-
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch '238-encryption-api-methods' into main
- Loading branch information
Showing
7 changed files
with
269 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| import { QlikSaaSClient } from "qlik-rest-api"; | ||
| import { IKeyProvider, KeyProvider } from "./KeyProvider"; | ||
| import { KeepRequired } from "../types/types"; | ||
|
|
||
| export interface IMigrationInformation { | ||
| /** | ||
| * Migration operation ID | ||
| */ | ||
| id: string; | ||
| /** | ||
| * Migration operation state | ||
| */ | ||
| state: "New" | "InProgress" | "Completed"; | ||
| /** | ||
| * Progress in percentage | ||
| */ | ||
| progress: number; | ||
| tenantId: string; | ||
| completedAt: string; | ||
| initiatedAt: string; | ||
| /** | ||
| * The nre key ARN that keys should be migrated to | ||
| */ | ||
| migratingTo: string; | ||
| /** | ||
| * The key ARN bing migrated from (in case of QlikVault, could be a short name only) | ||
| */ | ||
| migratingFrom: string; | ||
| /** | ||
| * The nre key prefix (to help services know which prefix should NOT be migrated) | ||
| */ | ||
| migratingToPrefix: string; | ||
| /** | ||
| * The nre ARN fingerprint | ||
| */ | ||
| migratingToFingerprint: string; | ||
| } | ||
|
|
||
| export class Encryption { | ||
| #saasClient: QlikSaaSClient; | ||
| constructor(saasClient: QlikSaaSClient) { | ||
| this.#saasClient = saasClient; | ||
| } | ||
|
|
||
| async get(arg: { id: string }) { | ||
| if (!arg.id) throw new Error(`encryption.get: "id" parameter is required`); | ||
|
|
||
| const kp: KeyProvider = new KeyProvider(this.#saasClient, arg.id); | ||
| await kp.init(); | ||
|
|
||
| return kp; | ||
| } | ||
|
|
||
| /** | ||
| * Lists keyproviders registered for the tenant | ||
| */ | ||
| async getAll() { | ||
| return await this.#saasClient | ||
| .Get<IKeyProvider[]>(`encryption/keyproviders?limit=50`) | ||
| .then((res) => res.data) | ||
| .then((data) => | ||
| data.map((t) => new KeyProvider(this.#saasClient, t.arnFingerPrint, t)) | ||
| ); | ||
| } | ||
|
|
||
| /** | ||
| * Lists keyproviders registered for the tenant [Qlik, AWS-KMS] | ||
| */ | ||
| async list() { | ||
| return await this.#saasClient | ||
| .Get<IKeyProvider[]>(`encryption/keyproviders/actions/list?limit=50`) | ||
| .then((res) => res.data) | ||
| .then((data) => | ||
| data.map((t) => new KeyProvider(this.#saasClient, t.arnFingerPrint, t)) | ||
| ); | ||
| } | ||
|
|
||
| /** | ||
| * Gets ongoing migration details | ||
| */ | ||
| async migrationDetails() { | ||
| return await this.#saasClient | ||
| .Get<IMigrationInformation[]>( | ||
| `encryption/keyproviders/migration/actions/details?limit=50` | ||
| ) | ||
| .then((res) => res.data); | ||
| } | ||
|
|
||
| /** | ||
| * Registers an AWS-KMS key for the specific tenant | ||
| */ | ||
| async create(arg: KeepRequired<IKeyProvider, "arn" | "name">) { | ||
| if (!arg.arn) | ||
| throw new Error(`encryption.create: "arn" parameter is required`); | ||
| if (!arg.name) | ||
| throw new Error(`encryption.create: "name" parameter is required`); | ||
|
|
||
| return await this.#saasClient | ||
| .Post<IKeyProvider>(`encryption/keyproviders`, arg) | ||
| .then((res) => new KeyProvider(this.#saasClient, res.data.arn, res.data)); | ||
| } | ||
|
|
||
| /** | ||
| * Resets tenant key provider to Qlik managed provider | ||
| */ | ||
| async resetToDefaultProvider() { | ||
| return await this.#saasClient | ||
| .Get<IMigrationInformation>( | ||
| `keyproviders/actions/reset-to-default-provider` | ||
| ) | ||
| .then((res) => res.data); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,131 @@ | ||
