feat(secrets): build G-8 KEK rotation (RewrapAll); design+plan G-7 clustered replication

G-8 (KEK rotation) — built in ZB.MOM.WW.Secrets, lib 0.1.2->0.1.3: - ISecretCipher.Rewrap(row, oldKek, newKek): re-wraps the per-secret DEK only (bodies never re-encrypted; revision/timestamps preserved -> invisible to cluster LWW). Fail-closed on wrong old-KEK id, wrong key bytes, and malformed wraps; DEK zeroed on all paths. - ISecretStore.ApplyRewrapAsync(rewrappedRow, expectedCurrentWrappedDek): updates only the 4 wrap columns + kek_id, compare-and-swap on the current wrapped DEK so a concurrent set/rotate cannot corrupt a row (closes a review-caught TOCTOU). - KekRotationService.RewrapAllAsync + RewrapReport: enumerate all rows incl. tombstones, idempotent/resumable skip-already-current, bounded CAS-retry, fail-closed on unknown/identical KEK. - `secret rewrap-all` CLI verb: key material only via env-var name / file path, JSON counts report; README section + operator runbook. Verified: full offline suite green (82 core + 15 UI, 0 regressions) + end-to-end CLI smoke + adversarial crypto review (all 7 categories PASS; TOCTOU fixed). G-7 (clustered replication) — designed + planned, no code: - Fork resolved to build Option A (shared SQL-Server ISecretStore); Akka replicator ZB.MOM.WW.Secrets.Akka is a deferred phase-2. Design doc + executable plan + .tasks.json under docs/plans/2026-07-17-secrets-g7-*. Tracking: components/secrets/GAPS.md + CLAUDE.md secrets row updated.
2026-07-17 02:55:43 -04:00
parent b009507e10
commit d82d3451e7
24 changed files with 1280 additions and 12 deletions
@@ -204,6 +204,101 @@ public sealed class SqliteSecretStoreTests : IAsyncLifetime, IDisposable
        Assert.Equal(new byte[] { 6, 6, 6 }, afterStale.Ciphertext);
    }

+    [Fact]
+    public async Task ApplyRewrap_ChangesOnlyWrapEnvelopeAndKekId_PreservingRevisionBodyAndTimestamps()
+    {
+        DateTimeOffset created = new(2026, 1, 1, 0, 0, 0, TimeSpan.Zero);
+        StoredSecret seed = MakeSecret("app/rewrap", ciphertext: [1, 2, 3], createdUtc: created);
+        await _store.UpsertAsync(seed, CancellationToken.None);
+        // Bump the revision once so we can prove ApplyRewrap does NOT change it.
+        await _store.UpsertAsync(MakeSecret("app/rewrap", ciphertext: [1, 2, 3]), CancellationToken.None);
+
+        StoredSecret before = (await _store.GetAsync(new SecretName("app/rewrap"), CancellationToken.None))!;
+        Assert.Equal(1, before.Revision);
+
+        // Re-wrap: only the four wrap-related fields differ; everything else is carried from `before`.
+        StoredSecret rewrapped = before with
+        {
+            WrappedDek = [90, 91, 92],
+            WrapNonce = [93, 94, 95],
+            WrapTag = [96, 97, 98],
+            KekId = "kek-2",
+        };
+        bool applied = await _store.ApplyRewrapAsync(rewrapped, before.WrappedDek, CancellationToken.None);
+        Assert.True(applied);
+
+        StoredSecret after = (await _store.GetAsync(new SecretName("app/rewrap"), CancellationToken.None))!;
+        // Wrap envelope + kek_id changed...
+        Assert.Equal(new byte[] { 90, 91, 92 }, after.WrappedDek);
+        Assert.Equal(new byte[] { 93, 94, 95 }, after.WrapNonce);
+        Assert.Equal(new byte[] { 96, 97, 98 }, after.WrapTag);
+        Assert.Equal("kek-2", after.KekId);
+        // ...but revision, updated timestamp, the sealed body, and audit stamps are untouched.
+        Assert.Equal(before.Revision, after.Revision);
+        Assert.Equal(before.UpdatedUtc, after.UpdatedUtc);
+        Assert.Equal(before.CreatedUtc, after.CreatedUtc);
+        Assert.Equal(before.UpdatedBy, after.UpdatedBy);
+        Assert.Equal(new byte[] { 1, 2, 3 }, after.Ciphertext);
+        Assert.Equal(before.Nonce, after.Nonce);
+        Assert.Equal(before.Tag, after.Tag);
+    }
+
+    [Fact]
+    public async Task ApplyRewrap_RewrapsTombstonedRows()
+    {
+        await _store.UpsertAsync(MakeSecret("app/dead"), CancellationToken.None);
+        await _store.DeleteAsync(new SecretName("app/dead"), "carol", CancellationToken.None);
+
+        StoredSecret tomb = (await _store.GetAsync(new SecretName("app/dead"), CancellationToken.None))!;
+        Assert.True(tomb.IsDeleted);
+
+        bool applied = await _store.ApplyRewrapAsync(
+            tomb with { WrappedDek = [1], WrapNonce = [2], WrapTag = [3], KekId = "kek-2" },
+            tomb.WrappedDek,
+            CancellationToken.None);
+
+        Assert.True(applied);
+        StoredSecret after = (await _store.GetAsync(new SecretName("app/dead"), CancellationToken.None))!;
+        Assert.Equal("kek-2", after.KekId);
+        // The tombstone survives the rewrap.
+        Assert.True(after.IsDeleted);
+        Assert.Equal(tomb.Revision, after.Revision);
+    }
+
+    [Fact]
+    public async Task ApplyRewrap_ReturnsFalse_WhenRowAbsent()
+    {
+        StoredSecret ghost = MakeSecret("never-existed") with { KekId = "kek-2" };
+        bool applied = await _store.ApplyRewrapAsync(ghost, ghost.WrappedDek, CancellationToken.None);
+        Assert.False(applied);
+    }
+
+    [Fact]
+    public async Task ApplyRewrap_ReturnsFalse_WhenCurrentWrapChanged_UnderConcurrentWrite()
+    {
+        StoredSecret original = MakeSecret("app/cas", ciphertext: [1, 2, 3]);
+        await _store.UpsertAsync(original, CancellationToken.None);
+        StoredSecret before = (await _store.GetAsync(new SecretName("app/cas"), CancellationToken.None))!;
+
+        // Simulate a concurrent set/rotate: a fresh write changes the wrapped DEK out from under us.
+        await _store.UpsertAsync(
+            MakeSecret("app/cas", ciphertext: [9, 9, 9]) with { WrappedDek = [77, 78, 79] },
+            CancellationToken.None);
+
+        // A rewrap that still expects the ORIGINAL wrap must NOT apply (0 rows) — it would otherwise
+        // pair a stale re-wrap with the newer body and corrupt the row.
+        bool applied = await _store.ApplyRewrapAsync(
+            before with { WrappedDek = [1], WrapNonce = [2], WrapTag = [3], KekId = "kek-2" },
+            before.WrappedDek,
+            CancellationToken.None);
+
+        Assert.False(applied);
+        StoredSecret after = (await _store.GetAsync(new SecretName("app/cas"), CancellationToken.None))!;
+        // The concurrent write's wrap survived untouched; no stale re-wrap was applied.
+        Assert.Equal(new byte[] { 77, 78, 79 }, after.WrappedDek);
+        Assert.Equal("kek-1", after.KekId);
+    }
+
    public void Dispose()
    {
        // Drop pooled connections so the WAL/-shm/-wal sidecars release before we delete.