dillard
99f1655d04
CI / unit (8.2) (push) Has been cancelled
CI / unit (8.3) (push) Has been cancelled
CI / unit (8.4) (push) Has been cancelled
CI / psalm (push) Has been cancelled
CI / frontend (push) Has been cancelled
CI / integration (mariadb, 32) (push) Has been cancelled
CI / integration (mariadb, 33) (push) Has been cancelled
CI / integration (mariadb, 34) (push) Has been cancelled
CI / integration (mariadb, 35) (push) Has been cancelled
CI / integration (pgsql, 32) (push) Has been cancelled
CI / integration (pgsql, 33) (push) Has been cancelled
CI / integration (pgsql, 34) (push) Has been cancelled
CI / integration (pgsql, 35) (push) Has been cancelled
CI / integration (sqlite, 32) (push) Has been cancelled
CI / integration (sqlite, 33) (push) Has been cancelled
CI / integration (sqlite, 34) (push) Has been cancelled
CI / integration (sqlite, 35) (push) Has been cancelled
CI / integration-targets (push) Has been cancelled
CI / integration-user (32) (push) Has been cancelled
CI / integration-user (33) (push) Has been cancelled
CI / integration-user (34) (push) Has been cancelled
CI / integration-user (35) (push) Has been cancelled
CI / integration-full-restore (push) Has been cancelled
- A location that a passphrase change could not reach gets it at its next backup - A key from before 1.1.0 is never replaced as an unused one - An unreadable settings file on a location is told apart from a missing one - A schedule is shown and saved in the zone it was saved in - Saving an unchanged schedule keeps its moment; --timezone needs a schedule - Schedule coverage uses the time the backup began reading its data - Tests: catch-up scenario, upgrade test restores the new file, autumn clock change
64 lines
2.0 KiB
PHP
64 lines
2.0 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
// SPDX-FileCopyrightText: 2026 Dillard Blom
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
namespace OCA\NgBackup\Service;
|
|
|
|
/**
|
|
* Passphrase slots (like LUKS): up to three passphrases, each opening the same master key, so
|
|
* that one person leaving or dying does not lock the company out of its backups. Every change
|
|
* is written to all locations and announced to all administrators; a new recovery kit must be
|
|
* downloaded and confirmed afterwards (backups keep running meanwhile).
|
|
*/
|
|
final class KeySlotService {
|
|
public function __construct(
|
|
private KeyService $keys,
|
|
private TargetService $targets,
|
|
private AlertService $alerts,
|
|
) {
|
|
}
|
|
|
|
public function add(#[\SensitiveParameter] string $passphrase, string $label): int {
|
|
$slot = $this->keys->addSlot($passphrase, $label);
|
|
$this->apply('slot_added', $slot);
|
|
return $slot;
|
|
}
|
|
|
|
public function replace(int $slot, #[\SensitiveParameter] string $passphrase, ?string $label = null): void {
|
|
$this->keys->replaceSlot($slot, $passphrase, $label);
|
|
$this->apply('slot_replaced', $slot);
|
|
}
|
|
|
|
public function remove(int $slot): void {
|
|
$this->keys->removeSlot($slot);
|
|
$this->apply('slot_removed', $slot);
|
|
}
|
|
|
|
private function apply(string $event, int $slot): void {
|
|
$wrapped = $this->keys->wrappedKey();
|
|
$failed = [];
|
|
foreach ($this->targets->list() as $t) {
|
|
try {
|
|
$this->targets->repository($t)->updateWrappedKey($wrapped);
|
|
$this->keys->setWrappedKeyPending($t->getId(), false);
|
|
} catch (\Throwable $e) {
|
|
$failed[] = $t->getName();
|
|
$this->keys->setWrappedKeyPending($t->getId(), true);
|
|
}
|
|
}
|
|
$label = '';
|
|
foreach ($this->keys->slots() as $s) {
|
|
if ($s['slot'] === $slot) {
|
|
$label = $s['label'];
|
|
}
|
|
}
|
|
$this->alerts->securityEvent($event, ['slot' => (string)$slot, 'label' => $label]);
|
|
if ($failed !== []) {
|
|
throw new \RuntimeException('Saved, but these locations could not be updated (they still accept the previous passphrases; the change is tried again at their next backup): ' . implode(', ', $failed));
|
|
}
|
|
}
|
|
}
|