store: feat encrypted filestore

Signed-off-by: Alano Terblanche <18033717+Benehiko@users.noreply.github.com>

Author: Benehiko

store/filestore/filestore.go

@@ -0,0 +1,350 @@
+package filestore
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"io"
+	"io/fs"
+	"os"
+	"strings"
+
+	"filippo.io/age"
+
+	"github.com/docker/secrets-engine/store"
+)
+
+type fileStore[T store.Secret] struct {
+	filesystem *os.Root
+	masterKey  string
+	f          store.Factory[T]
+}
+
+var _ store.Store = &fileStore[store.Secret]{}
+
+type keyStore map[string]string
+
+type file struct {
+	metadata        map[string]string
+	encryptedSecret []byte
+}
+
+// getFileNames retrieves the base64 encoded string of the secret ID and
+// metadata file
+func getFileNames(id store.ID) (string, string) {
+	secretFileName := base64.StdEncoding.EncodeToString([]byte(id.String()))
+	metadataFileName := secretFileName + "-meta.json"
+	return secretFileName, metadataFileName
+}
+
+func decryptSecret(encrypted []byte, masterKey string) ([]byte, error) {
+	identity, err := age.NewScryptIdentity(masterKey)
+	if err != nil {
+		return nil, err
+	}
+	r, err := age.Decrypt(bytes.NewReader(encrypted), identity)
+	if err != nil {
+		return nil, err
+	}
+
+	data, err := io.ReadAll(r)
+	if err != nil {
+		return nil, err
+	}
+	return data, nil
+}
+
+func getFile(ctx context.Context, filesystem *os.Root, secretFileName, metadataFileName string) (*file, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+	}
+
+	metadataStore, err := filesystem.Open(metadataFileName)
+	if err != nil {
+		return nil, err
+	}
+	defer metadataStore.Close()
+
+	fileStore, err := filesystem.Open(secretFileName)
+	if err != nil {
+		return nil, err
+	}
+	defer fileStore.Close()
+
+	var metadata map[string]string
+	b, err := io.ReadAll(metadataStore)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := json.Unmarshal(b, &metadata); err != nil {
+		return nil, err
+	}
+
+	encryptedSecret, err := io.ReadAll(fileStore)
+	if err != nil {
+		return nil, err
+	}
+
+	return &file{
+		metadata:        metadata,
+		encryptedSecret: encryptedSecret,
+	}, nil
+}
+
+func saveFile(ctx context.Context, id store.ID, f file, filesystem *os.Root) error {
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	default:
+	}
+
+	secretFileName, metadataFileName := getFileNames(id)
+	tmpSecretFileName := secretFileName + ".tmp"
+	tmpMetadataFileName := metadataFileName + ".tmp"
+
+	tmpMetadata, err := filesystem.Create(tmpMetadataFileName)
+	if err != nil {
+		return err
+	}
+	defer tmpMetadata.Close()
+
+	tmpSecret, err := filesystem.Create(tmpSecretFileName)
+	if err != nil {
+		return err
+	}
+	defer tmpSecret.Close()
+
+	enc := json.NewEncoder(tmpMetadata)
+	if err := enc.Encode(f.metadata); err != nil {
+		return err
+	}
+	if err := tmpMetadata.Sync(); err != nil {
+		return err
+	}
+	if err := tmpMetadata.Close(); err != nil {
+		return err
+	}
+
+	if _, err = tmpSecret.Write(f.encryptedSecret); err != nil {
+		return err
+	}
+	if err := tmpSecret.Sync(); err != nil {
+		return err
+	}
+	if err := tmpSecret.Close(); err != nil {
+		return err
+	}
+
+	if err := filesystem.Rename(tmpMetadataFileName, metadataFileName); err != nil {
+		return err
+	}
+	if err := filesystem.Rename(tmpSecretFileName, secretFileName); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (f *fileStore[T]) Delete(ctx context.Context, id store.ID) error {
+	secretsFileName, metadataFileName := getFileNames(id)
+	if err := f.filesystem.Remove(metadataFileName); err != nil {
+		return err
+	}
+	if err := f.filesystem.Remove(secretsFileName); err != nil {
+		return err
+	}
+	return nil
+}
+
+func (f *fileStore[T]) Filter(ctx context.Context, pattern store.Pattern) (map[store.ID]store.Secret, error) {
+	fsFiles, err := fs.ReadDir(f.filesystem.FS(), ".")
+	if err != nil {
+		return nil, err
+	}
+	if len(fsFiles) == 0 {
+		return nil, store.ErrCredentialNotFound
+	}
+
+	secrets := make(map[store.ID]store.Secret)
+	for _, fsFile := range fsFiles {
+		select {
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		default:
+		}
+
