mountpath: ", mountpath2)
+}
+
+func TestReadSecret(t *testing.T) {
+	_, err := client.Secrets.KvV2Read(ctx, "bar")
+	if err != nil {
+		log.Fatal("kv2: Failed to read secret:\n\t", err)
+	}
+}
+
+func TestReadMeta(t *testing.T) {
+	_, err := client.Secrets.KvV2ReadMetadata(ctx, "bar")
+	if err != nil {
+		log.Fatal("kv2: Failed to read metadata:\n\t", err)
+	}
+}
+
+func TestWriteAndReadMeta(t *testing.T) {
+	meta := schema.KvV2WriteMetadataRequest{
+		MaxVersions:        5,
+		CasRequired:        false,
+		DeleteVersionAfter: "3h25m19s",
+		CustomMetadata: map[string]interface{}{
+			"foo": "abc",
+			"bar": "123",
+			"baz": "5c07d823-3810-48f6-a147-4c06b5219e84",
+		},
+	}
+	_, err := client.Secrets.KvV2WriteMetadata(ctx, "newMeta", meta)
+	if err != nil {
+		log.Fatal("kv2: Failed to write metadata:\n\t", err)
+	}
+
+	// read the metadata
+	_, err2 := client.Secrets.KvV2ReadMetadata(ctx, "newMeta")
+	if err2 != nil {
+		log.Fatal("kv2: Failed to read metadata:\n\t", err)
+	}
+}
+
+// does NOT revert destruction
+func TestDestroySecret(t *testing.T) {
+	_, err := client.Secrets.KvV2DestroyVersions(ctx, "bar", schema.KvV2DestroyVersionsRequest{Versions: []int32{1}})
+	if err != nil {
+		log.Fatal("kv2: Failed to destroy secret:\n\t", err)
+	}
+}
+
+// does NOT revert destruction
+func TestDestroySecret2(t *testing.T) {
+	_, err := client.Secrets.KvV2DestroyVersions(ctx, "bar", schema.KvV2DestroyVersionsRequest{Versions: []int32{1, 2}})
+	if err != nil {
+		log.Fatal("kv2: Failed to destroy secret:\n\t", err)
+	}
+}

go_tests/go.mod

@@ -1,32 +0,0 @@
-module github.com/C0ffeeCode/rvault/go_client
-
-go 1.21.9
-
-// require github.com/hashicorp/vault-client-go v0.4.3
-
-require (
-	github.com/hashicorp/vault-client-go v0.4.3
-	github.com/hashicorp/vault/api v1.16.0
-)
-
-require (
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
-	github.com/go-jose/go-jose/v4 v4.0.1 // indirect
-	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
-	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 // indirect
-	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
-	github.com/hashicorp/hcl v1.0.0 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/ryanuber/go-glob v1.0.0 // indirect
-	golang.org/x/crypto v0.32.0 // indirect
-	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/sys v0.29.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-)

go_tests/go.sum

@@ -1,81 +0,0 @@
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
-github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
-github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
-github.com/go-jose/go-jose/v4 v4.0.1 h1:QVEPDE3OluqXBQZDcnNvQrInro2h0e4eqNbnZSWqS6U=
-github.com/go-jose/go-jose/v4 v4.0.1/go.mod h1:WVf9LFMHh/QVrmqrOfqun0C45tMe3RoiKJMPvgWwLfY=
-github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
-github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
-github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
-github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
-github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
-github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
-github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
-github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
-github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
-github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6 h1:om4Al8Oy7kCm/B86rLCLah4Dt5Aa0Fr5rYBG60OzwHQ=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.6/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
-github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
-github.com/hashicorp/vault-client-go v0.4.3 h1:zG7STGVgn/VK6rnZc0k8PGbfv2x/sJExRKHSUg3ljWc=
-github.com/hashicorp/vault-client-go v0.4.3/go.mod h1:4tDw7Uhq5XOxS1fO+oMtotHL7j4sB9cp0T7U6m4FzDY=
-github.com/hashicorp/vault/api v1.16.0 h1:nbEYGJiAPGzT9U4oWgaaB0g+Rj8E59QuHKyA5LhwQN4=
-github.com/hashicorp/vault/api v1.16.0/go.mod h1:KhuUhzOD8lDSk29AtzNjgAu2kxRA9jL9NAbkFlqvkBA=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
-github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
-github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
-github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
-github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
-github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
-github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
-github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

go_tests/main.go

@@ -1,26 +0,0 @@
-package main
-
-import (
-	"log/slog"
-	// "github.com/openbao/openbao"
-)
-
-// vault cmd args: >vault server -dev -dev-root-token-id="my-token"
-
-func main() {
-	slog.Info("run tests in tests/ with >go test")
-	// // prepare a client with the given base address
-	// client, err := vault.New(
-	// 	vault.WithAddress("http://localhost:8200"),
-	// 	vault.WithRequestTimeout(30*time.Second),
-	// )
-	// if err != nil {
-	// 	log.Fatal(err)
-	// }
-	// log.Println("client prepared")
-
-	// // authenticate with a root token (insecure)
-	// if err := client.SetToken("my-token"); err != nil {
-	// 	log.Fatal(err)
-	// }
-}

go_tests/tests/secret_test.go

@@ -1,123 +0,0 @@
-package tests
-
-import (
-	"context"
-	"log"
-	"os"
-	"reflect"
-	"testing"
-	"time"
-
-	// "github.com/hashicorp/vault-client-go"
-	// "github.com/hashicorp/vault-client-go/schema"
-	vault "github.com/hashicorp/vault/api"
-	// vault "github.com/openbao/openbao/api/v2"
-)
-
-var Client *vault.Client
-var ctx context.Context
-
-func TestMain(m *testing.M) {
-	ctx = context.Background()
-	var err error
-
-	config := vault.DefaultConfig()
-	config.Address = "http://localhost:8200"
-	config.Timeout = 30 * time.Second
-
-	// prepare a client with the given base address
-	Client, err = vault.NewClient(config)
-	if err != nil {
-		log.Fatalf("unable to initialize Vault client: %v", err)
-	}
-	log.Println("client prepared")
-
-	// authenticate with a root token (insecure)
-	Client.SetToken("my-token")
-
-	exitCode := m.Run() // run all tests and get code
-	os.Exit(exitCode)
-}
-
-// Requires in-code portions
-// func TestUnseal(t *testing.T) {
-// 	abc := []string{
-// 		"eyJpIjpbMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwxXSwidiI6WzE4OCw2NiwxMTksMTQ0LDE1OSw3MCw4NiwxMTUsMTIwLDI1MywxMjQsOTYsMTM5LDk0LDQ1LDE2NiwyMTMsMzYsMTE1LDU4LDg5LDE0OCw2MCwyOCwxNTAsMTE2LDU3LDg5LDIwMCw5NywxNDYsMjEzXX0=",
-// 		"eyJpIjpbMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwyXSwidiI6WzE1OCwyNDQsNzEsOTUsMTIyLDEzOCwyNDEsMjEzLDQ1LDE1NiwxMTgsNCwxNzYsNiwxNTcsMTkyLDE2MSwxNjEsNDMsMTc1LDE5NSw4NywxODAsMTAwLDE1NiwxNCwxNDgsMTUsMTc4LDkwLDY3LDExOF19",
-// 	}
-// 	for i := range abc {
-// 		if _, err := Client.Sys().Unseal(abc[i]); err != nil {
-// 			t.Fatal("Error unsealing", err)
-// 		}
-		
-// 	}
-// }
-
-func kv2Write(t *testing.T, mount string, path string) {
-	data := map[string]any{
-		"password1": "123abc",
-		"password2": "horse horse horse battery staple correct",
-	}
-	t.Logf("Attempting to write to KV2 %s path %s:\t", mount, path)
-	v, err := Client.KVv2(mount).Put(ctx, path, data)
-	if err != nil {
-		t.Fatal("ERROR writing secret:\n\t", err)
-	}
-	t.Log("Success (unchecked)\n\t", v)
-
-	res, err := Client.KVv2(mount).Get(ctx, path)
-	if err != nil {
-		t.Fatal("ERROR checking/reading secret (request failed)\n\t", err)
-	}
-	if !reflect.DeepEqual(res.Data, data) {
-		t.Fatal("AAAAH", res.Data)
-		t.Fatalf("ERROR secret received does not match what was outght to be written.\n\tWritten: %s\n\tReceived: %s\n", data, res.Data)
-		// t.Fatal("\tWritten: ", newVar.Data)
-		// t.Fatal("\tReceived:", res.Data.Data)
-	}
-	t.Logf("SUCCESS writing to KV2 %s path %s\n", mount, path)
-}
-
-func kv2Delete(t *testing.T, mount string, path string) {
-	err := Client.KVv2(mount).Delete(ctx, path) // currently disregarding modifier options
-	if err != nil {
-		log.Fatal("ERROR deleting secret:\n\t", err)
-	}
-	res, err := Client.KVv2(mount).Get(ctx, path)
-	if res != nil || err == nil {
-		t.Fatal("ERROR checking/reading secret (request failed)\n\t", res, err)
-	}
-	t.Logf("SUCCESS deleting KV2 secret %s path %s\n", mount, path)
-}
-
-// https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#create-update-secret
-// @Philip der Path steht in der KvV2Write Methode
-func TestWriteSecret(t *testing.T) {
-	// Apparently used as a default if mountpath is an empty string (client library)
-	var mountpath = "/kv-v2"
-	var mountpath2 = "/some"
-
-	// Path foo
-	t.Logf("Writing to first KV2 engine at %s...", mountpath)
-	kv2Write(t, mountpath, "foo")
-	kv2Write(t, mountpath, "bar")
-	t.Logf("Writing to second KV2 engine at %s...", mountpath2)
-	kv2Write(t, mountpath2, "foo")
-	kv2Write(t, mountpath2, "bar")
-	t.Logf("Deleting...")
-	kv2Delete(t, mountpath, "foo")
-}
-
-// func TestDeleteSecret(t *testing.T) {
-// 	_, err := client.Secrets.KvV2Delete(ctx, "foo") // currently disregarding modifier options
-// 	if err != nil {
-// 		log.Fatal("kv2: Failed to delete secret:\n\t", err)
-// 	}
-// }
-
-// func TestReadSecret(t *testing.T) {
-// 	_, err := client.Secrets.KvV2Read(ctx, "bar")
-// 	if err != nil {
-// 		log.Fatal("kv2: Failed to read secret:\n\t", err)
-// 	}
-// }

migrations/20240501152243_KvSecret.sql

@@ -1,8 +1,7 @@
 -- Add migration script here
 
-CREATE TABLE kv2_metadata (
+CREATE TABLE metadata (
-    engine_path TEXT NOT NULL,
+    secret_path TEXT PRIMARY KEY NOT NULL,
-    secret_path TEXT NOT NULL,
 
     cas_required INTEGER NOT NULL, -- no bool datatype in sqlite
     created_time TIMESTAMP NOT NULL,
@@ -11,22 +10,19 @@ CREATE TABLE kv2_metadata (
     -- current_version INTEGER NOT NULL,
     -- oldest_version INTEGER NOT NULL,
     updated_time TIMESTAMP NOT NULL,
-    custom_data TEXT,
+    custom_data TEXT
-
-    PRIMARY KEY (engine_path, secret_path)
 );
 
