Skip to content

Commit 692567a

Browse files
coltfredcoltfred
committed
formatting
1 parent 57217fe commit 692567a

5 files changed

Lines changed: 37 additions & 49 deletions

File tree

‎src/main/java/com/ironcorelabs/tenantsecurity/kms/v1/CachedEncryptor.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,7 @@
1111
* securely zero the DEK.
1212
*
1313
* @see TenantSecurityClient#createCachedEncryptor(DocumentMetadata)
14-
* @see TenantSecurityClient#withCachedEncryptor(DocumentMetadata,
15-
* java.util.function.Function)
14+
* @see TenantSecurityClient#withCachedEncryptor(DocumentMetadata, java.util.function.Function)
1615
*/
1716
public interface CachedEncryptor extends DocumentEncryptor, CachedKeyLifecycle {
1817
}

‎src/main/java/com/ironcorelabs/tenantsecurity/kms/v1/CachedKey.java‎

Lines changed: 19 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@
2020

2121
/**
2222
* Holds a cached DEK (Document Encryption Key) for repeated encrypt and decrypt operations without
23-
* making additional TSP wrap/unwrap calls. All documents encrypted with this instance will share the
24-
* same DEK/EDEK pair. The DEK is securely zeroed when close() is called.
23+
* making additional TSP wrap/unwrap calls. All documents encrypted with this instance will share
24+
* the same DEK/EDEK pair. The DEK is securely zeroed when close() is called.
2525
*
2626
* <p>
2727
* This class is thread-safe and can be used concurrently for multiple encrypt and decrypt
@@ -48,9 +48,8 @@ public final class CachedKey implements CachedEncryptor, CachedDecryptor {
4848
// Maximum time the cached key can be used before it expires
4949
private static final Duration TIMEOUT = Duration.ofMinutes(1);
5050

51-
private static final String EDEK_MISMATCH_MESSAGE =
52-
"EDEK does not match the cached EDEK. "
53-
+ "This CachedKey can only decrypt documents with matching EDEKs.";
51+
private static final String EDEK_MISMATCH_MESSAGE = "EDEK does not match the cached EDEK. "
52+
+ "This CachedKey can only decrypt documents with matching EDEKs.";
5453

5554
// The cached DEK bytes - zeroed on close()
5655
private final byte[] dek;
@@ -186,15 +185,13 @@ public int getOperationCount() {
186185
* @param errorCode The error code to use for closed/expired failures
187186
*/
188187
private <T> CompletableFuture<T> executeAndIncrement(Supplier<CompletableFuture<T>> operation,
189-
ToIntFunction<T> countOps, AtomicInteger counter,
190-
TenantSecurityErrorCodes errorCode) {
188+
ToIntFunction<T> countOps, AtomicInteger counter, TenantSecurityErrorCodes errorCode) {
191189
if (closed.get()) {
192190
return CompletableFuture
193191
.failedFuture(new TscException(errorCode, "CachedKey has been closed"));
194192
}
195193
if (isExpired()) {
196-
return CompletableFuture
197-
.failedFuture(new TscException(errorCode, "CachedKey has expired"));
194+
return CompletableFuture.failedFuture(new TscException(errorCode, "CachedKey has expired"));
198195
}
199196
return operation.get().thenApply(result -> {
200197
counter.addAndGet(countOps.applyAsInt(result));
@@ -217,9 +214,8 @@ public CompletableFuture<EncryptedDocument> encrypt(Map<String, byte[]> document
217214
public CompletableFuture<StreamingResponse> encryptStream(InputStream input, OutputStream output,
218215
DocumentMetadata metadata) {
219216
return executeAndIncrement(
220-
() -> CompletableFuture.supplyAsync(
221-
() -> CryptoUtils.encryptStreamInternal(dek, metadata, input, output, secureRandom)
222-
.join(),
217+
() -> CompletableFuture.supplyAsync(() -> CryptoUtils
218+
.encryptStreamInternal(dek, metadata, input, output, secureRandom).join(),
223219
encryptionExecutor).thenApply(v -> new StreamingResponse(edek)),
224220
result -> 1, encryptCount, TenantSecurityErrorCodes.DOCUMENT_ENCRYPT_FAILED);
225221
}
@@ -229,9 +225,8 @@ public CompletableFuture<BatchResult<EncryptedDocument>> encryptBatch(
229225
Map<String, Map<String, byte[]>> plaintextDocuments, DocumentMetadata metadata) {
230226
return executeAndIncrement(() -> {
231227
ConcurrentMap<String, CompletableFuture<EncryptedDocument>> ops = new ConcurrentHashMap<>();
232-
plaintextDocuments.forEach((id, doc) -> ops.put(id,
233-
DocumentCryptoOps.encryptFields(doc, metadata, dek, edek, encryptionExecutor,
234-
secureRandom)));
228+
plaintextDocuments.forEach((id, doc) -> ops.put(id, DocumentCryptoOps.encryptFields(doc,
229+
metadata, dek, edek, encryptionExecutor, secureRandom)));
235230
return CompletableFuture.supplyAsync(() -> DocumentCryptoOps.cryptoOperationToBatchResult(ops,
236231
TenantSecurityErrorCodes.DOCUMENT_ENCRYPT_FAILED));
237232
}, result -> result.getSuccesses().size(), encryptCount,
@@ -243,9 +238,8 @@ public CompletableFuture<BatchResult<EncryptedDocument>> encryptBatch(
243238
private CompletableFuture<PlaintextDocument> validateEdekAndDecrypt(
244239
EncryptedDocument encryptedDocument) {
245240
if (!edek.equals(encryptedDocument.getEdek())) {
246-
return CompletableFuture.failedFuture(
247-
new TscException(TenantSecurityErrorCodes.DOCUMENT_DECRYPT_FAILED,
248-
EDEK_MISMATCH_MESSAGE));
241+
return CompletableFuture.failedFuture(new TscException(
242+
TenantSecurityErrorCodes.DOCUMENT_DECRYPT_FAILED, EDEK_MISMATCH_MESSAGE));
249243
}
250244
return DocumentCryptoOps.decryptFields(encryptedDocument.getEncryptedFields(), dek,
251245
encryptedDocument.getEdek(), encryptionExecutor);
@@ -263,13 +257,12 @@ public CompletableFuture<Void> decryptStream(String edek, InputStream input, Out
263257
DocumentMetadata metadata) {
264258
return executeAndIncrement(() -> {
265259
if (!this.edek.equals(edek)) {
266-
return CompletableFuture
267-
.<Void>failedFuture(new TscException(TenantSecurityErrorCodes.DOCUMENT_DECRYPT_FAILED,
268-
EDEK_MISMATCH_MESSAGE));
260+
return CompletableFuture.<Void>failedFuture(new TscException(
261+
TenantSecurityErrorCodes.DOCUMENT_DECRYPT_FAILED, EDEK_MISMATCH_MESSAGE));
269262
}
270-
return CompletableFuture
271-
.supplyAsync(() -> CryptoUtils.decryptStreamInternal(this.dek, input, output).join(),
272-
encryptionExecutor);
263+
return CompletableFuture.supplyAsync(
264+
() -> CryptoUtils.decryptStreamInternal(this.dek, input, output).join(),
265+
encryptionExecutor);
273266
}, result -> 1, decryptCount, TenantSecurityErrorCodes.DOCUMENT_DECRYPT_FAILED);
274267
}
275268