+		if fsFile.IsDir() || strings.HasSuffix(fsFile.Name(), "-meta.json") {
+			continue
+		}
+
+		s, err := base64.StdEncoding.DecodeString(fsFile.Name())
+		if err != nil {
+			return nil, err
+		}
+		id, err := store.ParseID(string(s))
+		if err != nil {
+			continue
+		}
+
+		if !pattern.Match(id) {
+			continue
+		}
+
+		secretsFileName, metadataFileName := getFileNames(id)
+
+		secretsFile, err := getFile(ctx, f.filesystem, secretsFileName, metadataFileName)
+		if err != nil {
+			return nil, err
+		}
+
+		decryptedSecret, err := decryptSecret(secretsFile.encryptedSecret, f.masterKey)
+		if err != nil {
+			return nil, err
+		}
+
+		secret := f.f()
+		if err := secret.SetMetadata(secretsFile.metadata); err != nil {
+			return nil, err
+		}
+		if err := secret.Unmarshal(decryptedSecret); err != nil {
+			return nil, err
+		}
+		secrets[id] = secret
+	}
+	if len(secrets) == 0 {
+		return nil, store.ErrCredentialNotFound
+	}
+	return secrets, nil
+}
+
+func (f *fileStore[T]) Get(ctx context.Context, id store.ID) (store.Secret, error) {
+	secretFileName, metadataFileName := getFileNames(id)
+	secretFile, err := getFile(ctx, f.filesystem, secretFileName, metadataFileName)
+	if err != nil {
+		return nil, err
+	}
+
+	decryptedSecret, err := decryptSecret(secretFile.encryptedSecret, f.masterKey)
+	if err != nil {
+		return nil, err
+	}
+
+	secret := f.f()
+	if err := secret.SetMetadata(secretFile.metadata); err != nil {
+		return nil, err
+	}
+	if err := secret.Unmarshal(decryptedSecret); err != nil {
+		return nil, err
+	}
+	return secret, nil
+}
+
+func (f *fileStore[T]) GetAllMetadata(ctx context.Context) (map[store.ID]store.Secret, error) {
+	fsFiles, err := fs.ReadDir(f.filesystem.FS(), ".")
+	if err != nil {
+		return nil, err
+	}
+	if len(fsFiles) == 0 {
+		return nil, store.ErrCredentialNotFound
+	}
+
+	secrets := make(map[store.ID]store.Secret)
+	for _, fsFile := range fsFiles {
+		if fsFile.IsDir() {
+			continue
+		}
+
+		// skip secret files, we are only interested in metadata files
+		secretsFileName, found := strings.CutSuffix(fsFile.Name(), "-meta.json")
+		if !found {
+			continue
+		}
+
+		s, err := base64.StdEncoding.DecodeString(secretsFileName)
+		if err != nil {
+			return nil, err
+		}
+
+		id, err := store.ParseID(string(s))
+		if err != nil {
+			continue
+		}
+
+		metaFile, err := f.filesystem.Open(fsFile.Name())
+		if err != nil {
+			return nil, err
+		}
+		defer metaFile.Close()
+
+		enc := json.NewDecoder(metaFile)
+		var v map[string]string
+		if err := enc.Decode(&v); err != nil {
+			return nil, err
+		}
+
+		secret := f.f()
+		if err := secret.SetMetadata(v); err != nil {
+			return nil, err
+		}
+		secrets[id] = secret
+	}
+
+	if len(secrets) == 0 {
+		return nil, store.ErrCredentialNotFound
+	}
+	return secrets, nil
+}
+
+func (f *fileStore[T]) Save(ctx context.Context, id store.ID, secret store.Secret) error {
+	var err error
+
+	val, err := secret.Marshal()
+	if err != nil {
+		return err
+	}
+	metadata := secret.Metadata()
+
+	recipient, err := age.NewScryptRecipient(f.masterKey)
+	if err != nil {
+		return err
+	}
+
+	var encryptedSecret bytes.Buffer
+	w, err := age.Encrypt(&encryptedSecret, recipient)
+	if err != nil {
+		return err
+	}
+	defer w.Close()
+
+	if _, err := w.Write(val); err != nil {
+		return err
+	}
+	if err := w.Close(); err != nil {
+		return err
+	}
+
+	return saveFile(ctx, id, file{
+		encryptedSecret: encryptedSecret.Bytes(),
+		metadata:        metadata,
+	}, f.filesystem)
+}
+
+// NewFileStore is a [store.Store] that manages encrypted files on disk.
+//
+// Each secret stored gets persistet to its own file and the name is a
+// base64 encoded string of the secret's ID. The files are stored alongside
+// one another in the same directory as specified by rootDir.
+//
+// The secret metadata is stored alongside the file unencrypted as
+// `base64(id)-meta.json`
+func NewFileStore[T store.Secret](rootDir *os.Root, masterKey string, f store.Factory[T]) (store.Store, error) {
+	return &fileStore[T]{
+		masterKey:  masterKey,
+		filesystem: rootDir,
+		f:          f,
+	}, nil
+}