-CREATE TABLE kv2_secret_version (
+CREATE TABLE secret_versions (
-    engine_path TEXT NOT NULL,
+    secret_data TEXT NOT NULL,
+    
+    created_time TIMESTAMP NOT NULL,
+    deletion_time TIMESTAMP,
+
+    version_number INTEGER NOT NULL DEFAULT 0,
     secret_path TEXT NOT NULL,
-
+    PRIMARY KEY (secret_path, version_number),
-    version_number INTEGER NOT NULL CHECK ( version_number > 0 ),
+    FOREIGN KEY (secret_path) REFERENCES metadata(secret_path)
-    created_time DATETIME NOT NULL,
-    deletion_time DATETIME,
-
-    encrypted_data BLOB NOT NULL,
-    nonce BLOB NOT NULL CHECK ( length(nonce) = 12 ),
-
-    PRIMARY KEY (engine_path, secret_path, version_number),
-    FOREIGN KEY (engine_path, secret_path) REFERENCES kv2_metadata(engine_path, secret_path)
 );
+
+CREATE INDEX idx_secret_versions_secret_path ON secret_versions (secret_path);

migrations/20240506135416_testdata.sql

@@ -0,0 +1,8 @@
+-- Add migration script here
+
+INSERT INTO metadata VALUES ("bar", false, DateTime('now'), "30d", 4, DateTime('now'), '{"foo": "customData"}');
+
+INSERT INTO secret_versions VALUES ("secret_data", DateTime('now'), DateTime('now'), 1, "bar");
+INSERT INTO secret_versions VALUES ("more_secret_data", DateTime('now'), datetime('now', '+30 day'), 2, "bar");
+
+INSERT INTO metadata VALUES ("foo", false, DateTime('now'), "30d", 4, DateTime('now'), '{"foo": "customData"}');

migrations/20250326160659_sealing.sql

@@ -1,8 +0,0 @@
--- Sealing Key
-
-CREATE TABLE root_key (
-	version INTEGER PRIMARY KEY CHECK ( version = 1 ),
-	encrypted_key BLOB NOT NULL,
-	nonce BLOB,
-	type TEXT NOT NULL CHECK ( type IN ('dev_only', 'simple', 'shamir') )
-);

migrations/20250407112735_BasicIdentity.sql

@@ -1,25 +0,0 @@
-CREATE TABLE identity (
-    id TEXT PRIMARY KEY NOT NULL,
-    name TEXT NOT NULL
-);
-
-CREATE TABLE service_token_role_membership (
-   role_name TEXT NOT NULL,
-   token_id TEXT NOT NULL
-       REFERENCES service_token(id)
-           ON DELETE CASCADE
-           ON UPDATE CASCADE,
-   PRIMARY KEY (role_name, token_id)
-);
-
-CREATE TABLE service_token (
-    id TEXT PRIMARY KEY NOT NULL,
-    key TEXT NOT NULL,
-    expiry INTEGER,
-    parent_id TEXT NULL REFERENCES service_token(id)
-        ON DELETE NO ACTION
-        ON UPDATE CASCADE,
-    identity_id TEXT NULL REFERENCES identity(id)
-        ON DELETE CASCADE
-        ON UPDATE CASCADE
-);

src/auth.rs

@@ -1,14 +1,13 @@
-pub mod auth_extractor;
-pub(crate) mod token;
-
-use crate::auth::token::*;
-use crate::storage::DbPool;
 use axum::Router;
 
-/// Authentication routes
+use crate::storage::DatabaseDriver;
-pub fn auth_router(pool: DbPool) -> Router<DbPool> {
+
-    // The token auth router handles all token-related authentication routes
+// route prefix: `/auth/token/`
-    Router::new()
+// mod token;
-        .nest("/token", token_auth_router(pool.clone()))
+
-        .with_state(pool)
+// use self::token::token_auth_router;
+
+pub fn auth_router(pool: DatabaseDriver) -> Router<DatabaseDriver> {
+    Router::new().with_state(pool)
+    // .nest("/token", token_auth_router())
 }

src/auth/auth_extractor.rs

@@ -1,66 +0,0 @@
-use crate::auth::token::{TokenDTO, get_roles_from_token, get_token_from_key};
-use crate::storage::DbPool;
-use axum::body::Body;
-use axum::extract::FromRequestParts;
-use axum::http::request::Parts;
-use axum::http::{HeaderMap, Request, StatusCode, header};
-use std::fmt::Debug;
-
-// Currently unused but for usage in the future
-#[allow(unused)]
-/// AuthInfo is an extractor that retrieves authentication information from the request.
-#[derive(Debug)]
-pub struct AuthInfo {
-    token: TokenDTO,
-    roles: Vec<String>,
-}
-
-impl FromRequestParts<DbPool> for AuthInfo {
-    type Rejection = StatusCode;
-
-    /// Extracts authentication information from the request parts.
-    async fn from_request_parts(
-        parts: &mut Parts,
-        state: &DbPool,
-    ) -> Result<Self, Self::Rejection> {
-        let header = &parts.headers;
-
-        inspect_with_header(state, header).await
-    }
-}
-
-// Currently unused but for usage in the future
-#[allow(unused)]
-/// Extracts the headers from request and returns the result from inspect_with_header function.
-pub async fn inspect_req(state: &DbPool, req: &Request<Body>) -> Result<AuthInfo, StatusCode> {
-    let header = req.headers();
-    inspect_with_header(state, header).await
-}
-
-/// Inspects the request headers and extracts authentication information.
-/// Returns an `AuthInfo` struct containing the token and roles if successful.
-/// If the authorization header is missing or invalid, it returns a `StatusCode::UNAUTHORIZED`.
-///
-/// This function is intentionally separated so it can be used from
-/// within the Axum extractor as well as in other functions.
-pub async fn inspect_with_header(
-    state: &DbPool,
-    header: &HeaderMap,
-) -> Result<AuthInfo, StatusCode> {
-    let auth_header = header
-        .get(header::AUTHORIZATION)
-        .and_then(|value| value.to_str().ok());
-
-    match auth_header {
-        Some(auth_value) => {
-            let token = get_token_from_key(auth_value, state).await;
-            if token.is_err() {
-                return Err(StatusCode::UNAUTHORIZED);
-            }
-            let token = token.unwrap();
-            let roles = get_roles_from_token(&token, state).await;
-            Ok(AuthInfo { token, roles })
-        }
-        None => Err(StatusCode::UNAUTHORIZED),
-    }
-}

src/auth/token.rs

@@ -1,286 +1,45 @@
-// There are some placeholder functions, that will have to be implemented before the first release.
+use axum::Router;
-// They are marked with `todo!()` to indicate that they need to be implemented.
-// We want to keep these functions in the codebase.
-// That is why we choose to suppress unused warnings for now.
-// TODO
-#![allow(unused)]
 
-use crate::storage::DbPool;
+pub fn token_auth_router() -> Router {
-use axum::extract::State;
-use axum::http::StatusCode;
-use axum::response::{IntoResponse, Response};
-use axum::routing::post;
-use axum::{Json, Router};
-use log::error;
-use rand::{Rng, distributions::Alphanumeric};
-use serde::{Deserialize, Serialize};
-use sqlx::Error;
-use uuid::Uuid;
-
-#[derive(Debug, Serialize)]
-pub struct IdentityDTO {
-    id: String,
-    name: String,
-}
-
-#[derive(Debug)]
-pub struct TokenDTO {
-    key: String,
-    id: String,
-    identity_id: Option<String>,
-    parent_id: Option<String>,
-    expiry: Option<i64>,
-}
-
-#[derive(Debug)]
-pub struct TokenRoleMembershipDTO {
-    role_name: String,
-    token_id: String,
-}
-
-/// Represents a request body for the `/auth/token/lookup` endpoint.
-#[derive(Deserialize)]
-struct RequestBodyPostLookup {
-    token: String,
-}
-
-/// Represents the response body for the `/auth/token/lookup` endpoint.
-#[derive(Serialize)]
-struct TokenLookupResponse {
-    id: String,
-    type_name: String,
-    roles: Vec<String>,
-}
-
-/// Represents an error response for the API.
-#[derive(Serialize)]
-struct ErrorResponse {
-    error: String,
-}
-
-/// Generates a random string of the specified length using alphanumeric characters.
-// TODO: Make string generation secure
-fn get_random_string(len: usize) -> String {
-    rand::thread_rng()
-        .sample_iter(&Alphanumeric)
-        .take(len)
-        .map(char::from)
-        .collect()
-}
-
-/// Creates a root token if none exists in the database.
-/// Returns true if a new root token was created, false if one already exists.
-pub async fn create_root_token_if_none_exist(pool: &DbPool) -> bool {
-    // Check if a root token already exists
-    let exists = sqlx::query!(
-        r#"SELECT service_token.* FROM service_token, service_token_role_membership
-                          WHERE service_token.id = service_token_role_membership.token_id AND
-                                service_token_role_membership.role_name = 'root'
-                          LIMIT 1"#
-    )
-    .fetch_one(pool)
-    .await
-    .is_ok();
-    if exists {
-        return false;
-    }
-    // If no root token exists, create one
-    let result = create_root_token(pool).await;
-    if result.is_err() {
-        let error = result.err().unwrap();
-        // Log the error and panic
-        error!("create_root_token failed: {error:?}");
-        panic!("create_root_token failed: {error:?}");
-    }
-    // If successful, print the root token. This will only happen once.
-    println!("\n\nYour root token is: {}", result.unwrap());
-    println!("It will only be displayed once!\n\n");
-    true
-}
-
-/// Creates a root token in the database.
-async fn create_root_token(pool: &DbPool) -> Result<String, Error> {
-    let id = Uuid::new_v4().to_string();
-    let key = "s.".to_string() + &get_random_string(24);
-    // Insert the root token into the database
-    let result = sqlx::query!(r#"
-                    INSERT INTO service_token (id, key) VALUES ($1, $2);
-                    INSERT INTO service_token_role_membership (token_id, role_name) VALUES ($3, 'root');
-            "#, id, key, id).execute(pool).await;
-    // If the insert was successful, return the key
-    if result.is_ok() {
-        return Ok(key);
-    }
-    // Else, return the error
-    Err(result.unwrap_err())
-}
-
-/// Gets the current time in seconds since unix epoch
-fn get_time_as_int() -> i64 {
-    std::time::SystemTime::now()
-        .duration_since(std::time::UNIX_EPOCH)
-        .unwrap()
-        .as_secs() as i64
-}
-
-/// Gets the type of token. (The first character of the key always specifies the type)
-fn get_token_type(token: &TokenDTO) -> Result<String, &str> {
-    Ok(match token.key.clone().chars().next().unwrap_or('?') {
-        's' => "service",
-        'b' => "batch",
-        'r' => "recovery",
-        _ => {
-            error!("Unsupported token type");
-            return Err("Unsupported token type");
-        }
-    }
-    .to_string())
-}
-
-/// Retrieves a token from the database using its key.
-/// If the token is found and not expired, it returns the token.
-/// Else, it returns an error.
-pub async fn get_token_from_key(token_key: &str, pool: &DbPool) -> Result<TokenDTO, Error> {
-    let time = get_time_as_int();
-    sqlx::query_as!(
-            TokenDTO,
-            r#"SELECT * FROM 'service_token' WHERE key = $1 AND (expiry IS NULL OR expiry > $2) LIMIT 1"#,
-            token_key, time).fetch_one(pool).await
-}
-
-/// Retrieves the roles associated with a given token from the database.
-/// If the token does not exist, it returns an empty vector.
-pub async fn get_roles_from_token(token: &TokenDTO, pool: &DbPool) -> Vec<String> {
-    let result = sqlx::query_as!(
-        TokenRoleMembershipDTO,
-        r#"SELECT * FROM 'service_token_role_membership' WHERE token_id = $1"#,
-        token.id
-    )
-    .fetch_all(pool)
-    .await;
-    result
-        .unwrap_or(Vec::new())
-        .iter()
-        .map(|r| r.role_name.to_string())
-        .collect()
-}
-
-/// Return a router, that may be used to route traffic to the corresponding handlers
-pub fn token_auth_router(pool: DbPool) -> Router<DbPool> {
     Router::new()
-        .route("/lookup", post(post_lookup))
-        .with_state(pool)
 }
 
-/// Handles the `/auth/token/lookup` endpoint.
+async fn get_accessors() {}
-/// Retrieves the token and its associated roles from the database using the provided token key.
-/// The output format does not yet match the openBao specification and is for testing only!
-async fn post_lookup(
-    State(pool): State<DbPool>,
-    Json(body): Json<RequestBodyPostLookup>,
-) -> Response {
-    let token_str = body.token;
-    // Validate the token string
-    match get_token_from_key(&token_str, &pool).await {
-        // If the token is found, retrieve its type and roles
-        Ok(token) => {
-            let type_name = get_token_type(&token).unwrap_or_else(|_| String::from("Unknown"));
-            let roles = get_roles_from_token(&token, &pool).await;
-            let resp = TokenLookupResponse {
-                id: token.id,
-                type_name,
-                roles,
-            };
-            // Return the token information as a JSON response
-            (StatusCode::OK, axum::Json(resp)).into_response()
-        }
-        // If the token is not found, return a 404 Not Found error
-        Err(e) => {
-            error!("Failed to retrieve token: {e:?}");
-            let err = ErrorResponse {
-                error: "Failed to retrieve token".to_string(),
-            };
-            (StatusCode::NOT_FOUND, axum::Json(err)).into_response()
-        }
-    }
-}
 
-//
+async fn post_create() {}
-// The following functions are placeholders for the various token-related operations.
-//
 
-async fn get_accessors() -> &'static str {
+async fn post_create_orphan() {}
-    todo!("not implemented")
-}
 
-async fn post_create() -> &'static str {
+async fn post_create_role() {}
-    todo!("not implemented")
-}
 
-async fn post_create_orphan() -> &'static str {
+async fn get_lookup() {}
-    todo!("not implemented")
-}
 
-async fn post_create_role() -> &'static str {
+async fn post_lookup() {}
-    todo!("not implemented")
-}
 
-async fn get_lookup() -> &'static str {
+async fn get_lookup_self() {}
-    todo!("not implemented")
-}
 
