dohertj2/scadaproj
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(secrets-cli): doctor flow — catch scoped exactly to the rewrap call

Browse Source
This commit is contained in:
Joseph Doherty
2026-07-19 10:00:00 -04:00
parent e8b34be255
commit 4549b93d2a
1 changed files with 21 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ZB.MOM.WW.Secrets/src/ZB.MOM.WW.Secrets.Cli/Interactive/Flows/KekDoctorFlow.cs
+21 -15
View File
@@ -108,35 +108,41 @@ public sealed class KekDoctorFlow : IInteractiveFlow
{
IMasterKeyProvider oldKek = PromptForOldKek(console);
// Prompt and confirm OUTSIDE the guard: only the rewrap call itself is caught, so a stray
// ArgumentException from setup/prompt code is never mis-reported as a "rewrap failed" message.
string oldKekId = oldKek.KekId;
int moving = report.Rows.Count(r => string.Equals(r.RowKekId, oldKekId, StringComparison.Ordinal));
string confirmText =
$"Re-wrap {moving} row(s) from KEK '{Markup.Escape(oldKekId)}' → session KEK " +
$"'{Markup.Escape(report.SessionKekId)}'? (rewraps every row on the old KEK)";
if (!console.Prompt(new ConfirmationPrompt(confirmText) { DefaultValue = false }))
{
console.MarkupLine("[grey]Rewrap cancelled — no rows changed.[/]");
return;
}
RewrapReport result;
try
{
string oldKekId = oldKek.KekId;
int moving = report.Rows.Count(r => string.Equals(r.RowKekId, oldKekId, StringComparison.Ordinal));
string confirmText =
$"Re-wrap {moving} row(s) from KEK '{Markup.Escape(oldKekId)}' → session KEK " +
$"'{Markup.Escape(report.SessionKekId)}'? (rewraps every row on the old KEK)";
if (!console.Prompt(new ConfirmationPrompt(confirmText) { DefaultValue = false }))
{
console.MarkupLine("[grey]Rewrap cancelled — no rows changed.[/]");
return;
}
RewrapReport result = await doctor.RewrapAllAsync(session, oldKek, ct).ConfigureAwait(false);
console.MarkupLineInterpolated(
$"[green]Re-wrapped {result.Rewrapped} row(s)[/] onto the session KEK ({result.AlreadyCurrent} already current) of {result.Total} total.");
result = await doctor.RewrapAllAsync(session, oldKek, ct).ConfigureAwait(false);
}
catch (ArgumentException ex)
{
// Old and session KEK are identical — nothing to rotate.
console.MarkupLineInterpolated($"[red]Rewrap failed:[/] {ex.Message}");
return;
}
catch (SecretDecryptionException ex)
{
// Wrong old key, or a row wrapped by neither the old nor the session KEK (the pass aborted;
// any rows re-wrapped before the anomaly stay persisted).
console.MarkupLineInterpolated($"[red]Rewrap failed:[/] {ex.Message}");
return;
}
console.MarkupLineInterpolated(
$"[green]Re-wrapped {result.Rewrapped} row(s)[/] onto the session KEK ({result.AlreadyCurrent} already current) of {result.Total} total.");
}
// Prompts for the old-KEK source and builds the matching provider. Paste feeds a masked base64 entry to