mirror of
https://github.com/versity/versitygw.git
synced 2026-08-17 20:56:21 +00:00
niksis02
a884d52af4
Add `CreateAccessKey`, `UpdateAccessKey`, `DeleteAccessKey`, `ListAccessKeys`, and `GetAccessKeyLastUsed` actions for managing user access keys and retrieving their latest usage details. Generate AWS-style access key IDs and secrets, validate key identifiers and statuses, enforce per-user key quotas, and prevent deleting users that still own access keys. Persist access keys across internal and Vault storage backends with ownership indexing, pagination, and IAM-compatible errors and XML responses.
89 lines
2.8 KiB
Go
89 lines
2.8 KiB
Go
// Copyright 2026 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package iamutil
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"regexp"
|
|
|
|
"github.com/versity/versitygw/debuglogger"
|
|
"github.com/versity/versitygw/iamapi/iamerr"
|
|
)
|
|
|
|
const (
|
|
AccessKeyStatusActive = "Active"
|
|
AccessKeyStatusInactive = "Inactive"
|
|
|
|
accessKeyIDPrefix = "AKIA"
|
|
accessKeyIDRandomLen = 17
|
|
minAccessKeyIDLen = 16
|
|
maxAccessKeyIDLen = 128
|
|
secretAccessKeyBytes = 30
|
|
)
|
|
|
|
var accessKeyIDPattern = regexp.MustCompile(`^[\w]+$`)
|
|
|
|
// GenerateAccessKeyID returns a new cryptographically random IAM access key
|
|
// id in the AKIA… format.
|
|
func GenerateAccessKeyID() (string, error) {
|
|
id, err := generateAWSID(accessKeyIDPrefix, accessKeyIDRandomLen)
|
|
if err != nil {
|
|
debuglogger.Logf("failed to generate IAM access key id: %v", err)
|
|
return "", err
|
|
}
|
|
return id, nil
|
|
}
|
|
|
|
// GenerateSecretAccessKey returns a new cryptographically random 40 character
|
|
// secret access key.
|
|
func GenerateSecretAccessKey() (string, error) {
|
|
b := make([]byte, secretAccessKeyBytes)
|
|
if _, err := rand.Read(b); err != nil {
|
|
debuglogger.Logf("failed to generate IAM secret access key: %v", err)
|
|
return "", err
|
|
}
|
|
return base64.StdEncoding.EncodeToString(b), nil
|
|
}
|
|
|
|
// ValidateAccessKeyID checks that accessKeyID fits within the allowed length
|
|
// range and character set.
|
|
func ValidateAccessKeyID(accessKeyID string) error {
|
|
if len(accessKeyID) < minAccessKeyIDLen {
|
|
debuglogger.Logf("IAM access key id too short: value=%q", accessKeyID)
|
|
return iamerr.AccessKeyIDTooShort(minAccessKeyIDLen)
|
|
}
|
|
if len(accessKeyID) > maxAccessKeyIDLen {
|
|
debuglogger.Logf("IAM access key id too long: value=%q", accessKeyID)
|
|
return iamerr.AccessKeyIDTooLong(maxAccessKeyIDLen)
|
|
}
|
|
if !accessKeyIDPattern.MatchString(accessKeyID) {
|
|
debuglogger.Logf("invalid IAM access key id characters: value=%q", accessKeyID)
|
|
return iamerr.GetAPIError(iamerr.ErrInvalidAccessKeyIDChars)
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// ValidateAccessKeyStatus checks that status is either Active or Inactive.
|
|
func ValidateAccessKeyStatus(status string) error {
|
|
if status != AccessKeyStatusActive && status != AccessKeyStatusInactive {
|
|
debuglogger.Logf("invalid IAM access key status: %q", status)
|
|
return iamerr.InvalidAccessKeyStatus(status)
|
|
}
|
|
|
|
return nil
|
|
}
|