-async fn get_lookup_self() -> &'static str {
+async fn post_lookup_self() {}
-    todo!("not implemented")
-}
 
-async fn post_lookup_self() -> &'static str {
+async fn post_renew() {}
-    todo!("not implemented")
-}
 
-async fn post_renew() -> &'static str {
+async fn post_renew_accessor() {}
-    todo!("not implemented")
-}
 
-async fn post_renew_accessor() -> &'static str {
+async fn post_renew_self() {}
-    todo!("not implemented")
-}
 
-async fn post_renew_self() -> &'static str {
+async fn post_revoke() {}
-    todo!("not implemented")
-}
 
-async fn post_revoke() -> &'static str {
+async fn post_revoke_accessor() {}
-    todo!("not implemented")
-}
 
-async fn post_revoke_accessor() -> &'static str {
+async fn post_revoke_orphan() {}
-    todo!("not implemented")
-}
 
-async fn post_revoke_orphan() -> &'static str {
+async fn post_revoke_self() {}
-    todo!("not implemented")
-}
 
-async fn post_revoke_self() -> &'static str {
+async fn get_roles() {}
-    todo!("not implemented")
-}
 
-async fn get_roles() -> &'static str {
+async fn get_role_by_name() {}
-    todo!("not implemented")
-}
 
-async fn get_role_by_name() -> &'static str {
+async fn post_role_by_name() {}
-    todo!("not implemented")
-}
 
-async fn post_role_by_name() -> &'static str {
+async fn delete_role_by_name() {}
-    todo!("not implemented")
-}
 
-async fn delete_role_by_name() -> &'static str {
+async fn post_tidy() {}
-    todo!("not implemented")
-}
-
-async fn post_tidy() -> &'static str {
-    todo!("not implemented")
-}

src/common.rs

@@ -1,8 +1,8 @@
 use axum::{
-    Json,
     body::Body,
     http::StatusCode,
     response::{IntoResponse, Response},
+    Json,
 };
 use serde::Serialize;
 
@@ -13,11 +13,11 @@ pub struct HttpError {
 }
 
 impl HttpError {
-    pub fn multiple_errors(status_code: StatusCode, errors: Vec<String>) -> Response<Body> {
+    pub fn new(status_code: StatusCode, errors: Vec<String>) -> Response<Body> {
         (status_code, Json(HttpError { errors })).into_response()
     }
 
     pub fn simple(status_code: StatusCode, error: impl ToString) -> Response<Body> {
-        HttpError::multiple_errors(status_code, vec![error.to_string(); 1])
+        HttpError::new(status_code, vec![error.to_string(); 1])
     }
 }

src/engines.rs

@@ -1,38 +1,33 @@
 pub mod kv;
 
 use axum::{
-    Extension, Router,
     body::Body,
     extract::{Request, State},
     http::{StatusCode, Uri},
     response::{IntoResponse, Response},
+    Extension, Router,
 };
 use log::*;
 use tower::Service;
 
-use crate::{common::HttpError, storage::DbPool};
+use crate::storage::DatabaseDriver;
 
 #[derive(Clone)]
 /// State to be used to store the database pool
-/// and the routers for each engine.
+/// and the routers for each engine
 struct EngineMapperState {
-    pool: DbPool,
+    pool: DatabaseDriver,
     kv_v2: Router,
 }
 
-#[derive(Clone)]
+/// Secret engine router
-struct EnginePath(String);
+pub fn secrets_router(pool: DatabaseDriver) -> Router<DatabaseDriver> {
-
-/// Secret engine router.
-/// Dynamically puts requests into routers depending on database content.
-pub fn secrets_router(pool: DbPool) -> Router<DbPool> {
     // State containing the pool and engine routers
     let state = EngineMapperState {
         pool: pool.clone(),
         kv_v2: kv::kv_router(pool.clone()),
     };
 
-    // Problem solved via fallback route
     Router::new().fallback(engine_handler).with_state(state)
 }
 
@@ -43,7 +38,7 @@ async fn engine_handler(
     req: Request,
 ) -> Response<Body> {
     if let Some((mount_path, engine_type)) = map_mount_points(req.uri(), &engines.pool).await {
-        info!("Found mount point {mount_path} of type {engine_type}");
+        info!("Found mount point {} of type {}", mount_path, engine_type);
         // Match the engine type to the appropriate router
         match engine_type.as_str() {
             "kv_v2" => call_router(engines.kv_v2, mount_path, req).await,
@@ -52,7 +47,7 @@ async fn engine_handler(
         }
     } else {
         // Otherwise, the mount path could not be found
-        HttpError::simple(StatusCode::NOT_FOUND, "Secret engine mount path not found")
+        (StatusCode::NOT_FOUND, "Mount path not found").into_response()
     }
 }
 
@@ -60,7 +55,6 @@ async fn engine_handler(
 async fn call_router(engine: Router, mount_path: String, mut req: Request) -> Response {
     let rui = req.uri().path().replace(&mount_path, "").parse().unwrap();
     *req.uri_mut() = rui;
-    let mount_path = EnginePath(mount_path);
 
     engine
         .layer(Extension(mount_path))
@@ -72,17 +66,17 @@ async fn call_router(engine: Router, mount_path: String, mut req: Request) -> Re
 /// HTTP error response for unknown engine types
 /// Occurs when the mount path is found in the database
 /// but the registered is unknown
-fn unknown_engine(engine_type: String) -> impl IntoResponse {
+fn unknown_engine(engine_type: String) -> (StatusCode, String) {
-    error!("Engine type {engine_type} not implemented");
+    error!("Engine type {} not implemented", engine_type);
-    HttpError::simple(
+    (
         StatusCode::INTERNAL_SERVER_ERROR,
-        format!("Engine type {engine_type} not implemented"),
+        format!("Engine type {} not implemented", engine_type),
     )
 }
 
 /// Returns the mount path and engine type for the request,
 /// if the mount path is registed at the database
-async fn map_mount_points(req: &Uri, pool: &DbPool) -> Option<(String, String)> {
+async fn map_mount_points(req: &Uri, pool: &DatabaseDriver) -> Option<(String, String)> {
     let mut mount_path_fragments: Vec<&str> = req.path().split('/').collect();
 
     // Find longest matching existing mount path for the request

src/engines/kv.rs

@@ -1,31 +1,43 @@
-mod data;
+// pub mod logic;
-mod meta;
+pub mod db_structs;
-mod structs;
+pub mod http_structs;
 
 // #[cfg(test)]
 // mod tests;
 
-use crate::storage::DbPool;
+use crate::{engines::kv::http_structs::*, storage::DatabaseDriver};
-use axum::{Router, routing::*};
+use axum::{
+    extract::{self, Path, State},
+    http::StatusCode,
+    response::IntoResponse,
+    routing::*,
+    Json, Router,
+};
 
-pub fn kv_router(pool: DbPool) -> Router {
+use chrono::{DateTime, Utc};
+use db_structs::*;
+use log::{error, info};
+use serde_json;
+
+use sqlx::{Row, Sqlite};
+use std::{collections::HashMap, convert::Infallible};
+
+pub fn kv_router(pool: DatabaseDriver) -> Router {
     Router::new()
         .route("/config", get(get_config))
         .route("/config", post(post_config))
-        .route("/data/{*path}", get(data::get_data))
+        .route("/data/*path", get(get_data))
         // .route("/:mount_path/data/*path/", get(get_data))
-        .route("/data/{*path}", post(data::post_data))
+        .route("/data/*path", post(post_data))
-        // Why does HC V SDK expect PUT instead of POST - neither in the docs nor spec
+        .route("/data/*path", delete(delete_data))
-        .route("/data/{*path}", put(data::post_data))
+        .route("/delete/*path", post(delete_path))
-        .route("/data/{*path}", delete(data::delete_data))
+        .route("/destroy/*path", post(destroy_path))
-        .route("/delete/{*path}", post(meta::delete_path))
+        .route("/metadata/*path", get(get_meta))
-        .route("/destroy/{*path}", post(meta::destroy_path))
-        .route("/metadata/{*path}", get(meta::get_meta))
         // .route("/:mount_path/metadata/*path/", get(get_meta))
-        .route("/metadata/{*path}", post(meta::post_meta))
+        .route("/metadata/*path", post(post_meta))
-        .route("/metadata/{*path}", delete(meta::delete_meta))
+        .route("/metadata/*path", delete(delete_meta))
-        .route("/subkeys/{*path}", get(get_subkeys))
+        .route("/subkeys/*path", get(get_subkeys))
-        .route("/undelete/{*path}", post(post_undelete))
+        .route("/undelete/*path", post(post_undelete))
         .with_state(pool)
 }
 
@@ -37,6 +49,331 @@ async fn post_config() -> &'static str {
     todo!("not implemented")
 }
 
