Skip to content

Commit e7d9916

Browse files
kishore7snehilkishore7snehil
authored
Adding Support For BYOK with community contribution (#782)
### Contributing Changes - Adjusted link typo on codeExchange method to the right url by [GabrielBrittoDev](https://github.com/GabrielBrittoDev). ([#774](#774)) ### Changes Following endpoints have been added : - GET /api/v2/keys/encryption - POST /api/v2/keys/encryption - GET /api/v2/keys/encryption/{kid} - DELETE /api/v2/keys/encryption/{kid} - POST /api/v2/keys/encryption/{kid} - POST /api/v2/keys/encryption/{kid}/wrapping-key ### References - [/api/v2/keys/encryption](https://auth0.com/docs/api/management/v2/keys/get-encryption-keys) - [/api/v2/keys/encryption](https://auth0.com/docs/api/management/v2/keys/post-encryption) - [/api/v2/keys/encryption/{kid}](https://auth0.com/docs/api/management/v2/keys/get-encryption-key) - [DELETE /api/v2/keys/encryption/{kid}](https://auth0.com/docs/api/management/v2/keys/delete-encryption-key) - [/api/v2/keys/encryption/{kid}](https://auth0.com/docs/api/management/v2/keys/post-encryption-key) - [/api/v2/keys/encryption/{kid}/wrapping-key](https://auth0.com/docs/api/management/v2/keys/post-encryption-wrapping-key) - JIRA -> [SDK-5121](https://auth0team.atlassian.net/browse/SDK-5121) ### Testing - [x] This change adds unit test coverage - [x] This change adds integration test coverage - [x] This change has been tested on the latest version of the platform/language or why not ### Contributor Checklist - [x] I agree to adhere to the [Auth0 General Contribution Guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md). - [x] I agree to uphold the [Auth0 Code of Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md). [SDK-5121]: https://auth0team.atlassian.net/browse/SDK-5121?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ
1 parent d70324d commit e7d9916

File tree

4 files changed

+292
-2
lines changed

4 files changed

+292
-2
lines changed

‎src/API/Management/Keys.php

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
use Auth0\SDK\Contract\API\Management\KeysInterface;
88
use Auth0\SDK\Utility\Request\RequestOptions;
9+
use Auth0\SDK\Utility\Toolkit;
910
use Psr\Http\Message\ResponseInterface;
1011