@@ -282,9 +275,8 @@ public CompletableFuture<BatchResult<PlaintextDocument>> decryptBatch(
282275

283276
encryptedDocuments.forEach((id, encDoc) -> {
284277
if (!edek.equals(encDoc.getEdek())) {
285-
edekMismatches.put(id,
286-
new TscException(TenantSecurityErrorCodes.DOCUMENT_DECRYPT_FAILED,
287-
EDEK_MISMATCH_MESSAGE));
278+
edekMismatches.put(id, new TscException(TenantSecurityErrorCodes.DOCUMENT_DECRYPT_FAILED,
279+
EDEK_MISMATCH_MESSAGE));
288280
} else {
289281
ops.put(id, DocumentCryptoOps.decryptFields(encDoc.getEncryptedFields(), dek,
290282
encDoc.getEdek(), encryptionExecutor));

‎src/main/java/com/ironcorelabs/tenantsecurity/kms/v1/TenantSecurityClient.java‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -408,10 +408,10 @@ public CompletableFuture<EncryptedDocument> encrypt(Map<String, byte[]> document
408408
*/
409409
public CompletableFuture<EncryptedDocument> encrypt(PlaintextDocument document,
410410
DocumentMetadata metadata) {
411-
return this.encryptionService.unwrapKey(document.getEdek(), metadata).thenComposeAsync(
412-
dek -> DocumentCryptoOps.encryptFields(document.getDecryptedFields(), metadata, dek,
413-
document.getEdek(), encryptionExecutor, secureRandom),
414-
encryptionExecutor);
411+
return this.encryptionService.unwrapKey(document.getEdek(), metadata)
412+
.thenComposeAsync(dek -> DocumentCryptoOps.encryptFields(document.getDecryptedFields(),
413+
metadata, dek, document.getEdek(), encryptionExecutor, secureRandom),
414+
encryptionExecutor);
415415
}
416416