+async fn get_data(
+    State(pool): State<DatabaseDriver>,
+    Path(path): Path<String>,
+) -> Result<impl IntoResponse, Infallible> {
+    match sqlx::query("SELECT * FROM secret_versions WHERE secret_path = $1")
+        .bind(path)
+        .fetch_one(&pool)
+        .await
+    {
+        Ok(v) => {
+            let version: i64 = v.get("version_number");
+            let secret_content: HashMap<String, String> = HashMap::from([
+                // Consider using sqlx to parse the row to a struct, do not do it manually
+                ("secret_data".to_string(), v.get("secret_data")),
+                ("created_time".to_string(), v.get("created_time")),
+                ("deletion_time".to_string(), v.get("deletion_time")),
+                ("version_number".to_string(), version.to_string()),
+                ("secret_path".to_string(), v.get("secret_path")),
+            ]);
+            let return_secret = KvSecretRes::new(KvSecretResData {
+                created_time: DateTime::parse_from_rfc3339(
+                    secret_content
+                        .get("created_time")
+                        .unwrap_or(&"".to_string()),
+                )
+                .unwrap_or_default()
+                .to_utc(), // TODO
+                custom_metadata: None,
+                deletion_time: None,
+                destroyed: false,
+                version: version,
+            });
+            info!("{:?}", return_secret);
+
+            Ok((StatusCode::OK, Json(return_secret)).into_response())
+        }
+        Err(e) => match e {
+            sqlx::Error::RowNotFound => {
+                error!("{:?}", e);
+                let error_struct: ErrorStruct = ErrorStruct { err: e.to_string() };
+                error!("{:?}", error_struct.err);
+                Ok(error_struct.into_response()) // API doesn't specify return value in case of error. Error struct correct? Else send empty secret back?
+                                                 // let error_secret = KvSecretRes{data: None, options: None};
+                                                 // Ok(Json())
+            }
+            _ => panic!("{:?}", e),
+        },
+    }
+}
+
+async fn post_data(
+    State(pool): State<DatabaseDriver>,
+    Path(path): Path<String>,
+    extract::Json(payload): extract::Json<KvSecretReq>,
+) -> Result<impl IntoResponse, Infallible> {
+    // Insert Metadata first -> Else: Error because of foreign key constraint
+    // In a later implementation, a Metadata with default values from the config will be created
+
+    log::debug!(
+        "Secret: {}, Content: {:?}, Version: {:?}, path: {}",
+        path,
+        payload.data,
+        payload.options,
+        path
+    );
+
+    let mut highest_num = 0;
+    match sqlx::query("SELECT version_number FROM secret_versions WHERE secret_path = $1")
+        .bind(&path)
+        .fetch_all(&pool)
+        .await
+    {
+        Ok(v) => {
+            for curr_ver in v {
+                let curr_num = curr_ver.get("version_number");
+                if highest_num < curr_num {
+                    // should be the max of the available version numbers
+                    highest_num = curr_num;
+                }
+            }
+        }
+        Err(e) => {
+            log::error!("Error: {}", e)
+        }
+    }
+
+    let version = highest_num + 1;
+    log::debug!("{:?}", version);
+    let data = serde_json::to_string(&payload.data).unwrap();
+    log::debug!("Received data: {:?}", data);
+    let created_time = Utc::now();
+    let created_time_string = created_time.to_string();
+    let deletion_time = "12-12-2024 12:00:00"; // TODO
+
+    match sqlx::query("INSERT INTO secret_versions VALUES ($1, $2, $3, $4, $5)")
+        .bind(&data)
+        .bind(created_time_string)
+        .bind(deletion_time)
+        .bind(&version)
+        .bind(&path)
+        .execute(&pool)
+        .await
+    {
+        Ok(v) => {
+            info!("{:?}", v);
+
+            let return_struct = KvSecretResData {
+                created_time: created_time,
+                custom_metadata: None,
+                deletion_time: None,
+                destroyed: false,
+                version: version,
+            };
+            return Ok((StatusCode::OK, Json(return_struct)).into_response());
+        }
+        Err(e) => {
+            error!("{:?}", e);
+            return Ok((StatusCode::INTERNAL_SERVER_ERROR, Json(e.to_string())).into_response());
+        }
+    }
+}
+
+/// TODO: soft delete the secret version at path. can be undone with undelete_secret
+// https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#delete-latest-version-of-secret
+// https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#delete-secret-versions
+async fn delete_data() -> &'static str {
+    todo!("not implemented")
+}
+
+async fn delete_path() -> &'static str {
+    todo!("not implemented")
+}
+
+async fn destroy_path(
+    State(pool): State<DatabaseDriver>,
+    Path(kv_path): Path<String>,
+    Json(body): Json<KvSecretDestrReq>,
+) -> Result<impl IntoResponse, Infallible> {
+    let versions = body.versions;
+
+    for ver in versions {
+        let res_wrapper = sqlx::query::<Sqlite>(
+            "DELETE FROM secret_versions where secret_path = $1 AND version_number = $2",
+        )
+        .bind(&kv_path)
+        .bind(ver)
+        .execute(&pool)
+        .await;
+
+        match res_wrapper {
+            Ok(result) => {
+                if result.rows_affected() == 0 {
+                    log::debug!(
+                        "No rows were deleted for version {} at path {}",
+                        ver,
+                        kv_path
+                    );
+                } else {
+                    log::debug!("Deleted version {} at path {}", ver, kv_path);
+                }
+            }
+            Err(e) => {
+                log::error!(
+                    "Failed to delete version {} at path {}: {}",
+                    ver,
+                    kv_path,
+                    e
+                );
+            }
+        }
+    }
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn get_meta(
+    State(pool): State<DatabaseDriver>,
+    Path(kv_path): Path<String>,
+) -> Result<impl IntoResponse, Infallible> {
+    log::debug!("Path: {}", kv_path);
+
+    let mut metadata_res: KvMetaRes = KvMetaRes::default();
+
+    let dbmeta = sqlx::query_as::<_, DbSecretMeta>("SELECT * FROM metadata where secret_path = $1")
+        .bind(&kv_path)
+        .fetch_optional(&pool)
+        .await;
+
+    match dbmeta {
+        Ok(Some(dbmeta)) => {
+            metadata_res.data = KvMetaResData {
+                created_time: dbmeta.created_time,
+
+                // map the custom_data to a Hashmap
+                custom_metadata: dbmeta.custom_data.map(|data| {
+                    serde_json::from_str::<HashMap<String, String>>(&data)
+                        .unwrap_or_else(|_| HashMap::new())
+                }),
+
+                cas_required: dbmeta.cas_required,
+                max_versions: dbmeta.max_versions,
+                updated_time: dbmeta.updated_time,
+                delete_version_after: dbmeta.delete_version_after,
+                current_version: 0,
+                oldest_version: 0,
+                versions: HashMap::new(),
+            };
+
+            let version_data = sqlx::query_as::<_, DbSecretVersionMeta>("SELECT version_number, created_time, deletion_time FROM secret_versions WHERE secret_path = $1")
+            .bind(&kv_path)
+            .fetch_all(&pool)
+            .await;
+            log::debug!("found version_data: {:?}", version_data);
+
+            if let Ok(version_data) = version_data {
+                // 1. iterate through all version data
+                // 2. put all version numbers as keys in the hashmap. the rest of the values values should be the value
+                let mut parsed_versions: HashMap<i64, KvMetaResVersionData> = HashMap::new();
+                let now = Utc::now();
+
+                for curr_ver in version_data {
+                    let curr_num = curr_ver.version_number;
+                    let data = KvMetaResVersionData {
+                        created_time: curr_ver.created_time,
+                        deletion_time: curr_ver.deletion_time,
+                        destroyed: if curr_ver.deletion_time < now {
+                            true
+                        } else {
+                            false
+                        },
+                    };
+
+                    if metadata_res.data.current_version < curr_num {
+                        // the max of the available version numbers
+                        metadata_res.data.current_version = curr_num;
+                    }
+                    if metadata_res.data.oldest_version > curr_num {
+                        // the min of the available version numbers
+                        metadata_res.data.oldest_version = curr_num;
+                    }
+
+                    parsed_versions.insert(curr_num, data);
+                }
+
+                metadata_res.data.versions = parsed_versions;
+            }
+        }
+
+        Ok(None) => {
+            return Ok((StatusCode::BAD_REQUEST, Json("No metadata found")).into_response());
+        }
+        Err(e) => {
+            log::error!("Database error: {}", e);
+            return Ok((
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json("Internal server error"),
+            )
+                .into_response());
+        }
+    }
+
+    let json_string = serde_json::to_string(&metadata_res).unwrap();
+    log::debug!("Returning response: {}", json_string);
+
+    Ok((StatusCode::OK, Json(metadata_res)).into_response())
+}
+
+// currently only writes the metadata - Not case if already exists
+async fn post_meta(
+    State(pool): State<DatabaseDriver>,
+    Path(kv_path): Path<String>,
+    Json(body): Json<KvMetaReq>,
+    // extract::Json(body): extract::Json<http_structs::KvMetaReq>,
+) -> Result<impl IntoResponse, Infallible> {
+    let now = Utc::now();
+    let custom_metadata: String = match serde_json::to_string(&body.custom_metadata) {
+        Ok(data) => data,
+        Err(_) => {
+            log::error!(
+                "could not serialize custom_metadata: {:?}\ndropping data",
+                body.custom_metadata
+            );
+            String::new()
+        }
+    };
+
+    let new_metadata = DbSecretMeta {
+        cas_required: body.cas_required.unwrap_or(false),
+        secret_path: kv_path,
+        created_time: now,
+        delete_version_after: Some("30d".to_string()),
+        max_versions: body.max_versions,
+        updated_time: now,
+
+        custom_data: Some(custom_metadata),
+    };
+
+    match  sqlx::query("INSERT INTO metadata (cas_required, secret_path, created_time, delete_version_after, max_versions, updated_time, custom_data) VALUES ($1, $2, $3, $4, $5, $6, $7)")
+    .bind(new_metadata.cas_required)
+    .bind(new_metadata.secret_path)
+    .bind(new_metadata.created_time)
+    .bind(new_metadata.delete_version_after.unwrap())
+    .bind(new_metadata.max_versions)
+    .bind(new_metadata.updated_time)
+    .bind(new_metadata.custom_data.unwrap())
+    .execute(&pool)
+    .await
+    {
+    Ok(result) => {
+        info!("{:?}", result);
+        if result.rows_affected() == 0 {
+            log::error!("Failed to insert metadata");
+        }
+    }
+        Err(e) => {
+            error!("{:?}", e);
+        }
+    };
+
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn delete_meta() -> &'static str {
+    todo!("not implemented")
+}
+
 async fn get_subkeys() -> &'static str {
     todo!("not implemented")
 }

src/engines/kv/data.rs

@@ -1,253 +0,0 @@
-// There are some placeholder functions, that will have to be implemented before the first release.
-// They are marked with `todo!()` to indicate that they need to be implemented.
-// We want to keep these functions in the codebase.
-// That is why we choose to suppress unused warnings for now.
-// TODO
-#![allow(unused)]
-
-use super::structs::KvV2WriteRequest;
-use crate::{
-    DbPool,
-    common::HttpError,
-    engines::{
-        EnginePath,
-        kv::structs::{KvSecretData, KvSecretRes, KvV2WriteResponse, Wrapper},
-    },
-    storage::sealing::Secret,
-};
-use axum::{
-    Extension, Json,
-    extract::{Path, Query, State},
-    http::StatusCode,
-    response::{IntoResponse, NoContent, Response},
-};
-use log::{debug, error, info, warn};
-use serde::Deserialize;
-use time::{OffsetDateTime, UtcDateTime};
-
-#[derive(Deserialize)]
-pub struct GetDataQuery {
-    #[serde(default)]
-    /// Version of secret requested to be read.
-    /// Default `0`, to get the most recent version.
-    pub version: u32,
-}
-
-/// Unluckily needed as `sqlx::query_as!()` does not support FromRow derivations
-struct SecretDataInternal {
-    pub created_time: OffsetDateTime,
-    pub deletion_time: Option<OffsetDateTime>,
-    pub version_number: i64,
-    pub secret_path: String,
-
-    pub nonce: Vec<u8>,
-    pub encrypted_data: Vec<u8>,
-}
-
-impl SecretDataInternal {
-    pub async fn into_external(self) -> KvSecretData {
-        let secret = Secret::new(self.encrypted_data, self.nonce).decrypt().await;
-        KvSecretData {
-            created_time: self.created_time,
-            deletion_time: self.deletion_time,
-            version_number: self.version_number,
-            secret_path: self.secret_path,
-            secret_data: secret.unwrap(),
-        }
-    }
-}
-
-pub async fn get_data(
-    State(pool): State<DbPool>,
-    Query(params): Query<GetDataQuery>,
-    Path(path): Path<String>,
-    Extension(EnginePath(engine_path)): Extension<EnginePath>,
-) -> Result<Response, ()> {
-    debug!("Get request: Engine: {engine_path}, path: {path}",);
-
-    let res = if params.version != 0 {
-        // With specific version
-        sqlx::query_as!(
-            SecretDataInternal,
-            r#"SELECT nonce, encrypted_data, created_time, deletion_time, version_number, secret_path
-            FROM kv2_secret_version WHERE engine_path = $1 AND secret_path = $2 AND deletion_time IS NULL
-                AND version_number = $3"#,
-            engine_path, path, params.version).fetch_one(&pool).await
-    } else {
-        // Without specific version
-        sqlx::query_as!(
-            SecretDataInternal,
-            r#"SELECT nonce, encrypted_data, created_time, deletion_time, version_number, secret_path
-            FROM kv2_secret_version WHERE engine_path = $1 AND secret_path = $2 AND deletion_time IS NULL
-            ORDER BY version_number DESC LIMIT 1"#,
-            engine_path, path).fetch_one(&pool).await
-    };
-
-    match res {
-        Ok(secret_content) => {
-            let secret_content = secret_content.into_external().await;
-            let inner = secret_content.secret_data;
-            let data = Wrapper {
-                data: serde_json::from_str(&inner).unwrap(),
-            };
-            let return_secret = KvSecretRes {
-                data,
-                options: None,
-                version: Some(secret_content.version_number),
-            };
-            let return_secret = Json(return_secret);
-            info!("{return_secret:?}");
-
-            Ok(return_secret.into_response())
-        }
-        Err(e) => match e {
-            sqlx::Error::RowNotFound => {
-                warn!("Secret not found (could be correct behavior) {e:?}");
-                Ok(HttpError::simple(
-                    StatusCode::NOT_FOUND,
-                    "Secret not found within kv2 engine",
-                ))
-            }
-            _ => panic!("Unhandled error: {e:?}"),
-        },
-    }
-}
-
-pub async fn post_data(
-    State(pool): State<DbPool>,
-    Path(kv_path): Path<String>,
-    Extension(EnginePath(engine_path)): Extension<EnginePath>,
-    Json(secret): Json<KvV2WriteRequest>,
-) -> Result<Response, ()> {
-    debug!(
-        "Engine: {}, Secret: {}, Version: {:?}, path: {}",
-        engine_path,
-        kv_path,
-        secret.version, //.unwrap_or(0),
-        kv_path
-    );
-
-    let created_time = time::UtcDateTime::now();
-    let ts = created_time.unix_timestamp();
-
-    let content = serde_json::to_string(&secret.data).unwrap();
-
-    let Secret {
-        nonce,
-        protected_data,
-    } = Secret::encrypt(&content).await.unwrap();
-    let nonce = nonce.as_slice();
-
-    let mut tx = pool.begin().await.unwrap();
-
-    let _ = sqlx::query!("
-        INSERT INTO kv2_metadata (engine_path, secret_path, cas_required, created_time, max_versions, updated_time)
-        VALUES ($1, $2, 0, $3, 100, $3)
-        ON CONFLICT(engine_path, secret_path) DO NOTHING;
-    ", engine_path, kv_path, ts).execute(&mut *tx).await.unwrap();
-
-    let res_r = sqlx::query_file!(
-        "src/engines/kv/post_secret.sql",
-        engine_path,
-        kv_path,
-        nonce,
-        protected_data,
-        ts,
-        secret.version,
-    )
-    .fetch_one(&mut *tx)
-    .await
-    .unwrap();
-
-    tx.commit().await.expect("FAILED TO WRITE TX!");
-
-    let res = KvV2WriteResponse {
-        created_time: created_time.into(),
-        custom_metadata: None,
-        deletion_time: None,
-        destroyed: false,
-        version: res_r.version_number,
-    };
-
-    Ok(Json(res).into_response())
-}
-
-/// TODO: soft delete the secret version at path. can be undone with undelete_secret
-// https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#delete-latest-version-of-secret
-// https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#delete-secret-versions
-pub async fn delete_data(
-    State(pool): State<DbPool>,
-    Path(path): Path<String>,
-    Extension(EnginePath(engine_path)): Extension<EnginePath>,
-) -> Result<Response, Response> {
-    debug!("Secret: {path}, path: {path}");
-
-    let del_time = UtcDateTime::now().unix_timestamp();
-
-    let mut tx = pool.begin().await.unwrap();
-
-    // TODO: Find a better way
-    let latest_version = sqlx::query!(
-        r#"
-        SELECT version_number AS latest_version FROM kv2_secret_version
-        WHERE engine_path = $1 AND secret_path = $2 AND deletion_time IS NULL
-        ORDER BY version_number DESC LIMIT 1"#,
-        engine_path,
-        path,
-    )
-    .fetch_optional(&mut *tx)
-    .await
-    .unwrap();
-
-    let latest_version = match latest_version {
-        Some(v) => v.latest_version,
-        None => {
-            return Err(HttpError::simple(
-                StatusCode::NOT_FOUND,
-                "No secret version found which could be deleted",
-            ));
-        }
-    };
-
-    let u = sqlx::query!(
-        r#"
-        UPDATE kv2_secret_version
-        SET deletion_time = $4
-        WHERE engine_path = $1 AND secret_path = $2
-            AND version_number = $3
-        "#,
-        engine_path,
-        path,
-        latest_version,
-        del_time
-    )
-    .execute(&mut *tx)
-    .await;
-
-    if let Err(e) = u {
-        error!(
-            "Strange - a version to be deleted has been found but could not be found to set deletion.\n\t{e:?}"
-        );
-        // Not committed transactions will be aborted upon drop
-        // tx.rollback().await.unwrap();
-        return Err(HttpError::simple(
-            StatusCode::INTERNAL_SERVER_ERROR,
-            "A version to be deleted was found but could not be deleted",
-        ));
-    }
-
-    tx.commit().await.unwrap();
-
-    info!("Secret {path} version {latest_version} of {engine_path} engine deleted! {u:?}");
-
-    Ok(NoContent.into_response())
-}
-
-pub async fn patch_data(
-    State(pool): State<DbPool>,
-    Path(kv_path): Path<String>,
-    Extension(EnginePath(engine_path)): Extension<EnginePath>,
-    Json(secret): Json<KvV2WriteRequest>,
-) -> &'static str {
-    todo!("not implemented")
-}

