fix(secrets-ui): preserve metadata on rotate + audit unexpected mutation/reveal failures
This commit is contained in:
Joseph Doherty
@@ -57,12 +57,53 @@
|
||||
{
|
||||
_error = null;
|
||||
_busy = true;
|
||||
bool deleted = false;
|
||||
try
|
||||
{
|
||||
string actor = await SecretActorResolver.ResolveAsync(Services, AuthState);
|
||||
|
||||
await Store.DeleteAsync(Name, actor, _cts.Token);
|
||||
try
|
||||
{
|
||||
await Store.DeleteAsync(Name, actor, _cts.Token);
|
||||
|
||||
await Audit.WriteAsync(
|
||||
new AuditEvent
|
||||
{
|
||||
EventId = Guid.NewGuid(),
|
||||
OccurredAtUtc = DateTimeOffset.UtcNow,
|
||||
Actor = actor,
|
||||
Action = "secret.delete",
|
||||
Outcome = AuditOutcome.Success,
|
||||
Category = "Secrets",
|
||||
Target = Name.Value,
|
||||
},
|
||||
_cts.Token);
|
||||
|
||||
deleted = true;
|
||||
}
|
||||
catch (Exception)
|
||||
{
|
||||
// An unexpected store fault must still be audited as a Failure and surfaced to the
|
||||
// operator instead of tearing down the circuit.
|
||||
_error = "Unable to delete the secret.";
|
||||
await WriteFailureAuditAsync(actor);
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
_busy = false;
|
||||
}
|
||||
|
||||
if (deleted)
|
||||
{
|
||||
await OnDeleted.InvokeAsync();
|
||||
}
|
||||
}
|
||||
|
||||
private async Task WriteFailureAuditAsync(string actor)
|
||||
{
|
||||
try
|
||||
{
|
||||
await Audit.WriteAsync(
|
||||
new AuditEvent
|
||||
{
|
||||
@@ -70,17 +111,16 @@
|
||||
OccurredAtUtc = DateTimeOffset.UtcNow,
|
||||
Actor = actor,
|
||||
Action = "secret.delete",
|
||||
Outcome = AuditOutcome.Success,
|
||||
Outcome = AuditOutcome.Failure,
|
||||
Category = "Secrets",
|
||||
Target = Name.Value,
|
||||
DetailsJson = "{\"reason\":\"error\"}",
|
||||
},
|
||||
_cts.Token);
|
||||
|
||||
await OnDeleted.InvokeAsync();
|
||||
}
|
||||
finally
|
||||
catch
|
||||
{
|
||||
_busy = false;
|
||||
// Best-effort audit of a failure; never let audit itself surface into the event pipeline.
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -73,6 +73,15 @@ else
|
||||
_error = "Unable to decrypt secret.";
|
||||
outcome = AuditOutcome.Failure;
|
||||
}
|
||||
catch (Exception)
|
||||
{
|
||||
// Any other unexpected store/cipher fault (e.g. master key unavailable, timeout) must
|
||||
// still be audited as a Failure and surfaced to the user, not left to tear down the
|
||||
// circuit. The value is never shown.
|
||||
_value = null;
|
||||
_error = "Unable to reveal secret.";
|
||||
outcome = AuditOutcome.Failure;
|
||||
}
|
||||
finally
|
||||
{
|
||||
_busy = false;
|
||||
@@ -80,18 +89,26 @@ else
|
||||
}
|
||||
|
||||
string actor = await SecretActorResolver.ResolveAsync(Services, AuthState);
|
||||
await Audit.WriteAsync(
|
||||
new AuditEvent
|
||||
{
|
||||
EventId = Guid.NewGuid(),
|
||||
OccurredAtUtc = DateTimeOffset.UtcNow,
|
||||
Actor = actor,
|
||||
Action = "secret.reveal",
|
||||
Outcome = outcome,
|
||||
Category = "Secrets",
|
||||
Target = Name.Value,
|
||||
},
|
||||
_cts.Token);
|
||||
try
|
||||
{
|
||||
await Audit.WriteAsync(
|
||||
new AuditEvent
|
||||
{
|
||||
EventId = Guid.NewGuid(),
|
||||
OccurredAtUtc = DateTimeOffset.UtcNow,
|
||||
Actor = actor,
|
||||
Action = "secret.reveal",
|
||||
Outcome = outcome,
|
||||
Category = "Secrets",
|
||||
Target = Name.Value,
|
||||
DetailsJson = outcome == AuditOutcome.Failure ? "{\"reason\":\"error\"}" : null,
|
||||
},
|
||||
_cts.Token);
|
||||
}
|
||||
catch
|
||||
{
|
||||
// Best-effort audit; never let an audit-write fault surface into the event pipeline.