417417
/**
@@ -482,8 +482,8 @@ public CompletableFuture<BatchResult<EncryptedDocument>> encryptExistingBatch(
482482
@Override
483483
public CompletableFuture<PlaintextDocument> decrypt(EncryptedDocument encryptedDocument,
484484
DocumentMetadata metadata) {
485-
return this.encryptionService.unwrapKey(encryptedDocument.getEdek(), metadata).thenComposeAsync(
486-
decryptedDocumentAESKey -> DocumentCryptoOps.decryptFields(
485+
return this.encryptionService.unwrapKey(encryptedDocument.getEdek(), metadata)
486+
.thenComposeAsync(decryptedDocumentAESKey -> DocumentCryptoOps.decryptFields(
487487
encryptedDocument.getEncryptedFields(), decryptedDocumentAESKey,
488488
encryptedDocument.getEdek(), encryptionExecutor));
489489
}
@@ -503,8 +503,8 @@ private CompletableFuture<CachedKey> newCachedKeyFromUnwrap(String edek,
503503
private CompletableFuture<CachedKey> newCachedKeyFromWrap(DocumentMetadata metadata) {
504504
return this.encryptionService.wrapKey(metadata).thenApply(wrappedKey -> {
505505
byte[] dekBytes = wrappedKey.getDekBytes();
506-
CachedKey cachedKey = new CachedKey(dekBytes, wrappedKey.getEdek(),
507-
this.encryptionExecutor, this.secureRandom, this.encryptionService, metadata);
506+
CachedKey cachedKey = new CachedKey(dekBytes, wrappedKey.getEdek(), this.encryptionExecutor,
507+
this.secureRandom, this.encryptionService, metadata);
508508
Arrays.fill(dekBytes, (byte) 0);
509509
return cachedKey;
510510
});
@@ -516,8 +516,7 @@ private CompletableFuture<CachedKey> newCachedKeyFromWrap(DocumentMetadata metad
516516
*/
517517
private <K extends CachedKeyLifecycle, T> CompletableFuture<T> withCachedResource(
518518
CompletableFuture<K> resource, Function<K, CompletableFuture<T>> operation) {
519-
return resource.thenCompose(
520-
k -> operation.apply(k).whenComplete((result, error) -> k.close()));
519+
return resource.thenCompose(k -> operation.apply(k).whenComplete((result, error) -> k.close()));
521520
}
522521

523522
// === Cached decryptor factory methods ===
@@ -697,8 +696,8 @@ public CompletableFuture<CachedKey> createCachedKey(EncryptedDocument encryptedD
697696
}
698697

699698
/**
700-
* Execute an operation using a CachedKey with automatic lifecycle management. Wraps a new key
701-
* and provides full encrypt + decrypt access.
699+
* Execute an operation using a CachedKey with automatic lifecycle management. Wraps a new key and
700+
* provides full encrypt + decrypt access.
702701
*
703702
* @param <T> The type returned by the operation
704703
* @param metadata Metadata for the wrap operation
@@ -711,8 +710,8 @@ public <T> CompletableFuture<T> withCachedKey(DocumentMetadata metadata,
711710
}
712711

713712
/**
714-
* Execute an operation using a CachedKey with automatic lifecycle management. Unwraps an
715-
* existing EDEK and provides full encrypt + decrypt access.
713+
* Execute an operation using a CachedKey with automatic lifecycle management. Unwraps an existing
714+
* EDEK and provides full encrypt + decrypt access.
716715
*
717716
* @param <T> The type returned by the operation
718717
* @param edek The encrypted document encryption key to unwrap

‎src/test/java/com/ironcorelabs/tenantsecurity/kms/v1/CachedKeyOpsRoundTrip.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -494,8 +494,7 @@ public void cachedDecryptorBatchEdekMismatchPartialFailure() throws Exception {
494494

495495
// mismatch should be in failures
496496
assertTrue(result.getFailures().containsKey("mismatch"));
497-
assertTrue(
498-
result.getFailures().get("mismatch").getMessage().contains("EDEK does not match"));
497+
assertTrue(result.getFailures().get("mismatch").getMessage().contains("EDEK does not match"));
499498

500499
assertEquals(decryptor.getOperationCount(), 1);
501500
}

‎src/test/java/com/ironcorelabs/tenantsecurity/kms/v1/CachedKeyTest.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -337,8 +337,7 @@ public void decryptBatchEdekMismatchGoesToFailures() {
337337
assertTrue(result.getSuccesses().containsKey("matching"));
338338
// The mismatched doc should be in failures
339339
assertTrue(result.getFailures().containsKey("mismatched"));
340-
assertTrue(
341-
result.getFailures().get("mismatched").getMessage().contains("EDEK does not match"));
340+
assertTrue(result.getFailures().get("mismatched").getMessage().contains("EDEK does not match"));
342341
// The matching doc should NOT be in failures
343342
assertFalse(result.getFailures().containsKey("matching"));
344343

@@ -349,8 +348,8 @@ public void decryptBatchEdekMismatchGoesToFailures() {
349348

350349
public void constructorCopiesDekToPreventExternalModification() throws Exception {
351350
byte[] originalDek = createValidDek();
352-
CachedKey cachedKey = new CachedKey(originalDek, TEST_EDEK, executor, secureRandom,
353-
encryptionService, metadata);
351+
CachedKey cachedKey =
352+
new CachedKey(originalDek, TEST_EDEK, executor, secureRandom, encryptionService, metadata);
354353

355354
// Modify the original array
356355
Arrays.fill(originalDek, (byte) 0x00);

0 commit comments

Comments
 (0)