src/engines/kv/db_structs.rs

@@ -0,0 +1,35 @@
+use chrono::{DateTime, Utc};
+use serde::Serialize;
+use sqlx::FromRow;
+
+#[derive(FromRow, Debug)]
+pub struct DbSecretMeta {
+    pub secret_path: String,
+    pub cas_required: bool,
+    pub created_time: DateTime<Utc>,
+    // Consider implementation of duration type for further development:
+    // https://developer.hashicorp.com/vault/docs/concepts/duration-format
+    /// In Hashicorp:
+    /// If not set, the backend's configured delete_version_after is used.
+    /// Cannot be greater than the backend's delete_version_after
+    pub delete_version_after: Option<String>,
+
+    ///In Hashicorp:
+    /// The number of versions to keep per key.
+    /// If not set, the backend’s configured max version is used.
+    /// Once a key has more than the configured allowed versions,
+    /// the oldest version will be permanently deleted.
+    pub max_versions: i64,
+    pub updated_time: DateTime<Utc>,
+    /// User-provided key-value pairs that are used to describe arbitrary and version-agnostic information about a secret.
+    pub custom_data: Option<String>,
+}
+
+#[derive(Serialize, Debug, FromRow)]
+/// Metadata concerning a specific secret version
+/// contained by [KvMetaRes]
+pub struct DbSecretVersionMeta {
+    pub version_number: i64,
+    pub created_time: DateTime<Utc>,
+    pub deletion_time: DateTime<Utc>,
+}

src/engines/kv/delete_secret.sql

@@ -1,25 +0,0 @@
-
-WITH latest AS (
-    SELECT version_number AS version
-    FROM kv2_secret_version
-    WHERE engine_path = '/kv-v2' AND secret_path = 'foo' AND deletion_time IS NULL
-    ORDER BY version_number DESC
-    LIMIT 1
-),
-update_deleted AS (
-    UPDATE kv2_secret_version
-    SET deletion_time = CURRENT_TIMESTAMP
-    WHERE engine_path = '/kv-v2' AND secret_path = 'foo'
-      AND version_number = (SELECT version FROM latest)
-    RETURNING version_number AS deleted_version
-),
-new_latest AS (
-    SELECT version_number AS new_latest_version
-    FROM kv2_secret_version
-    WHERE engine_path = '/kv-v2' AND secret_path = 'foo' AND deletion_time IS NULL
-    ORDER BY version_number DESC
-    LIMIT 1
-)
-SELECT 
-    (SELECT deleted_version FROM update_deleted) AS deleted_version,
-    (SELECT new_latest_version FROM new_latest) AS new_latest_version;

src/engines/kv/http_structs.rs

@@ -0,0 +1,143 @@
+use axum::{
+    body::Body,
+    http::{Response, StatusCode},
+    response::IntoResponse,
+};
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use zeroize::Zeroize;
+
+pub type KvSecretData = HashMap<String, String>;
+
+// This file contains structures for serializing HTTP Responses (Res) and deserializing Requests (Req) for the KV engine
+
+#[derive(Deserialize, Debug)]
+// #[zeroize(drop)]
+/// HTTP Request to create or update a secret
+pub struct KvSecretReq {
+    /// Map (required)
+    pub data: KvSecretData,
+    /// Map (optional), may contain `cas` integer
+    // #[serde_as(as = "serde_with::EnumMap")]
+    pub options: Option<HashMap<String, String>>,
+    // Version does not exist for create/update operations
+    // pub version: Option<i64>,
+}
+
+impl Zeroize for KvSecretReq {
+    fn zeroize(&mut self) {
+        // Zero out each field individually
+        self.data = HashMap::new();
+        self.options = None;
+    }
+}
+
+impl Drop for KvSecretReq {
+    fn drop(&mut self) {
+        self.zeroize();
+    }
+}
+
+#[derive(Serialize, Debug)]
+/// HTTP Response to creating or updating a secret
+/// Contained by [`KvSecretRes`]
+pub struct KvSecretResData {
+    pub created_time: DateTime<Utc>,
+    pub custom_metadata: Option<HashMap<String, String>>,
+    pub deletion_time: Option<DateTime<Utc>>,
+    pub destroyed: bool,
+    pub version: i64,
+}
+
+#[derive(Serialize, Debug)]
+/// HTTP Response to creating or updating a secret
+/// Container of [`KvSecretResData`]
+pub struct KvSecretRes {
+    pub data: KvSecretResData,
+}
+
+impl KvSecretRes {
+    pub fn new(data: KvSecretResData) -> Self {
+        KvSecretRes { data }
+    }
+}
+
+#[derive(Serialize)]
+pub struct ErrorStruct {
+    pub err: String,
+}
+impl ErrorStruct {
+    pub fn into_response(self) -> Response<Body> {
+        let body = self.err;
+        (StatusCode::NOT_FOUND, body).into_response()
+    }
+}
+
+#[derive(Deserialize)]
+/// HTTP Request to destroy secret versions
+pub struct KvSecretDestrReq {
+    pub versions: Vec<i64>,
+}
+
+#[derive(Serialize, Debug)]
+/// HTTP Response to Reading a Secret metadata
+/// Container of [`KvMetaResData`]
+pub struct KvMetaRes {
+    pub data: KvMetaResData,
+}
+
+impl Default for KvMetaRes {
+    fn default() -> Self {
+        let now = Utc::now();
+        Self {
+            data: KvMetaResData {
+                cas_required: false,
+                created_time: now,
+                delete_version_after: Some("".to_string()),
+                max_versions: 0,
+                updated_time: now,
+                custom_metadata: Some(HashMap::new()),
+                current_version: 0,
+                oldest_version: 0,
+
+                versions: HashMap::new(),
+            },
+        }
+    }
+}
+
+#[derive(Serialize, Debug)]
+/// Metadata concerning a specific secret version
+/// contained by [KvMetaRes]
+pub struct KvMetaResVersionData {
+    pub created_time: DateTime<Utc>,
+    pub deletion_time: DateTime<Utc>,
+    pub destroyed: bool,
+}
+
+#[derive(Serialize, Debug)]
+/// contained by [KvMetaRes]
+pub struct KvMetaResData {
+    pub cas_required: bool,
+    pub created_time: DateTime<Utc>,
+    pub current_version: i64,
+    pub delete_version_after: Option<String>,
+    pub max_versions: i64,
+    pub oldest_version: i64,
+    pub updated_time: DateTime<Utc>,
+    pub custom_metadata: Option<HashMap<String, String>>,
+    pub versions: HashMap<i64, KvMetaResVersionData>,
+    // here, the key to a version is the version number
+}
+
+#[derive(Serialize, Debug, Deserialize)]
+/// HTTP Request to post metadatas
+pub struct KvMetaReq {
+    pub cas_required: Option<bool>,
+    // pub cas_required: bool,
+    pub delete_version_after: Option<String>,
+    pub max_versions: i64,
+    // pub updated_time: Option<DateTime<Utc>>,
+    pub custom_metadata: Option<HashMap<String, String>>,
+}

src/engines/kv/logic.rs

@@ -0,0 +1,31 @@
+use serde_json::Value;
+
+use super::{db_structs::SecretMeta, http_structs::*};
+
+// Consider leaving this here - JSON merge patch is also used in the official implementation
+#[deprecated(note = "Propably not needed (remove deprecation if actually needed)")]
+/// Consider:
+/// Instead of patching JSON, we should apply the modified fields directly to the database
+pub fn patch_metadata(
+    old: &mut SecretMeta,
+    new: &SecretMeta,
+) -> Result<SecretMeta, serde_json::Error> {
+    let mut patch = serde_json::to_value(old)?; // ? operator is cool: returns early if error was detected
+    let new_json = serde_json::to_value(new)?;
+    json_patch::merge(&mut patch, &new_json);
+    serde_json::from_value(patch)
+}
+
+#[deprecated(note = "DO NOT USE: Use Axum extractors to structs instead")]
+#[allow(unreachable_code, unused_variables)]
+/// See [JSON extractor documentation](https://docs.rs/axum/latest/axum/struct.Json.html#extractor-example)
+pub fn body_to_json(body: String) -> Value {
+    todo!("REMOVE: Use Axum extractors to structs instead");
+    match serde_json::from_str::<serde_json::Value>(body.as_str()) {
+        Ok(val) => val,
+        Err(e) => {
+            log::debug!("Faulty result from conversion: {:?}", e);
+            "Error converting body".into()
+        }
+    }
+}

src/engines/kv/meta.rs

@@ -1,33 +0,0 @@
-// There are some placeholder functions, that will have to be implemented before the first release.
-// They are marked with `todo!()` to indicate that they need to be implemented.
-// We want to keep these functions in the codebase.
-// That is why we choose to suppress unused warnings for now.
-// TODO
-#![allow(unused)]
-
-use crate::storage::DbPool;
-use axum::extract::{Path, State};
-
-pub async fn delete_path() -> &'static str {
-    todo!("not implemented")
-}
-
-pub async fn destroy_path() -> &'static str {
-    todo!("not implemented")
-}
-
-pub async fn get_meta() -> &'static str {
-    todo!("not implemented")
-}
-
-pub async fn post_meta(
-    State(pool): State<DbPool>,
-    Path((mount_path, kv_path)): Path<(String, String)>,
-    body: String,
-) -> &'static str {
-    todo!("not implemented")
-}
-
-pub async fn delete_meta() -> &'static str {
-    todo!("not implemented")
-}

src/engines/kv/post_secret.sql

@@ -1,19 +0,0 @@
-
-WITH latest_version AS (
-    SELECT MAX(version_number) AS max_version
-    FROM kv2_secret_version
-    WHERE engine_path = $1 AND secret_path = $2 -- engine_path AND secret_path
-)
-INSERT INTO kv2_secret_version (engine_path, secret_path, nonce, encrypted_data, created_time, version_number)
-VALUES (
-    $1, -- engine_path
-    $2, -- secret_path
-    $3, -- nonce
-    $4, -- encrypted_data
-    $5, -- created_time
-    CASE -- Use provided version if given
-        WHEN $6 IS NOT NULL THEN $6 -- version_number (optional)
-        ELSE COALESCE((SELECT max_version FROM latest_version) + 1, 1) -- otherwise 1
-    END -- version_number logic
-)
-RETURNING version_number;