1112
/**
@@ -15,6 +16,96 @@
1516
*/
1617
final class Keys extends ManagementEndpoint implements KeysInterface
1718
{
19+
public function deleteEncryptionKey(
20+
string $kId,
21+
?RequestOptions $options = null,
22+
): ResponseInterface {
23+
[$kId] = Toolkit::filter([$kId])->string()->trim();
24+
25+
Toolkit::assert([
26+
[$kId, \Auth0\SDK\Exception\ArgumentException::missing('kId')],
27+
])->isString();
28+
29+
return $this->getHttpClient()
30+
->method('delete')->addPath(['keys', 'encryption', $kId])
31+
->withOptions($options)
32+
->call();
33+
}
34+
35+
public function getEncryptionKey(
36+
string $kId,
37+
?RequestOptions $options = null,
38+
): ResponseInterface {
39+
[$kId] = Toolkit::filter([$kId])->string()->trim();
40+
41+
Toolkit::assert([
42+
[$kId, \Auth0\SDK\Exception\ArgumentException::missing('kId')],
43+
])->isString();
44+
45+
return $this->getHttpClient()
46+
->method('get')
47+
->addPath(['keys', 'encryption', $kId])
48+
->withOptions($options)
49+
->call();
50+
}
51+
52+
public function getEncryptionKeys(
53+
?array $parameters = null,
54+
?RequestOptions $options = null,
55+
): ResponseInterface {
56+
[$parameters] = Toolkit::filter([$parameters])->array()->trim();
57+
58+
/** @var array<null|int|string> $parameters */
59+
60+
return $this->getHttpClient()
61+
->method('get')
62+
->addPath(['keys', 'encryption'])
63+
->withParams($parameters)
64+
->withOptions($options)
65+
->call();
66+
}
67+
68+
public function postEncryption(
69+
array $body,
70+
?RequestOptions $options = null,
71+
): ResponseInterface {
72+
[$body] = Toolkit::filter([$body])->array()->trim();
73+
74+
Toolkit::assert([
75+
[$body, \Auth0\SDK\Exception\ArgumentException::missing('body')],
76+
])->isArray();
77+
78+
return $this->getHttpClient()
79+
->method('post')
80+
->addPath(['keys', 'encryption'])
81+
->withBody((object) $body)
82+
->withOptions($options)
83+
->call();
84+
}
85+
86+
public function postEncryptionKey(
87+
string $kId,
88+
array $body,
89+
?RequestOptions $options = null,
90+
): ResponseInterface {
91+
[$kId] = Toolkit::filter([$kId])->string()->trim();
92+
[$body] = Toolkit::filter([$body])->array()->trim();
93+
94+
Toolkit::assert([
95+
[$kId, \Auth0\SDK\Exception\ArgumentException::missing('kId')],
96+
])->isString();
97+
Toolkit::assert([
98+
[$body, \Auth0\SDK\Exception\ArgumentException::missing('body')],
99+
])->isArray();
100+
101+
return $this->getHttpClient()
102+
->method('post')
103+
->addPath(['keys', 'encryption', $kId])
104+
->withBody((object) $body)
105+
->withOptions($options)
106+
->call();
107+
}
108+
18109
public function postEncryptionRekey(
19110
?RequestOptions $options = null,
20111
): ResponseInterface {
@@ -24,4 +115,21 @@ public function postEncryptionRekey(
24115
->withOptions($options)
25116
->call();
26117
}
118+
119+
public function postEncryptionWrappingKey(
120+
string $kId,
121+
?RequestOptions $options = null,
122+
): ResponseInterface {
123+
[$kId] = Toolkit::filter([$kId])->string()->trim();
124+
125+
Toolkit::assert([
126+
[$kId, \Auth0\SDK\Exception\ArgumentException::missing('kId')],
127+
])->isString();
128+
129+
return $this->getHttpClient()
130+
->method('post')
131+
->addPath(['keys', 'encryption', $kId, 'wrapping-key'])
132+
->withOptions($options)
133+
->call();
134+
}
27135
}

‎src/Contract/API/AuthenticationInterface.php

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ public function clientCredentials(
5353
* @throws ConfigurationException when a redirect uri is not configured
5454
* @throws NetworkException when the API request fails due to a network error
5555
*
56-
* @see https://auth0.com/docs/api/authentication#authorization-code-flow45
57-
* @see https://auth0.com/docs/api/authentication#authorization-code-flow-with-pkce46
56+
* @see https://auth0.com/docs/api/authentication#authorization-code-flow
57+
* @see https://auth0.com/docs/api/authentication#authorization-code-flow-with-pkce
5858
*/
5959
public function codeExchange(
6060
string $code,

