Files
Joseph Doherty d82d3451e7 feat(secrets): build G-8 KEK rotation (RewrapAll); design+plan G-7 clustered replication
G-8 (KEK rotation) — built in ZB.MOM.WW.Secrets, lib 0.1.2->0.1.3:
- ISecretCipher.Rewrap(row, oldKek, newKek): re-wraps the per-secret DEK only
  (bodies never re-encrypted; revision/timestamps preserved -> invisible to
  cluster LWW). Fail-closed on wrong old-KEK id, wrong key bytes, and malformed
  wraps; DEK zeroed on all paths.
- ISecretStore.ApplyRewrapAsync(rewrappedRow, expectedCurrentWrappedDek):
  updates only the 4 wrap columns + kek_id, compare-and-swap on the current
  wrapped DEK so a concurrent set/rotate cannot corrupt a row (closes a
  review-caught TOCTOU).
- KekRotationService.RewrapAllAsync + RewrapReport: enumerate all rows incl.
  tombstones, idempotent/resumable skip-already-current, bounded CAS-retry,
  fail-closed on unknown/identical KEK.
- `secret rewrap-all` CLI verb: key material only via env-var name / file path,
  JSON counts report; README section + operator runbook.

Verified: full offline suite green (82 core + 15 UI, 0 regressions) + end-to-end
CLI smoke + adversarial crypto review (all 7 categories PASS; TOCTOU fixed).

G-7 (clustered replication) — designed + planned, no code:
- Fork resolved to build Option A (shared SQL-Server ISecretStore); Akka
  replicator ZB.MOM.WW.Secrets.Akka is a deferred phase-2. Design doc +
  executable plan + .tasks.json under docs/plans/2026-07-17-secrets-g7-*.

Tracking: components/secrets/GAPS.md + CLAUDE.md secrets row updated.
2026-07-17 02:55:43 -04:00

97 lines
3.6 KiB
C#

using System.Collections.Concurrent;
using ZB.MOM.WW.Secrets.Abstractions;
namespace ZB.MOM.WW.Secrets.Ui.Tests.Fakes;
/// <summary>
/// A hand-written <see cref="ISecretStore"/> test double (the family does not use Moq) that keeps
/// an in-memory table of rows and records every <see cref="UpsertAsync"/> and
/// <see cref="DeleteAsync"/> call so a test can assert on the mutation trail.
/// </summary>
public sealed class RecordingSecretStore : ISecretStore
{
private readonly ConcurrentDictionary<string, StoredSecret> _rows = new();
private readonly ConcurrentQueue<StoredSecret> _upserts = new();
private readonly ConcurrentQueue<(SecretName Name, string? Actor)> _deletes = new();
/// <summary>Rows upserted, in call order.</summary>
public IReadOnlyList<StoredSecret> Upserts => _upserts.ToArray();
/// <summary>Delete calls (name + recorded actor), in call order.</summary>
public IReadOnlyList<(SecretName Name, string? Actor)> Deletes => _deletes.ToArray();
/// <summary>When set, <see cref="UpsertAsync"/> throws this to drive the mutation-failure path.</summary>
public Exception? UpsertFault { get; set; }
/// <summary>When set, <see cref="DeleteAsync"/> throws this to drive the mutation-failure path.</summary>
public Exception? DeleteFault { get; set; }
/// <summary>Seeds a row so <see cref="GetAsync"/> and <see cref="ListAsync"/> can return it.</summary>
/// <param name="row">The row to seed.</param>
public void Seed(StoredSecret row) => _rows[row.Name.Value] = row;
/// <inheritdoc />
public Task<StoredSecret?> GetAsync(SecretName name, CancellationToken ct)
=> Task.FromResult(_rows.TryGetValue(name.Value, out StoredSecret? row) ? row : null);
/// <inheritdoc />
public Task UpsertAsync(StoredSecret row, CancellationToken ct)
{
if (UpsertFault is not null)
{
throw UpsertFault;
}
_rows[row.Name.Value] = row;
_upserts.Enqueue(row);
return Task.CompletedTask;
}
/// <inheritdoc />
public Task<bool> DeleteAsync(SecretName name, string? actor, CancellationToken ct)
{
if (DeleteFault is not null)
{
throw DeleteFault;
}
_deletes.Enqueue((name, actor));
return Task.FromResult(_rows.TryRemove(name.Value, out _));
}
/// <inheritdoc />
public Task<IReadOnlyList<SecretMetadata>> ListAsync(bool includeDeleted, CancellationToken ct)
{
IReadOnlyList<SecretMetadata> projection = _rows.Values
.Where(r => includeDeleted || !r.IsDeleted)
.Select(r => new SecretMetadata
{
Name = r.Name,
Description = r.Description,
ContentType = r.ContentType,
KekId = r.KekId,
Revision = r.Revision,
IsDeleted = r.IsDeleted,
CreatedUtc = r.CreatedUtc,
UpdatedUtc = r.UpdatedUtc,
CreatedBy = r.CreatedBy,
UpdatedBy = r.UpdatedBy,
})
.ToArray();
return Task.FromResult(projection);
}
/// <inheritdoc />
public Task<IReadOnlyList<SecretManifestEntry>> GetManifestAsync(CancellationToken ct)
=> throw new NotSupportedException();
/// <inheritdoc />
public Task ApplyReplicatedAsync(StoredSecret row, CancellationToken ct)
=> throw new NotSupportedException();
/// <inheritdoc />
public Task<bool> ApplyRewrapAsync(
StoredSecret rewrappedRow, byte[] expectedCurrentWrappedDek, CancellationToken ct)
=> throw new NotSupportedException();
}