src/engines/kv/structs.rs

@@ -1,123 +0,0 @@
-// There are some placeholder functions, that will have to be implemented before the first release.
-// They are marked with `todo!()` to indicate that they need to be implemented.
-// We want to keep these functions in the codebase.
-// That is why we choose to suppress unused warnings for now.
-#![allow(unused)]
-
-use serde::{Deserialize, Serialize};
-use std::{collections::HashMap, vec};
-use time::{OffsetDateTime, UtcDateTime, serde::rfc3339};
-
-// #[derive(Serialize, Deserialize, Debug)]
-// pub struct KvSecretData {
-//     pub secret_data: String,
-//     #[serde(with = "rfc3339")]
-//     pub created_time: UtcDateTime,
-
-//     #[serde(with = "rfc3339::option")]
-//     pub deletion_time: Option<UtcDateTime>,
-//     pub version_number: i64,
-//     pub secret_path: String,
-// }
-
-#[derive(Serialize, Deserialize, Debug, Clone)]
-pub struct KvSecretData {
-    pub secret_data: String,
-    #[serde(with = "rfc3339")]
-    pub created_time: OffsetDateTime,
-    #[serde(with = "rfc3339::option")]
-    pub deletion_time: Option<OffsetDateTime>,
-    pub version_number: i64,
-    pub secret_path: String,
-}
-
-// impl From<KvSecretDataDBO> for KvSecretData {
-//     fn from(value: KvSecretDataDBO) -> Self {
-//         Self {
-//             secret_data: value.secret_data,
-//             created_time: value.created_time.to_offset(UtcOffset::UTC),
-//             deletion_time: value.deletion_time.map(|v| v.to_utc()),
-//             version_number: value.version_number,
-//             secret_path: value.secret_path,
-//         }
-//     }
-// }
-
-#[derive(serde::Serialize, Deserialize, Debug)]
-pub struct Wrapper<T> {
-    pub data: T,
-}
-
-#[derive(Serialize, Deserialize, Debug)]
-pub struct KvSecretRes {
-    /// Map (required)
-    pub data: Wrapper<serde_json::Value>,
-    /// Map (optional), may contain `cas` integer
-    /// Set the `cas` value to use a Check-And-Set operation
-    // #[serde_as(as = "serde_with::EnumMap")]
-    pub options: Option<HashMap<String, String>>,
-    // Version does not exist for create/update operations
-    pub version: Option<i64>,
-    // TODO add all fields
-}
-
-#[derive(Deserialize)]
-pub struct KvV2WriteRequest {
-    pub data: serde_json::Value,
-    pub options: Option<serde_json::Value>,
-    pub version: Option<i32>,
-}
-
-#[derive(Serialize, Debug)]
-pub struct KvV2WriteResponse {
-    #[serde(with = "rfc3339")]
-    pub created_time: OffsetDateTime,
-    pub custom_metadata: Option<HashMap<String, String>>,
-    #[serde(with = "rfc3339::option")]
-    pub deletion_time: Option<OffsetDateTime>,
-    pub destroyed: bool,
-    pub version: i64,
-}
-
-#[derive(Serialize, Deserialize, Debug)]
-pub struct VersionMeta {
-    pub created_time: UtcDateTime,
-    pub deletion_time: Option<UtcDateTime>, // optional deletion time
-    pub destroyed: bool,
-}
-
-#[derive(Serialize, Deserialize, Debug)]
-pub struct SecretMeta {
-    pub cas_required: bool,
-    pub created_time: UtcDateTime,
-    pub current_version: i64,
-    /// In Hashicorp:
-    /// If not set, the backend's configured delete_version_after is used.
-    /// Cannot be greater than the backend's delete_version_after
-    // TODO: implement duration type
-    pub delete_version_after: String,
-    // TODO https://developer.hashicorp.com/vault/docs/concepts/duration-format
-    pub max_versions: i64,
-    pub oldest_version: i64,
-    pub updated_time: UtcDateTime,
-    /// User-provided key-value pairs that are used to describe arbitrary and version-agnostic information about a secret.
-    pub custom_metadata: Option<HashMap<String, String>>,
-    pub versions: Vec<VersionMeta>,
-}
-
-impl Default for SecretMeta {
-    fn default() -> Self {
-        let current = UtcDateTime::now();
-        SecretMeta {
-            cas_required: false,
-            created_time: current,
-            current_version: 1,
-            delete_version_after: "24h00m00s".to_string(),
-            max_versions: 10,
-            oldest_version: 1,
-            updated_time: current,
-            custom_metadata: None,
-            versions: vec![],
-        }
-    }
-}

src/engines/kv/tests.rs

@@ -0,0 +1,68 @@
+// This file is deprecated. Currently, all tests are in written in go.
+
+// use std::collections::HashMap;
+
+// use chrono::Utc;
+// use tests::{
+//     logic::patch_metadata,
+//     structs::{SecretMeta, VersionMeta},
+// };
+
+// use super::*;
+
+// #[test]
+// #[cfg(target_feature = "_disabled")]
+// fn print_serialized_test() {
+//     let temp_secret = TempSecret {
+//         content: String::from("Hallo"),
+//         version: 12,
+//     };
+//     let serialized = serialize_secret_json(&temp_secret);
+//     println!("string serialized: {:?}", serialized);
+//     let deserialized = deserialize_secret_struct(&serialized.unwrap());
+//     println!(
+//         "Struct field from deserialized: {}",
+//         deserialized.unwrap().content
+//     )
+// }
+// #[test]
+// #[cfg(target_feature = "_disabled")]
+// fn test_patching() {
+//     // TODO add more assertions
+//     let mut base = create_mock_meta();
+//     println!("OLD metadata: {:?}", base);
+//     let overwrite: SecretMeta = SecretMeta {
+//         max_versions: 10,
+//         versions: vec![VersionMeta {
+//             created_time: Utc::now(),
+//             deletion_time: Some(Utc::now()),
+//             destroyed: true,
+//         }],
+//         cas_required: true,
+//         delete_version_after: "10m".to_string(),
+//         current_version: 4,
+//         oldest_version: 2,
+//         updated_time: Utc::now(),
+//         created_time: Utc::now(),
+//         custom_metadata: Some(HashMap::new()),
+//     };
+//     let mut patched: Option<SecretMeta> = None;
+//     match patch_metadata(&mut base, &overwrite) {
+//         Ok(meta) => {
+//             println!("NEW metadata: {:?}", meta);
+//             println!("patched successfully");
+//             patched = Some(meta);
+//         }
+//         Err(e) => {
+//             log::error!("error patching metadata: {}", e);
+//             panic!("Patching failed");
+//         }
+//     }
+
+//     if let Some(patched_meta) = patched {
+//         assert!(patched_meta.current_version == 4);
+//         assert!(patched_meta.versions[0].destroyed == true);
+//     } else {
+//         panic!("patched was not initialized");
+//     }
+// }

src/identity.rs

@@ -1,7 +1,7 @@
 use axum::Router;
 
-use crate::storage::DbPool;
+use crate::storage::DatabaseDriver;
 
-pub fn identity_router(pool: DbPool) -> Router<DbPool> {
+pub fn identity_router(pool: DatabaseDriver) -> Router<DatabaseDriver> {
     Router::new().with_state(pool)
 }

src/main.rs

@@ -1,25 +1,18 @@
-#![forbid(unsafe_code)]
-
-// // There are some placeholder functions, that will have to be implemented before the first release.
-// // They are marked with `todo!()` to indicate that they need to be implemented.
-// // We want to keep these functions in the codebase.
-// // That is why we choose to suppress unused warnings for now.
-// #![allow(unused)]
-
-use crate::common::HttpError;
 use axum::{
-    Router,
     extract::Request,
     http::StatusCode,
     middleware::{self, Next},
     response::{IntoResponse, Response},
     routing::get,
+    Router,
 };
 use log::*;
 use std::{env, net::SocketAddr, str::FromStr};
-use storage::DbPool;
+use storage::DatabaseDriver;
 use tokio::{net::TcpListener, signal};
 
+use crate::common::HttpError;
+
 mod auth;
 mod common;
 mod engines;
@@ -29,12 +22,13 @@ mod sys;
 
 #[tokio::main]
 async fn main() {
-    // NOTE: Rethink choice of environment variables in regards to security in the future
+    // To be configured via environment variables
-    let _ = dotenvy::dotenv();
+    // choose from (highest to lowest): error, warn, info, debug, trace, off
+    env::set_var("RUST_LOG", "trace");
+    // env::set_var("DATABASE_URL", "sqlite:test.db"); // Format for the env var config. Consider moving to an .env file
     env_logger::init();
-
     // Listen on all IPv4 and IPv6 interfaces on port 8200 by default
-    let listen_addr = env::var("LISTEN_ADDR").unwrap_or("[::]:8200".to_string());
+    let listen_addr = env::var("LISTEN_ADDR").unwrap_or("[::]:8200".to_string()); // Do not change
     let listen_addr = SocketAddr::from_str(&listen_addr).expect("Failed to parse LISTEN_ADDR");
 
     let db_url = env::var("DATABASE_URL").expect("DATABASE_URL must be set");
@@ -52,13 +46,7 @@ async fn main() {
         .layer(middleware::from_fn(set_default_content_type_json))
         .with_state(pool.clone());
 
-    if !storage::sealing::prepare_unseal(&pool).await {
+    warn!("Listening on {}", listen_addr.to_string());
-        storage::sealing::init_default(&pool).await;
-    }
-
-    auth::token::create_root_token_if_none_exist(&pool).await;
-
-    warn!("Listening on {listen_addr}");
     // Start listening
     let listener = TcpListener::bind(listen_addr).await.unwrap();
     axum::serve(listener, app)
@@ -67,22 +55,20 @@ async fn main() {
         .unwrap();
 }
 
-/// Middleware setting unspecified `Content-Type`s to json since this is done by client libraries.
-/// Axum's [axum::extract::Json] rejects extraction attempts without json content type.
 async fn set_default_content_type_json(
     mut req: Request,
     next: Next,
 ) -> Result<impl IntoResponse, Response> {
     if req.headers().get("content-type").is_none() {
         let headers = req.headers_mut();
-
+        // debug!("Request header: \n{:?}", headers);
         headers.insert("content-type", "application/json".parse().unwrap());
     }
 
     Ok(next.run(req).await)
 }
 
-async fn shutdown_signal(pool: DbPool) {
+async fn shutdown_signal(pool: DatabaseDriver) {
     let ctrl_c = async {
         signal::ctrl_c()
             .await
@@ -109,7 +95,6 @@ async fn shutdown_signal(pool: DbPool) {
 }
 
 /// Fallback route for unknown routes
-///
 /// Note: `/v1/*` is handled by [`engines::secrets_router`]
 async fn fallback_route_unknown(req: Request) -> Response {
     log::error!(
@@ -122,7 +107,7 @@ async fn fallback_route_unknown(req: Request) -> Response {
     HttpError::simple(StatusCode::NOT_FOUND, "Route not implemented")
 }
 
-/// Basic handler that responds with a static string
+/// basic handler that responds with a static string
 async fn root() -> &'static str {
     info!("Hello world");
     "Hello, World!"

src/storage.rs

@@ -1,26 +1,16 @@
-pub mod sealing;
-
 use std::{fs::File, path::Path};
 
 use log::*;
-use sqlx::{Pool, Sqlite, sqlite::SqlitePoolOptions};
+use sqlx::{sqlite::SqlitePoolOptions, Pool, Sqlite};
 
-pub(crate) type DbType = Sqlite;
+pub(crate) type DatabaseDriver = Pool<Sqlite>;
-pub(crate) type DbPool = Pool<DbType>;
 