‎src/Contract/API/Management/KeysInterface.php

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,92 @@
99

1010
interface KeysInterface
1111
{
12+
/**
13+
* Delete the custom provided encryption key with the given ID and move back to using native encryption key.
14+
* Required scope: `delete:encryption_keys`.
15+
*
16+
* @param string $kId key (by it's ID) to query
17+
* @param null|RequestOptions $options Optional. Additional request options to use, such as a field filtering or pagination. (Not all endpoints support these. See @see for supported options.)
18+
*
19+
* @throws \Auth0\SDK\Exception\ArgumentException when an invalid `grantId` is provided
20+
* @throws \Auth0\SDK\Exception\NetworkException when the API request fails due to a network error
21+
*
22+
* @see https://auth0.com/docs/api/management/v2#!/keys/delete-encryption-key
23+
*/
24+
public function deleteEncryptionKey(
25+
string $kId,
26+
?RequestOptions $options = null,
27+
): ResponseInterface;
28+
29+
/**
30+
* Retrieve details of the encryption key with the given ID..
31+
* Required scopes: `read:encryption_key`.
32+
*
33+
* @param string $kId key (by it's ID) to query
34+
* @param null|RequestOptions $options Optional. Additional request options to use, such as a field filtering or pagination. (Not all endpoints support these. See @see for supported options.)
35+
*
36+
* @throws \Auth0\SDK\Exception\ArgumentException when an invalid `kId` is provided
37+
* @throws \Auth0\SDK\Exception\NetworkException when the API request fails due to a network error
38+
*
39+
* @see https://auth0.com/docs/api/management/v2#!/keys/get-encryption-key
40+
*/
41+
public function getEncryptionKey(
42+
string $kId,
43+
?RequestOptions $options = null,
44+
): ResponseInterface;
45+
46+
/**
47+
* Retrieve details of all the encryption keys associated with your tenant.
48+
* Required scope: `read:encryption_keys`.
49+
*
50+
* @param null|int[]|null[]|string[] $parameters Optional. Additional query parameters to pass with the API request. See @see for supported options.
51+
* @param null|RequestOptions $options Optional. Additional request options to use, such as a field filtering or pagination. (Not all endpoints support these. See @see for supported options.)
52+
*
53+
* @throws \Auth0\SDK\Exception\NetworkException when the API request fails due to a network error
54+
*
55+
* @see https://auth0.com/docs/api/management/v2#!/keys/get-encryption-keys
56+
*/
57+
public function getEncryptionKeys(
58+
?array $parameters = null,
59+
?RequestOptions $options = null,
60+
): ResponseInterface;
61+
62+
/**
63+
* Create the new, pre-activated encryption key, without the key material.
64+
* Required scope: `create:encryption_keys`.
65+
*
66+
* @param array<mixed> $body Additional body content to pass with the API request. See @see for supported options.
67+
* @param null|RequestOptions $options Optional. Additional request options to use, such as a field filtering or pagination. (Not all endpoints support these. See @see for supported options.)
68+
*
69+
* @throws \Auth0\SDK\Exception\ArgumentException when an invalid `body` are provided
70+
* @throws \Auth0\SDK\Exception\NetworkException when the API request fails due to a network error
71+
*
72+
* @see https://auth0.com/docs/api/management/v2#!/keys/post-encryption
73+
*/
74+
public function postEncryption(
75+
array $body,
76+
?RequestOptions $options = null,
77+
): ResponseInterface;
78+
79+
/**
80+
* Import wrapped key material and activate encryption key.
81+
* Required scope: `create:encryption_keys`.
82+
*
83+
* @param string $kId key (by it's ID) to query
84+
* @param array<mixed> $body Additional body content to pass with the API request. See @see for supported options.
85+
* @param null|RequestOptions $options Optional. Additional request options to use, such as a field filtering or pagination. (Not all endpoints support these. See @see for supported options.)
86+
*
87+
* @throws \Auth0\SDK\Exception\ArgumentException when an invalid `body` are provided
88+
* @throws \Auth0\SDK\Exception\NetworkException when the API request fails due to a network error
89+
*
90+
* @see https://auth0.com/docs/api/management/v2#!/keys/post-encryption-key
91+
*/
92+
public function postEncryptionKey(
93+
string $kId,
94+
array $body,
95+
?RequestOptions $options = null,
96+
): ResponseInterface;
97+
1298
/**
1399
* Perform rekeying operation on the key hierarchy.
14100
* Required scope: `create:encryption_keys`, `update:encryption_keys`.
@@ -22,4 +108,21 @@ interface KeysInterface
22108
public function postEncryptionRekey(
23109
?RequestOptions $options = null,
24110
): ResponseInterface;
111+
112+
/**
113+
* Create the public wrapping key to wrap your own encryption key material.
114+
* Required scope: `create:encryption_keys`.
115+
*
116+
* @param string $kId key (by it's ID) to query
117+
* @param null|RequestOptions $options Optional. Additional request options to use, such as a field filtering or pagination. (Not all endpoints support these. See @see for supported options.)
118+
*
119+
* @throws \Auth0\SDK\Exception\ArgumentException when an invalid `body` are provided
120+
* @throws \Auth0\SDK\Exception\NetworkException when the API request fails due to a network error
121+
*
122+
* @see https://auth0.com/docs/api/management/v2#!/keys/post-encryption-wrapping-key
123+
*/
124+
public function postEncryptionWrappingKey(
125+
string $kId,
126+
?RequestOptions $options = null,
127+
): ResponseInterface;
25128
}

‎tests/Unit/API/Management/KeysTest.php

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,66 @@
2424
$this->endpoint = $this->api->mock()->keys();
2525
});
2626

27+
test('getEncryptionKey() issues an appropriate request', function(): void {
28+
$keyId = uniqid();
29+
30+
$this->endpoint->getEncryptionKey($keyId);
31+
32+
expect($this->api->getRequestMethod())->toEqual('GET');
33+
expect($this->api->getRequestUrl())->toStartWith('https://' . $this->api->mock()->getConfiguration()->getDomain() . '/api/v2/keys/encryption/' . $keyId);
34+
});
35+
36+
test('getEncryptionKeys() issues an appropriate request', function(): void {
37+
$this->endpoint->getEncryptionKeys();
38+
39+
expect($this->api->getRequestMethod())->toEqual('GET');
40+
expect($this->api->getRequestUrl())->toEndWith('/api/v2/keys/encryption');
41+
expect($this->api->getRequestQuery())->toBeEmpty();
42+
});
43+
44+
test('postEncryption() issues an appropriate request', function(): void {
45+
$type = 'environment-root-key';
46+
$mock = (object) [
47+
'body' => [
48+
'type' => $type
49+
]
50+
];
51+
52+
$this->endpoint->postEncryption($mock->body);
53+
54+
expect($this->api->getRequestMethod())->toEqual('POST');
55+
expect($this->api->getRequestUrl())->toEndWith('/api/v2/keys/encryption');
56+
57+
$body = $this->api->getRequestBody();
58+
$this->assertArrayHasKey('type', $body);;
59+
expect($body['type'])->toEqual($type);
60+
61+
$body = $this->api->getRequestBodyAsString();
62+
expect($body)->toEqual(json_encode(['type' => $type]));
63+
});
64+
65+
test('postEncryptionKey() issues an appropriate request', function(): void {
66+
$keyId = uniqid();
67+
$wrappedKey = 'base64 encoded ciphertext of wrapped key';
68+
$mock = (object) [
69+
'body' => [
70+
'wrappedKey' => $wrappedKey
71+
]
72+
];
73+
74+
$this->endpoint->postEncryptionKey($keyId, $mock->body);
75+
76+
expect($this->api->getRequestMethod())->toEqual('POST');
77+
expect($this->api->getRequestUrl())->toEndWith('/api/v2/keys/encryption/' . $keyId);
78+
79+
$body = $this->api->getRequestBody();
80+
$this->assertArrayHasKey('wrappedKey', $body);;
81+
expect($body['wrappedKey'])->toEqual($wrappedKey);
82+
83+
$body = $this->api->getRequestBodyAsString();
84+
expect($body)->toEqual(json_encode(['wrappedKey' => $wrappedKey]));
85+
});
86+
2787
test('postEncryptionRekey() issues an appropriate request', function(): void {
2888

2989
$this->endpoint->postEncryptionRekey();
@@ -47,3 +107,22 @@
47107
->call();
48108
expect($response->getStatusCode())->toEqual(204);
49109
});
110+
111+
test('postEncryptionWrappingKey() issues an appropriate request', function(): void {
112+
$keyId = uniqid();
113+
114+
$this->endpoint->postEncryptionWrappingKey($keyId);
115+
116+
expect($this->api->getRequestMethod())->toEqual('POST');
117+
expect($this->api->getRequestUrl())->toEndWith('/api/v2/keys/encryption/' . $keyId . '/wrapping-key');
118+
});
119+
120+
test('deleteEncryptionKey() issues an appropriate request', function(): void {
121+
$keyId = uniqid();
122+
123+
$this->endpoint->deleteEncryptionKey($keyId);
124+
125+
expect($this->api->getRequestMethod())->toEqual('DELETE');
126+
expect($this->api->getRequestUrl())->toEndWith('/api/v2/keys/encryption/' . $keyId);
127+
});
128+

0 commit comments

Comments
 (0)