|
||||
}
|
||||
}
|
||||
|
||||
private void Hide()
|
||||
|
||||
@@ -82,13 +82,26 @@
|
||||
[CascadingParameter] private Task<AuthenticationState>? AuthState { get; set; }
|
||||
|
||||
private bool IsRotate => ExistingName is not null;
|
||||
private bool _metadataLoaded;
|
||||
|
||||
/// <inheritdoc />
|
||||
protected override void OnParametersSet()
|
||||
protected override async Task OnParametersSetAsync()
|
||||
{
|
||||
if (IsRotate)
|
||||
{
|
||||
_name = ExistingName!.Value.Value;
|
||||
|
||||
// Rotate must preserve the existing row's metadata: the store's upsert overwrites the
|
||||
// description and content type from the incoming row, so pre-fill both from the current
|
||||
// row (metadata only — no plaintext is read or decrypted). Load once so a re-render does
|
||||
// not clobber operator edits. The operator still supplies the NEW value.
|
||||
if (!_metadataLoaded)
|
||||
{
|
||||
_metadataLoaded = true;
|
||||
StoredSecret? row = await Store.GetAsync(ExistingName.Value, _cts.Token);
|
||||
_description = row?.Description ?? string.Empty;
|
||||
_contentType = row?.ContentType ?? SecretContentType.Text;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -108,37 +121,79 @@
|
||||
}
|
||||
|
||||
_busy = true;
|
||||
bool saved = false;
|
||||
try
|
||||
{
|
||||
string actor = await SecretActorResolver.ResolveAsync(Services, AuthState);
|
||||
|
||||
StoredSecret row = Cipher.Encrypt(name, _value, _contentType);
|
||||
row = row with
|
||||
try
|
||||
{
|
||||
Description = string.IsNullOrWhiteSpace(_description) ? null : _description,
|
||||
CreatedBy = actor,
|
||||
UpdatedBy = actor,
|
||||
};
|
||||
await Store.UpsertAsync(row, _cts.Token);
|
||||
StoredSecret row = Cipher.Encrypt(name, _value, _contentType);
|
||||
row = row with
|
||||
{
|
||||
Description = string.IsNullOrWhiteSpace(_description) ? null : _description,
|
||||
CreatedBy = actor,
|
||||
UpdatedBy = actor,
|
||||
};
|
||||
await Store.UpsertAsync(row, _cts.Token);
|
||||
|
||||
await Audit.WriteAsync(
|
||||
new AuditEvent
|
||||
{
|
||||
EventId = Guid.NewGuid(),
|
||||
OccurredAtUtc = DateTimeOffset.UtcNow,
|
||||
Actor = actor,
|
||||
Action = IsRotate ? "secret.rotate" : "secret.add",
|
||||
Outcome = AuditOutcome.Success,
|
||||
Category = "Secrets",
|
||||
Target = name.Value,
|
||||
},
|
||||
_cts.Token);
|
||||
|
||||
saved = true;
|
||||
}
|
||||
catch (Exception)
|
||||
{
|
||||
// An unexpected store/cipher fault (e.g. master key unavailable, timeout) must still
|
||||
// be audited as a Failure and surfaced to the operator — never the value — instead of
|
||||
// tearing down the circuit. The detail carries no plaintext.
|
||||
_error = IsRotate ? "Unable to rotate the secret." : "Unable to add the secret.";
|
||||
await WriteFailureAuditAsync(
|
||||
actor, IsRotate ? "secret.rotate" : "secret.add", name.Value);
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
_busy = false;
|
||||
}
|
||||
|
||||
if (saved)
|
||||
{
|
||||
await OnSaved.InvokeAsync();
|
||||
}
|
||||
}
|
||||
|
||||
private async Task WriteFailureAuditAsync(string actor, string action, string target)
|
||||
{
|
||||
try
|
||||
{
|
||||
await Audit.WriteAsync(
|
||||
new AuditEvent
|
||||
{
|
||||
EventId = Guid.NewGuid(),
|
||||
OccurredAtUtc = DateTimeOffset.UtcNow,
|
||||
Actor = actor,
|
||||
Action = IsRotate ? "secret.rotate" : "secret.add",
|
||||
Outcome = AuditOutcome.Success,
|
||||
Action = action,
|
||||
Outcome = AuditOutcome.Failure,
|
||||
Category = "Secrets",
|
||||
Target = name.Value,
|
||||
Target = target,
|
||||
DetailsJson = "{\"reason\":\"error\"}",
|
||||
},
|
||||
_cts.Token);
|
||||
|
||||
await OnSaved.InvokeAsync();
|
||||
}
|
||||
finally
|
||||
catch
|
||||
{
|
||||
_busy = false;
|
||||
// Best-effort audit of a failure; never let audit itself surface into the event pipeline.
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user