| import { QlikSaaSClient } from "qlik-rest-api"; | ||
| import { IMigrationInformation } from "./Encryption"; | ||
|
|
||
| export interface IKeyProvider { | ||
| /** | ||
| * The provider resource notation for the key | ||
| */ | ||
| arn: string; | ||
| /** | ||
| * Name of key provider entry | ||
| */ | ||
| name: string; | ||
| /** | ||
| * Indicates whether the key is being used to encrypt/decrypt secrets | ||
| */ | ||
| current: boolean; | ||
| /** | ||
| * Tenant ID | ||
| */ | ||
| tenantId: string; | ||
| /** | ||
| * When key entry was created | ||
| */ | ||
| createdAt: string; | ||
| /** | ||
| * Description of key provider entry | ||
| */ | ||
| description: string; | ||
| /** | ||
| * Key Provider type. | ||
| * | ||
| * At the moment only "AWS-KMS" (12/2023) | ||
| */ | ||
| keyProvider: string; | ||
| /** | ||
| * Indicated whether the key has multi-region configuration and has replica key in qcs secondary region | ||
| */ | ||
| multiRegion: boolean; | ||
| replicaKeys: { | ||
| /** | ||
| * Replica key keeps list of backup keys from the supported qcs secondary region | ||
| */ | ||
| arn: string; | ||
| /** | ||
| * Region indicates the backup qcs-region link to the primary region | ||
| */ | ||
| region: string; | ||
| }[]; | ||
| /** | ||
| * The ARN fingerprint | ||
| */ | ||
| arnFingerPrint: string; | ||
| /** | ||
| * When the key was promoted to being current active one | ||
| */ | ||
| promotedToCurrentAt: string; | ||
| /** | ||
| * When the ley was demoted from being current to non active | ||
| */ | ||
| demotedFromCurrentAt: string; | ||
| } | ||
|
|
||
| export class KeyProvider { | ||
| #id: string; | ||
| #saasClient: QlikSaaSClient; | ||
| details: IKeyProvider; | ||
| constructor(saasClient: QlikSaaSClient, id: string, details?: IKeyProvider) { | ||
| if (!id) throw new Error(`keyProvider.get: "id" parameter is required`); | ||
|
|
||
| this.details = details ?? ({} as IKeyProvider); | ||
| this.#id = id; | ||
| this.#saasClient = saasClient; | ||
| } | ||
|
|
||
| async init(arg?: { force: boolean }) { | ||
| if ( | ||
| !this.details || | ||
| Object.keys(this.details).length == 0 || | ||
| arg?.force == true | ||
| ) { | ||
| this.details = await this.#saasClient | ||
| .Get<IKeyProvider>(`encryption/keyproviders/${this.#id}`) | ||
| .then((res) => res.data); | ||
| } | ||
| } | ||
|
|
||
| async remove() { | ||
| return await this.#saasClient | ||
| .Delete(`encryption/keyproviders/${this.#id}`) | ||
| .then((res) => res.status); | ||
| } | ||
|
|
||
| /** | ||
| * Patches Name & Description of keyprovider information | ||
| */ | ||
| async patch(arg: { op: string; path: string; value: string }[]) { | ||
| let updateStatus = 0; | ||
|
|
||
| return await this.#saasClient | ||
| .Patch(`encryption/keyproviders/${this.#id}`, arg) | ||
| .then((res) => { | ||
| updateStatus = res.status; | ||
| return this.init({ force: true }); | ||
| }) | ||
| .then(() => updateStatus); | ||
| } | ||
|
|
||
| /** | ||
| * Migrates existing cipher keys from current key provider to requested key provider | ||
| */ | ||
| async migrate() { | ||
| return await this.#saasClient | ||
| .Post<IMigrationInformation>( | ||
| `encryption/keyproviders/${this.#id}/actions/migrate`, | ||
| {} | ||
| ) | ||
| .then((res) => res.data); | ||
| } | ||
|
|
||
| /** | ||
| * Validates AWS-KMS key access and usage | ||
| */ | ||
| async test() { | ||
| return await this.#saasClient | ||
| .Post<IKeyProvider>( | ||
| `encryption/keyproviders/${this.#id}/actions/test`, | ||
| {} | ||
| ) | ||
| .then((res) => res.data); | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters