-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'encryptCredentials-692' into 'main'
Adds encryption of API credentials See merge request softwares-pkp/plugins_ojs/pre-endorsement-plaudit!42
- Loading branch information
Showing
16 changed files
with
260 additions
and
40 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| <?php | ||
|
|
||
| namespace APP\plugins\generic\plauditPreEndorsement\classes\api; | ||
|
|
||
| use Firebase\JWT\JWT; | ||
| use PKP\config\Config; | ||
| use Exception; | ||
|
|
||
| class APIKeyEncryption | ||
| { | ||
| public static function secretConfigExists(): bool | ||
| { | ||
| try { | ||
| self::getSecretFromConfig(); | ||
| } catch (Exception $e) { | ||
| return false; | ||
| } | ||
| return true; | ||
| } | ||
|
|
||
| private static function getSecretFromConfig(): string | ||
| { | ||
| $secret = Config::getVar('security', 'api_key_secret'); | ||
| if ($secret === "") { | ||
| throw new Exception("A secret must be set in the config file ('api_key_secret') so that keys can be encrypted and decrypted"); | ||
| } | ||
| return $secret; | ||
| } | ||
|
|
||
| public static function encryptString(string $plainText): string | ||
| { | ||
| $secret = self::getSecretFromConfig(); | ||
| return JWT::encode($plainText, $secret, 'HS256'); | ||
| } | ||
|
|
||
| public static function decryptString(string $encryptedText) | ||
| { | ||
| $secret = self::getSecretFromConfig(); | ||
| try { | ||
| return JWT::decode($encryptedText, $secret, ['HS256']); | ||
| } catch (Exception $e) { | ||
| if ($e instanceof Firebase\JWT\SignatureInvalidException) { | ||
| throw new Exception( | ||
| 'The `api_key_secret` configuration is not the same as the one used to encrypt the key.', | ||
| 1 | ||
| ); | ||
| } | ||
|
|
||
| throw $e; | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| <?php | ||
|
|
||
| namespace APP\plugins\generic\plauditPreEndorsement\classes\migration\upgrade; | ||
|
|
||
| use Illuminate\Database\Migrations\Migration; | ||
| use Illuminate\Support\Facades\DB; | ||
| use PKP\install\DowngradeNotSupportedException; | ||
| use APP\plugins\generic\plauditPreEndorsement\classes\api\APIKeyEncryption; | ||
| use Firebase\JWT\JWT; | ||
|
|
||
| class EncryptLegacyCredentials extends Migration | ||
| { | ||
| public function up(): void | ||
| { | ||
| $credentialSettings = $this->getCredentialSettings(); | ||
|
|
||
| if (!empty($credentialSettings)) { | ||
| $credentials = $this->getCredentials($credentialSettings); | ||
|
|
||
| foreach ($credentials as $contextId => $setting) { | ||
| $orcidClientId = $setting['orcidClientId']; | ||
| $orcidClientSecret = $setting['orcidClientSecret']; | ||
| $plauditAPISecret = $setting['plauditAPISecret']; | ||
|
|
||
| try { | ||
| APIKeyEncryption::decryptString($orcidClientId); | ||
| } catch (\Exception $e) { | ||
| if ($e instanceof \UnexpectedValueException) { | ||
| $this->encryptCredentials($contextId, $orcidClientId, $orcidClientSecret, $plauditAPISecret); | ||
| } | ||
| } | ||
| } | ||
| } | ||
| } | ||
|
|
||
| public function down(): void | ||
| { | ||
| throw new DowngradeNotSupportedException(); | ||
| } | ||
|
|
||
| private function getCredentialSettings() | ||
| { | ||
| return DB::table('plugin_settings') | ||
| ->whereIn('setting_name', [ | ||
| 'orcidClientId', | ||
| 'orcidClientSecret', | ||
| 'plauditAPISecret' | ||
| ]) | ||
| ->get(); | ||
| } | ||
|
|
||
| private function getCredentials($credentialSettings) | ||
| { | ||
| $credentials = []; | ||
| foreach ($credentialSettings as $credentialSetting) { | ||
| $contextId = $credentialSetting->context_id; | ||
| $credentials[$contextId][$credentialSetting->setting_name] = $credentialSetting->setting_value; | ||
| } | ||
| return $credentials; | ||
| } | ||
|
|
||
| private function encryptCredentials($contextId, $orcidClientId, $orcidClientSecret, $plauditAPISecret) | ||
| { | ||
| $credentials = [ | ||
| 'orcidClientId' => $orcidClientId, | ||
| 'orcidClientSecret' => $orcidClientSecret, | ||
| 'plauditAPISecret' => $plauditAPISecret | ||
| ]; | ||
|
|
||
| foreach ($credentials as $settingName => $settingValue) { | ||
| $encryptedValue = APIKeyEncryption::encryptString($settingValue); | ||
|
|
||
| DB::table('plugin_settings') | ||
| ->where('context_id', $contextId) | ||
| ->where('setting_name', $settingName) | ||
| ->update(['setting_value' => $encryptedValue]); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,3 +1,7 @@ | ||
| .orcidAPIPath, .orcidClientId, .orcidClientSecret, .plauditAPISecret { | ||
| margin-top: 1rem; | ||
| } | ||
|
|
||
| #credentialsFields { | ||
| overflow: hidden; | ||
| } |
Oops, something went wrong.