-/// Creates a SQLx SQLite database pool.
+pub async fn create_pool(db_url: String) -> DatabaseDriver {
-/// If nonexistent, it creates a new SQLite file.
-///
-/// Note: rvault uses compile-time queries.
-/// Hence, during development a migrated SQLite file is required.
-/// Use `cargo sqlx database reset` if required.
-/// Otherwise, set the env var `SQLX_OFFLINE=true` during compilation (not helpful for development).
-pub async fn create_pool(db_url: String) -> DbPool {
     // Create SQLite database file if it does not exist
     if db_url.starts_with("sqlite:") && db_url != ("sqlite::memory:") {
         let path = db_url.replace("sqlite:", "");
         if !Path::new(&path).exists() {
-            warn!("Sqlite database does not exist, creating file {path}");
+            warn!("Sqlite database does not exist, creating file {}", path);
             File::create(&path).expect("Failed to create database file");
         }
     }

src/storage/sealing.rs

@@ -1,330 +0,0 @@
-#[cfg(feature = "shamir")]
-pub mod shamir;
-pub mod simple;
-
-use aes_gcm_siv::{
-    AeadCore, Aes256GcmSiv, KeyInit,
-    aead::{Aead, OsRng},
-};
-use log::{error, info, warn};
-use simple::SimpleSealing;
-use tokio::sync::RwLock;
-
-use super::DbPool;
-
-#[derive(PartialEq)]
-enum KeyEnum {
-    /// Final key
-    MainKey(Vec<u8>),
-    /// Encrypted with single secret (protected_rk, nonce)
-    Simple(SimpleSealing),
-    #[cfg(feature = "shamir")]
-    // Shamir's Secret Sharing
-    Shamir(shamir::ShamirBucket),
-    /// Unknown or not initialized
-    Uninitialized,
-}
-
-trait Sealing {
-    fn new(protected_rk: Vec<u8>, nonce: Vec<u8>) -> Self;
-
-    async fn unseal(&mut self, key: String) -> UnsealResult;
-}
-
-struct ProtectedRK {
-    pub protection_type: String,
-    pub encrypted_key: Vec<u8>,
-    pub nonce: Option<Vec<u8>>,
-}
-
-static ROOT_KEY_MAYBE: RwLock<KeyEnum> = RwLock::const_new(KeyEnum::Uninitialized);
-
-/// Returns `true` if vault is initialized or unsealed.
-/// Returns `false` if uninitialized (nothing in the database).
-pub async fn prepare_unseal(pool: &DbPool) -> bool {
-    {
-        if !matches!(*ROOT_KEY_MAYBE.read().await, KeyEnum::Uninitialized) {
-            info!("Vault unseal is already prepared");
-            return true;
-        }
-    }
-
-    let lock = ROOT_KEY_MAYBE.write(); // Not awaited just here
-
-    let rk = sqlx::query_as!(
-        ProtectedRK,
-        "SELECT encrypted_key, type as protection_type, nonce FROM root_key ORDER BY version LIMIT 1"
-    )
-    .fetch_optional(pool)
-    .await
-    .expect("Failed to optionally read root key from the database");
-
-    let v = match rk {
-        Some(v) => v,
-        None => {
-            warn!("No root key was found in the database!");
-            return false;
-        }
-    };
-    info!(
-        "Root key of type {} found in the database",
-        v.protection_type
-    );
-
-    let mut lock = lock.await;
-    let nonce = v.nonce.expect("Simple encryption but the nonce is missing");
-    let res = match &*v.protection_type {
-        #[cfg(feature = "insecure-dev-sealing")]
-        "dev_only" => {
-            warn!(
-                "Root key is of type {}. This is INSECURE and must only be used for development purposes!",
-                v.protection_type
-            );
-            KeyEnum::MainKey(v.encrypted_key)
-        }
-        #[cfg(not(feature = "insecure-dev-sealing"))]
-        "dev_only" => panic!(
-            r#"Database is insecure but "insecure-dev-sealing" is not enabled for this build!"#
-        ),
-        "simple" => KeyEnum::Simple(SimpleSealing::new(v.encrypted_key, nonce)),
-        #[cfg(feature = "shamir")]
-        "shamir" => KeyEnum::Shamir(shamir::ShamirBucket::new(v.encrypted_key, nonce)),
-        #[cfg(not(feature = "shamir"))]
-        "shamir" => panic!(r#"Feature "shamir" is not enabled for this build!"#),
-        _ => panic!("Unknown root key type in database"),
-    };
-    *lock = res;
-    true
-}
-
-/// Must NOT be used in production.
-/// Token is plainly stored in the database and will be unsealed directly by [prepare_unseal]!
-/// Danger!
-#[cfg(feature = "insecure-dev-sealing")]
-pub async fn init_insecure_in_db(pool: &DbPool) {
-    let root_key = Aes256GcmSiv::generate_key(&mut OsRng);
-    let root_key = root_key.as_slice().to_owned();
-
-    warn!(
-        "Danger: INSECURE! Generated root key is stored plainly in the database. Must ONLY be used for development!"
-    );
-    write_new_root_key(pool, root_key, "dev_only", Some(b"")).await;
-}
-
-async fn write_new_root_key(
-    pool: &DbPool,
-    protected_key: Vec<u8>,
-    type_to_be: &str,
-    nonce: Option<&[u8]>,
-) {
-    let _ = sqlx::query!(
-        "
-        INSERT INTO root_key (encrypted_key, type, version, nonce)
-        VALUES ($1, $2, 1, $3)
-        ",
-        protected_key,
-        type_to_be,
-        nonce
-    )
-    .execute(pool)
-    .await
-    .expect("Failed to write new root key to the database");
-
-    info!("Initialized new root key!");
-}
-
-pub async fn reseal(pool: &DbPool) {
-    {
-        let mut lock = ROOT_KEY_MAYBE.write().await;
-        *lock = KeyEnum::Uninitialized;
-    }
-    prepare_unseal(pool).await;
-}
-
-// pub async fn sealing_status() {
-//     let lock = ROOT_KEY_MAYBE.read().await;
-//     match &*lock {
-//         KeyEnum::MainKey(_) => todo!(),
-//         KeyEnum::Simple(_, _) => todo!(),
-//         KeyEnum::Uninitialized => todo!(),
-//         KeyEnum::Shamir(_, _) => todo!(),
-//     }
-// }
-
-pub async fn provide_key(key: String) -> UnsealResult {
-    // First, check if we need to write-lock at all
-    {
-        let read_lock = ROOT_KEY_MAYBE.read().await;
-        if matches!(*read_lock, KeyEnum::MainKey(_)) {
-            info!("Providing keys is useless since vault is already unlocked");
-            return UnsealResult::AlreadyDone;
-        } else if matches!(*read_lock, KeyEnum::Uninitialized) {
-            error!("Cannot process provided key when the vault is uninitialized");
-            return UnsealResult::Uninitialized;
-        }
-    }
-
-    // A write lock is necessary.
-    let mut write_lock = ROOT_KEY_MAYBE.write().await;
-    let rk = match &mut *write_lock {
-        KeyEnum::MainKey(_) | KeyEnum::Uninitialized => {
-            unreachable!("Should have been checked above")
-        }
-        KeyEnum::Simple(simple) => simple.unseal(key).await,
-        #[cfg(feature = "shamir")]
-        KeyEnum::Shamir(shamir) => shamir.unseal(key).await,
-    };
-    let rk = match rk {
-        UnsealResult::DoneConfidential(rk) => rk,
-        UnsealResult::Done => unreachable!(),
-        reject_action => return reject_action,
-    };
-    *write_lock = KeyEnum::MainKey(rk);
-
-    info!("Unsealing done; Vault ready");
-    UnsealResult::Done
-}
-
-pub struct Secret {
-    pub nonce: [u8; 12],
-    pub protected_data: Vec<u8>,
-}
-
-impl Secret {
-    pub fn new<D, N>(data: D, nonce: N) -> Self
-    where
-        D: Into<Vec<u8>>,
-        N: AsRef<[u8]>,
-    {
-        let nonce_slice = nonce.as_ref();
-        assert!(
-            nonce_slice.len() == 12,
-            "Nonce must be exactly 12 bytes long"
-        );
-
-        let nonce: &[u8; 12] = nonce_slice.try_into().expect("Nonce must be 12 bytes long");
-
-        Self {
-            nonce: *nonce,
-            protected_data: data.into(),
-        }
-    }
-
-    /// Encrypt a secret
-    ///
-    /// # Errors
-    ///
-    /// This function will return an error if the vault is uninitialized or an unknown error occurs.
-    pub async fn encrypt(data: &String) -> Result<Self, ()> {
-        let cipher = if let KeyEnum::MainKey(key) = &*ROOT_KEY_MAYBE.read().await {
-            match Aes256GcmSiv::new_from_slice(key) {
-                Ok(v) => v,
-                Err(e) => {
-                    error!("Failed to create new AesGcmSiv cipher from variable size key: {e}");
-                    return Err(());
-                }
-            }
-        } else {
-            error!("Cannot encrypt secret since the vault is not unsealed");
-            return Err(());
-        };
-
-        let nonce: aes_gcm_siv::aead::generic_array::GenericArray<
-            u8,
-            <Aes256GcmSiv as aes_gcm_siv::AeadCore>::NonceSize,
-        > = Aes256GcmSiv::generate_nonce(&mut OsRng); // 96-bits; unique per message
-        let enc = match cipher.encrypt(&nonce, data.as_bytes()) {
-            Ok(v) => v,
-            Err(e) => {
-                error!("Failed to encrypt secret with cipher: {e}");
-                return Err(());
-            }
-        };
-        debug_assert!(nonce.len() == 12, "Nonce should be exactly 12 bytes");
-        let nonce = match nonce.as_slice().try_into() {
-            Ok(v) => v,
-            Err(e) => {
-                error!("Nonce should be exactly 12 bytes: {e}");
-                return Err(());
-            }
-        };
-        Ok(Self {
-            nonce,
-            protected_data: enc,
-        })
-    }
-
-    pub async fn decrypt_bytes(self) -> Result<Vec<u8>, ()> {
-        assert!(self.nonce.len() == 12);
-        let cipher = match &*ROOT_KEY_MAYBE.read().await {
-            KeyEnum::MainKey(key) => Aes256GcmSiv::new_from_slice(key),
-            _ => panic!("Cannot seal secret since the vault is not unsealed"),
-        }
-        .expect("Failed to create new AesGcmSiv cipher from variable size key");
-
-        let nonce = aes_gcm_siv::aead::generic_array::GenericArray::from_slice(&self.nonce);
-        let enc = match cipher.decrypt(nonce, self.protected_data.as_ref()) {
-            Ok(v) => v,
-            Err(e) => {
-                error!("Failed to decrypt secret with given nonce and cipher: {e}");
-                return Err(());
-            }
-        };
-        Ok(enc)
-    }
-
-    pub async fn decrypt(self) -> Result<String, ()> {
-        String::from_utf8(self.decrypt_bytes().await?).map_err(|e| {
-            error!("Failed to parse secret as UTF8: {e}");
-        })
-    }
-}
-
-pub enum UnsealResult {
-    /// Unsealing finished, with root key hidden
-    Done,
-    /// Was already unsealed, no action taken
-    AlreadyDone,
-    /// Could not unseal as the vault is uninitialized
-    Uninitialized,
-
-    /// Unsealing finished, returns root key
-    DoneConfidential(Vec<u8>),
-    /// Unsealing attempt has been recorded but is not sufficient
-    Unfinished,
-    /// The provided or the set of previously provided portions are invalid.
-    /// Unsealing has been reset.
-    InvalidReset,
-    /// Duplicate share
-    Duplicate,
-    /// Error processing share, invalid
-    InvalidRejected,
-}
-
-pub async fn init_default(pool: &DbPool) {
-    #[cfg(feature = "insecure-dev-sealing")]
-    let user_key = {
-        storage::sealing::init_insecure_in_db(&pool).await;
-        "INSECURE automatic unlock - TESTING ONLY"
-    };
-
-    #[cfg(not(feature = "insecure-dev-sealing"))]
-    let user_key = {
-        #[cfg(not(feature = "shamir"))]
-        {
-            simple::init_simple(&pool).await
-        }
-
-        #[cfg(feature = "shamir")]
-        {
-            shamir::init_shamir(pool, 2, 5).await
-        }
-    };
-
-    let success = prepare_unseal(pool).await;
-    warn!("New sealing password generated: {user_key:?}");
-    assert!(
-        success,
-        "Vault ought to have been initialized just now but it is not."
-    );
-}

