extern/zrok
1
1
Fork 0
mirror of https://github.com/openziti/zrok.git synced 2025-06-26 12:42:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

no soft delete for secrets; clean up secrets when share is removed (#983)

Browse Source
This commit is contained in:
Michael Quigley 2025-06-23 14:39:17 -04:00
parent d0cbd0b98d
commit 8c17480abd
No known key found for this signature in database
GPG Key ID: 9B60314A9DD20A62
4 changed files with 23 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
controller/store/secret.go
View File

@ -32,7 +32,7 @@ func (str *Store) CreateSecrets(secrets Secrets, trx *sqlx.Tx) error {
func (str *Store) GetSecrets(shareId int, trx *sqlx.Tx) (Secrets, error) {
secrets := Secrets{}
rows, err := trx.Queryx("select key, value from secrets where share_id = $1 and not deleted", shareId)
rows, err := trx.Queryx("select key, value from secrets where share_id = $1", shareId)
if err != nil {
return Secrets{}, errors.Wrap(err, "error getting all from secrets")
}
@ -45,3 +45,10 @@ func (str *Store) GetSecrets(shareId int, trx *sqlx.Tx) (Secrets, error) {
}
return secrets, nil
}
func (str *Store) DeleteSecrets(shareId int, trx *sqlx.Tx) error {
if _, err := trx.Exec("delete from secrets where share_id = $1", shareId); err != nil {
return errors.Wrapf(err, "error deleting secrets for share_id = '%v'", shareId)
}
return nil
}

3
controller/store/sql/postgresql/034_v1_0_7_secrets.sql
View File

@ -8,8 +8,7 @@ create table secrets (
value text not null,
created_at timestamptz not null default(current_timestamp),
updated_at timestamptz not null default(current_timestamp),
deleted boolean not null default(false)
updated_at timestamptz not null default(current_timestamp)
);
create index secrets_share_id_idx on secrets(share_id);

3
controller/store/sql/sqlite3/034_v1_0_7_secrets.sql
View File

@ -8,8 +8,7 @@ create table secrets (
value text not null,
created_at datetime not null default(strftime('%Y-%m-%d %H:%M:%f', 'now')),
updated_at datetime not null default(strftime('%Y-%m-%d %H:%M:%f', 'now')),
deleted boolean not null default(false)
updated_at datetime not null default(strftime('%Y-%m-%d %H:%M:%f', 'now'))
);
create index secrets_share_id_idx on secrets(share_id);

21
controller/unshare.go
View File

@ -3,6 +3,8 @@ package controller
import (
"context"
"fmt"
"time"
"github.com/go-openapi/runtime/middleware"
"github.com/openziti/edge-api/rest_management_api_client"
edge_service "github.com/openziti/edge-api/rest_management_api_client/service"
@ -12,7 +14,6 @@ import (
"github.com/openziti/zrok/rest_server_zrok/operations/share"
"github.com/pkg/errors"
"github.com/sirupsen/logrus"
"time"
)
type unshareHandler struct{}
@ -22,12 +23,12 @@ func newUnshareHandler() *unshareHandler {
}
func (h *unshareHandler) Handle(params share.UnshareParams, principal *rest_model_zrok.Principal) middleware.Responder {
tx, err := str.Begin()
trx, err := str.Begin()
if err != nil {
logrus.Errorf("error starting transaction for '%v': %v", principal.Email, err)
return share.NewUnshareInternalServerError()
}
defer func() { _ = tx.Rollback() }()
defer func() { _ = trx.Rollback() }()
edge, err := zrokEdgeSdk.Client(cfg.Ziti)
if err != nil {
@ -41,7 +42,7 @@ func (h *unshareHandler) Handle(params share.UnshareParams, principal *rest_mode
return share.NewUnshareNotFound()
}
var senv *store.Environment
if envs, err := str.FindEnvironmentsForAccount(int(principal.ID), tx); err == nil {
if envs, err := str.FindEnvironmentsForAccount(int(principal.ID), trx); err == nil {
for _, env := range envs {
if env.ZId == params.Body.EnvZID {
senv = env
@ -58,7 +59,7 @@ func (h *unshareHandler) Handle(params share.UnshareParams, principal *rest_mode
}
var sshr *store.Share
if shrs, err := str.FindSharesForEnvironment(senv.Id, tx); err == nil {
if shrs, err := str.FindSharesForEnvironment(senv.Id, trx); err == nil {
for _, shr := range shrs {
if shr.ZId == shrZId {
sshr = shr
@ -79,15 +80,19 @@ func (h *unshareHandler) Handle(params share.UnshareParams, principal *rest_mode
h.deallocateResources(senv, shrToken, shrZId, edge)
logrus.Debugf("deallocated share '%v'", shrToken)
if err := str.DeleteAccessGrantsForShare(sshr.Id, tx); err != nil {
if err := str.DeleteSecrets(sshr.Id, trx); err != nil {
logrus.Errorf("error deleting secrets for share '%v': %v", shrToken, err)
return share.NewUnshareInternalServerError()
}
if err := str.DeleteAccessGrantsForShare(sshr.Id, trx); err != nil {
logrus.Errorf("error deleting access grants for share '%v': %v", shrToken, err)
return share.NewUnshareInternalServerError()
}
if err := str.DeleteShare(sshr.Id, tx); err != nil {
if err := str.DeleteShare(sshr.Id, trx); err != nil {
logrus.Errorf("error deleting share '%v': %v", shrToken, err)
return share.NewUnshareInternalServerError()
}
if err := tx.Commit(); err != nil {
if err := trx.Commit(); err != nil {
logrus.Errorf("error committing transaction for '%v': %v", shrZId, err)
return share.NewUnshareInternalServerError()
}