src/storage/sealing/shamir.rs

@@ -1,225 +0,0 @@
-use aes_gcm_siv::{
-    AeadCore, Aes256GcmSiv, KeyInit,
-    aead::{Aead, OsRng, generic_array::GenericArray},
-};
-use base64::{Engine, prelude::BASE64_STANDARD};
-use log::{error, info, warn};
-use p256::{NonZeroScalar, Scalar, SecretKey};
-use serde::{Deserialize, Serialize};
-use serde_json::json;
-use vsss_rs::{
-    DefaultShare, Error as VsssErr, IdentifierPrimeField, ReadableShareSet, ShareElement,
-    ValuePrimeField,
-};
-use zeroize::ZeroizeOnDrop;
-
-use crate::DbPool;
-
-use super::{Sealing, UnsealResult, write_new_root_key};
-
-type P256Share = DefaultShare<IdentifierPrimeField<Scalar>, IdentifierPrimeField<Scalar>>;
-
-#[derive(PartialEq, Clone, Debug, Serialize, Deserialize, ZeroizeOnDrop)]
-/// Differs from [P256Share] by containing Strings
-struct ShamirPortion {
-    #[serde(rename = "i")]
-    pub identifier: Vec<u8>,
-    #[serde(rename = "v")]
-    pub value: Vec<u8>,
-}
-
-#[derive(PartialEq)]
-/// Container for multiple [ShamirPortion]s and the protected root key.
-/// Multiple instances could exist in the future for per-namespace encryption.
-pub struct ShamirBucket {
-    portions: Vec<ShamirPortion>,
-    protected_rk: Vec<u8>,
-    nonce: Vec<u8>,
-}
-
-impl Sealing for ShamirBucket {
-    fn new(protected_rk: Vec<u8>, nonce: Vec<u8>) -> Self {
-        Self {
-            portions: Vec::with_capacity(2),
-            protected_rk,
-            nonce,
-        }
-    }
-
-    async fn unseal(&mut self, key: String) -> UnsealResult {
-        let key = match BASE64_STANDARD.decode(key) {
-            Ok(v) => v,
-            Err(e) => {
-                warn!("Portion could not be decoded: {e}");
-                return UnsealResult::InvalidRejected;
-            }
-        };
-        let key_portion: ShamirPortion = match serde_json::from_slice(&key) {
-            Ok(v) => v,
-            Err(e) => {
-                info!("Portion could not be parsed: {e}");
-                return UnsealResult::InvalidRejected;
-            }
-        };
-
-        if self.portions.contains(&key_portion) {
-            warn!("The supplied Shamir portion is already known. Duplication ignored.");
-            return UnsealResult::Duplicate;
-        }
-        self.portions.push(key_portion);
-
-        let joined_keys = match join_keys(&self.portions) {
-            Ok(v) => v,
-            Err(e) => {
-                return match e {
-                    VsssErr::SharingMinThreshold => {
-                        info!("Shamir portion provided. Sharing threshold not reached.");
-                        UnsealResult::Unfinished
-                    },
-                    VsssErr::SharingDuplicateIdentifier => unreachable!("Addition of duplicate keys should have been prevented by not recording them"),
-                    e => {
-                        error!("Unknown error occurred upon joining keys {e:?}");
-                        unreachable!()
-                    },
-                };
-            }
-        }
-        .to_bytes();
-
-        let cipher = match Aes256GcmSiv::new_from_slice(&joined_keys) {
-            Ok(v) => v,
-            Err(e) => {
-                info!("Cipher could not be created from slice: {e}");
-                return UnsealResult::InvalidRejected;
-            }
-        };
-        debug_assert_eq!(self.nonce.len(), 12);
-        let nonce = aes_gcm_siv::aead::generic_array::GenericArray::from_slice(&self.nonce);
-        let root_key = cipher.decrypt(nonce, self.protected_rk.as_ref());
-        match root_key {
-            Ok(v) => UnsealResult::DoneConfidential(v),
-            Err(_) => {
-                // Err is opaque on purpose
-                self.portions.clear();
-                warn!(
-                    "Enough shares have been provided but the set of shares is invalid. The set of shares has been reset."
-                );
-                UnsealResult::InvalidReset
-            }
-        }
-    }
-}
-
-/// Shamir Secret Sharing does not verify a portion for validity,
-/// unlike Feldman Verified Secret Sharing, which is built on Shamir.
-/// "Validation" happens by attempting to decrypt the root key.
-///
-/// # Returns
-/// List of encoded key portions
-pub async fn init_shamir(pool: &DbPool, threshold: usize, limit: usize) -> Vec<String> {
-    let root_key = Aes256GcmSiv::generate_key(&mut OsRng);
-    let nonce: GenericArray<u8, <Aes256GcmSiv as AeadCore>::NonceSize> =
-        Aes256GcmSiv::generate_nonce(&mut OsRng); // 96-bits; unique per message
-    let root_key = root_key.as_slice().to_owned();
-
-    let (user_key, protected_rk) = {
-        let key = Aes256GcmSiv::generate_key(&mut OsRng);
-        let cipher = Aes256GcmSiv::new(&key);
-        let nonce: &[u8] = nonce.as_slice();
-        debug_assert_eq!(nonce.len(), 12);
-        let nonce = aes_gcm_siv::aead::generic_array::GenericArray::from_slice(nonce);
-        let enc = cipher.encrypt(nonce, root_key.as_slice()).unwrap();
-        (key, enc)
-    };
-
-    let portions = share_keys(&mut OsRng, threshold, limit, &user_key);
-
-    log::debug!("Shared Keys: {portions:?}");
-
-    write_new_root_key(pool, protected_rk, "shamir", Some(nonce.as_slice())).await;
-    portions
-}
-
-/// Returns a Vec of Base64 encoded JSON-wrapped identifier-value pairs
-fn share_keys(
-    mut osrng: &mut OsRng,
-    threshold: usize,
-    limit: usize,
-    root_key: &[u8],
-) -> Vec<String> {
-    log::debug!("RK: {root_key:?}");
-    assert!(
-        threshold <= limit,
-        "Threshold cannot be higher than the number of shares (limit)"
-    );
-
-    let rk_array = GenericArray::from_slice(root_key);
-    let rk_scalar = NonZeroScalar::from_repr(*rk_array).unwrap();
-    let shared_secret = IdentifierPrimeField(*rk_scalar.as_ref());
-    let res =
-        vsss_rs::shamir::split_secret::<P256Share>(threshold, limit, &shared_secret, &mut osrng);
-
-    res.unwrap()
-        .iter()
-        .map(|f| {
-            BASE64_STANDARD.encode(
-                json!(ShamirPortion {
-                    identifier: f.identifier.to_vec(),
-                    value: f.value.to_vec(),
-                })
-                .to_string(),
-            )
-        })
-        .collect()
-}
-
-fn join_keys(shares: &[ShamirPortion]) -> Result<SecretKey, vsss_rs::Error> {
-    let shares: Vec<P256Share> = shares
-        .iter()
-        .map(|portion| {
-            let identifier = IdentifierPrimeField::<Scalar>::from_slice(&portion.identifier)
-                .map_err(|e| {
-                    info!("Portion could not be converted to IdentifierPrimeField: {e}");
-                    VsssErr::InvalidShare
-                })?;
-            let value = ValuePrimeField::<Scalar>::from_slice(&portion.value).map_err(|e| {
-                info!("Portion could not be converted to ValuePrimeField: {e}");
-                VsssErr::InvalidShare
-            })?;
-            Ok(P256Share { identifier, value })
-        })
-        .collect::<Result<_, VsssErr>>()?;
-
-    let scalar = shares.combine()?;
-    // A little suboptimal thanks to CtOption
-    let nzs = match NonZeroScalar::from_repr(scalar.0.into()).into_option() {
-        Some(v) => v,
-        None => return Err(VsssErr::InvalidShare),
-    };
-    let sk = SecretKey::from(nzs);
-    Ok(sk)
-}
-
-#[test]
-fn split_and_join() {
-    let root_key = Aes256GcmSiv::generate_key(&mut OsRng);
-    let root_key = root_key.as_slice().to_owned();
-    let kps = share_keys(&mut OsRng, 2, 5, &root_key);
-
-    let kps: Vec<_> = kps
-        .iter()
-        .map(|f| {
-            let b = BASE64_STANDARD
-                .decode(f)
-                .expect("A portion could not be decoded from BASE64");
-            serde_json::from_slice(&b).expect("A portion could not be parsed as a key pair")
-        })
-        .collect();
-    let k = join_keys(&kps).expect("Error on joining key pairs");
-
-    assert_eq!(
-        root_key,
-        k.to_bytes().as_slice(),
-        "Original key and re-combined key from shares are not equal"
-    );
-}

src/storage/sealing/simple.rs

@@ -1,48 +0,0 @@
-use aes_gcm_siv::{
-    AeadCore, Aes256GcmSiv, KeyInit,
-    aead::{Aead, OsRng, generic_array::GenericArray},
-};
-use base64::{Engine, prelude::BASE64_STANDARD};
-
-use crate::DbPool;
-
-use super::{Sealing, UnsealResult, write_new_root_key};
-
-/// Pair of protected root key and nonce
-#[derive(PartialEq)]
-pub struct SimpleSealing(Vec<u8>, Vec<u8>);
-
-impl Sealing for SimpleSealing {
-    fn new(protected_rk: Vec<u8>, nonce: Vec<u8>) -> Self {
-        Self(protected_rk, nonce)
-    }
-
-    async fn unseal(&mut self, key: String) -> UnsealResult {
-        let key = BASE64_STANDARD.decode(key).unwrap();
-        let cipher = Aes256GcmSiv::new_from_slice(&key).unwrap();
-        debug_assert_eq!(self.1.len(), 12);
-        let nonce = aes_gcm_siv::aead::generic_array::GenericArray::from_slice(self.1.as_slice());
-        UnsealResult::DoneConfidential(cipher.decrypt(nonce, self.0.as_ref()).unwrap())
-    }
-}
-
-/// Initialize the vault with a simple password
-#[allow(unused)]
-pub async fn init_simple(pool: &DbPool) -> String {
-    let root_key = Aes256GcmSiv::generate_key(&mut OsRng);
-    let nonce: GenericArray<u8, <Aes256GcmSiv as AeadCore>::NonceSize> =
-        Aes256GcmSiv::generate_nonce(&mut OsRng); // 96-bits; unique per message
-    let root_key = root_key.as_slice().to_owned();
-
-    let (user_key, protected_rk) = {
-        let key = Aes256GcmSiv::generate_key(&mut OsRng);
-        let cipher = Aes256GcmSiv::new(&key);
-        let nonce: &[u8] = nonce.as_slice();
-        debug_assert_eq!(nonce.len(), 12);
-        let nonce = aes_gcm_siv::aead::generic_array::GenericArray::from_slice(nonce);
-        let enc = cipher.encrypt(nonce, root_key.as_slice()).unwrap();
-        (key, enc)
-    };
-    write_new_root_key(pool, protected_rk, "simple", Some(nonce.as_slice())).await;
-    BASE64_STANDARD.encode(user_key)
-}

src/sys.rs

@@ -1,16 +1,8 @@
-mod root_generation;
-mod sealing;
-
 use axum::Router;
-use root_generation::root_generation;
-use sealing::sealing_routes;
 
-use crate::storage::DbPool;
+use crate::storage::DatabaseDriver;
 
 /// System routes
-pub fn sys_router(pool: DbPool) -> Router<DbPool> {
+pub fn sys_router(pool: DatabaseDriver) -> Router<DatabaseDriver> {
-    Router::new()
+    Router::new().with_state(pool)
-        .merge(sealing_routes())
-        .merge(root_generation())
-        .with_state(pool)
 }

src/sys/root_generation.rs

@@ -1,14 +0,0 @@
-use axum::{Router, routing::post};
-
-use crate::DbPool;
-
-pub fn root_generation() -> Router<DbPool> {
-    Router::new()
-        // .route("/generate-root", get(get_root_generation_attempt))
-        // .route("/generate-root", delete(cancel_generate_root))
-        .route("/generate-root", post(generate_new_root))
-}
-
-async fn generate_new_root() {
-    todo!()
-}

src/sys/sealing.rs

@@ -1,54 +0,0 @@
-use axum::{
-    Json, Router,
-    extract::State,
-    routing::{get, post, put},
-};
-use log::warn;
-use serde::Deserialize;
-
-use crate::storage::{DbPool, sealing};
-
-pub fn sealing_routes() -> Router<DbPool> {
-    Router::new()
-        .route("/seal", post(seal_post))
-        .route("/seal-status", get(seal_status_get))
-        .route("/unseal", post(unseal_post))
-        // Again? Its supposed to be POST but actually a PUT
-        .route("/unseal", put(unseal_post))
-}
-
-async fn seal_post(State(pool): State<DbPool>) {
-    sealing::reseal(&pool).await;
-}
-
-#[derive(Deserialize)]
-struct UnsealRequest {
-    /// Required, unless `reset` is true
-    pub key: Option<String>,
-    #[serde(default)]
-    /// Specifies if previously-provided unseal keys are discarded and the unseal process is reset.
-    pub reset: bool,
-    // #[serde(default)]
-    // /// Used to migrate the seal from shamir to autoseal or autoseal to shamir. Must be provided on all unseal key calls.
-    // pub migrate: bool,
-}
-
-async fn unseal_post(State(pool): State<DbPool>, Json(req): Json<UnsealRequest>) -> Result<(), ()> {
-    if req.reset {
-        warn!("Unsealing progress has been reset on unseal request");
-        sealing::reseal(&pool).await;
-    }
-
-    if let Some(key) = req.key {
-        sealing::provide_key(key).await;
-    } else if !req.reset {
-        // No request key nor reset = bad request
-        return Err(());
-    }
-
-    Ok(())
-}
-
-async fn seal_status_get(State(_pool): State<DbPool>) -> &'static str {
-    todo!("not implemented")
-}