Bank
` + rec := e.send(t, http.MethodPut, "/settings/vault", map[string]any{"notes": dirty}, true) + if rec.Code != http.StatusOK { + t.Fatalf("put status=%d body=%s", rec.Code, rec.Body.String()) + } + out := decodeVault(t, rec.Body.Bytes()) + if out.Data.Data["notes"] != "Bank
" { + t.Fatalf("notes = %#v", out.Data.Data["notes"]) + } + if out.Data.Meta == nil || len(out.Data.Meta.Notices) != 2 || out.Data.Meta.Notices[0].Field != "notes" { + t.Fatalf("notices = %s", rec.Body.String()) + } + var stored paymentsVault + if err := e.db.First(&stored, 1).Error; err != nil { + t.Fatal(err) + } + if stored.Notes != "Bank
" { + t.Fatalf("stored notes = %q", stored.Notes) + } + + clean := "IBAN PL00 & \"swift\"
\nx
"}}, true) + if rec.Code != http.StatusUnprocessableEntity || !strings.Contains(rec.Body.String(), `"notes"`) { + t.Fatalf("non-string notes status=%d body=%s", rec.Code, rec.Body.String()) + } +} diff --git a/modules/cabana/richeditor_test.go b/modules/cabana/richeditor_test.go index a17a044..d1c5e93 100644 --- a/modules/cabana/richeditor_test.go +++ b/modules/cabana/richeditor_test.go @@ -95,11 +95,18 @@ func TestRichEditorCompile(t *testing.T) { } }) + t.Run("settings forms accept a richeditor (Phase 18 F3)", func(t *testing.T) { + fsys := fstest.MapFS{"models/settings/fields.yaml": &fstest.MapFile{Data: []byte("fields:\n enabled:\n type: switch\n extra:\n type: richeditor\n")}} + item := pact.SettingsItem{Code: "demo", Label: "Demo", Form: "models/settings/fields.yaml", Model: "DemoSettings", NewModel: func() any { return &ucSettings{} }} + if _, err := compileSetting("acme.unit", item, fsys); err != nil { + t.Fatalf("richeditor refused on a settings form: %v", err) + } + }) + t.Run("settings forms refuse the controller-only features", func(t *testing.T) { for name, field := range map[string]string{ - "richeditor": " type: richeditor\n", - "repeater": " type: repeater\n form:\n fields:\n a:\n type: text\n", - "dependsOn": " type: dropdown\n dependsOn: enabled\n", + "repeater": " type: repeater\n form:\n fields:\n a:\n type: text\n", + "dependsOn": " type: dropdown\n dependsOn: enabled\n", } { fsys := fstest.MapFS{"models/settings/fields.yaml": &fstest.MapFile{Data: []byte("fields:\n enabled:\n type: switch\n extra:\n" + field)}} item := pact.SettingsItem{Code: "demo", Label: "Demo", Form: "models/settings/fields.yaml", Model: "DemoSettings", NewModel: func() any { return &ucSettings{} }} diff --git a/modules/cabana/settings.go b/modules/cabana/settings.go index 653c55d..5fbf407 100644 --- a/modules/cabana/settings.go +++ b/modules/cabana/settings.go @@ -10,6 +10,7 @@ import ( "reflect" "strings" + "git.golem15.com/golem15/summercms/modules/compass" "git.golem15.com/golem15/summercms/modules/lagoon" "git.golem15.com/golem15/summercms/modules/pact" "git.golem15.com/golem15/summercms/modules/phrasebook" @@ -25,20 +26,29 @@ type CompiledSetting struct { Item pact.SettingsItem Form *FormSchema Writable []WritableField + // Secrets are the names of the form's write-only password fields, in + // form order (Phase 18 D-13): lagoon.Encrypted columns whose value never + // leaves the server. + Secrets []string } -// SettingsResult is the explicit missing/existing singleton response. +// SettingsResult is the explicit missing/existing singleton response. Data +// never holds a password field; Meta reports each one's state and the +// richeditor save notices, and is omitted when there is nothing to report. type SettingsResult struct { Exists bool `json:"exists"` Data map[string]any `json:"data"` + Meta *SettingsMeta `json:"meta,omitempty"` } // SettingsService reads and transactionally updates compiled singleton rows. -// Tr localizes the 422 messages of the settings Put (a money value outside -// its field's scale or max); nil keeps the phrase keys. +// Tr localizes the 422 messages and notices of the settings Put; nil keeps +// the phrase keys. Config resolves the SecretFallbacks keys of a settings +// model for the env state of its secrets; nil reports no env state. type SettingsService struct { - DB *gorm.DB - Tr *phrasebook.Translator + DB *gorm.DB + Tr *phrasebook.Translator + Config *compass.Config } // compileSettingLink registers a settings entry that opens an admin @@ -89,13 +99,13 @@ func compileSettingWithTypes(pluginID string, item pact.SettingsItem, fsys fs.FS } for _, field := range fields { // A settings screen has no admin controller to own actions or view models. - if field.Type == "widget" || field.Type == "partial" || field.Type == "fileupload" || field.Type == "password" || field.Type == permissionFieldType { + if field.Type == "widget" || field.Type == "partial" || field.Type == "fileupload" || field.Type == permissionFieldType { return nil, fmt.Errorf("cabana: setting %s field %s: type %s is not supported on a settings form", item.Code, field.Name, field.Type) } if field.Preset != nil { return nil, fmt.Errorf("cabana: setting %s field %s: preset is not supported on a settings form", item.Code, field.Name) } - if err := controllerFormOnly(field); err != nil { + if err := settingsFormOnly(field); err != nil { return nil, fmt.Errorf("cabana: setting %s field %s: %w", item.Code, field.Name, err) } } @@ -106,8 +116,12 @@ func compileSettingWithTypes(pluginID string, item pact.SettingsItem, fsys fs.FS fillable[key] = struct{}{} } writable := make([]WritableField, 0, len(fields)) + var secrets []string for _, field := range fields { - if !scalarFormField(field.Type) || protectedFillKey(field.Name) { + // A password field is a write-only secret on a settings form (D-13): + // bound like a scalar, checked against lagoon.Encrypted, never served. + secret := field.Type == passwordFieldType + if (!scalarFormField(field.Type) && !secret) || protectedFillKey(field.Name) { continue } if _, ok := columns[field.Name]; !ok { @@ -126,9 +140,15 @@ func compileSettingWithTypes(pluginID string, item pact.SettingsItem, fsys fs.FS return nil, fmt.Errorf("cabana: setting %s: %w", item.Code, err) } } + if secret { + if err := checkSecretType(model, field); err != nil { + return nil, fmt.Errorf("cabana: setting %s: %w", item.Code, err) + } + secrets = append(secrets, field.Name) + } writable = append(writable, WritableField{Name: field.Name, FillKey: field.Name}) } - return &CompiledSetting{PluginID: pluginID, Item: item, Form: form, Writable: writable}, nil + return &CompiledSetting{PluginID: pluginID, Item: item, Form: form, Writable: writable, Secrets: secrets}, nil } // Get returns default-valued data without creating a missing singleton. @@ -144,13 +164,15 @@ func (s SettingsService) Get(ctx context.Context, setting *CompiledSetting) (Set return SettingsResult{}, err } err = s.DB.WithContext(ctx).Where(clause.Eq{Column: clause.Column{Name: primaryColumn(model)}, Value: 1}).Take(model).Error - if errors.Is(err, gorm.ErrRecordNotFound) { - return SettingsResult{Exists: false, Data: projectSetting(setting, model)}, nil - } - if err != nil { + exists := err == nil + if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) { return SettingsResult{}, err } - return SettingsResult{Exists: true, Data: projectSetting(setting, model)}, nil + return SettingsResult{ + Exists: exists, + Data: withoutSecrets(setting, projectSetting(setting, model)), + Meta: settingsMeta(ctx, s.Tr, secretStates(setting, model, s.Config), nil), + }, nil } // Put validates and persists exactly one settings row. Identical replay is a @@ -165,7 +187,19 @@ func (s SettingsService) Put(ctx context.Context, setting *CompiledSetting, body if details := moneyDetails(ctx, s.Tr, setting.Form.Fields, body, nil); len(details) > 0 { return SettingsResult{}, &ValidationError{Details: details} } - var result SettingsResult + // D-13: an absent or empty secret keeps the stored value, null clears it. + if err := liftSecretValues(setting, body); err != nil { + return SettingsResult{}, err + } + // A richeditor value is a string or null; anything else is refused on + // the field instead of being dropped by the projection. + if err := checkSettingRichEditors(setting, body); err != nil { + return SettingsResult{}, err + } + var ( + result SettingsResult + notices []pluginNotice + ) err := s.DB.WithContext(ctx).Transaction(func(tx *gorm.DB) error { model, err := newSettingModel(setting) if err != nil { @@ -187,6 +221,9 @@ func (s SettingsService) Put(ctx context.Context, setting *CompiledSetting, body } before := projectSetting(setting, model) projected := projectSettingBody(setting, body) + // Every richeditor value is sanitized before Fill sees it, as on a + // controller save. + notices = sanitizeSettingRichEditors(setting, projected) allowed := make([]string, 0, len(setting.Writable)) for _, field := range setting.Writable { allowed = append(allowed, field.FillKey) @@ -217,7 +254,11 @@ func (s SettingsService) Put(ctx context.Context, setting *CompiledSetting, body return err } } - result = SettingsResult{Exists: true, Data: after} + result = SettingsResult{ + Exists: true, + Data: withoutSecrets(setting, after), + Meta: settingsMeta(ctx, s.Tr, secretStates(setting, model, s.Config), notices), + } return nil }) return result, err @@ -309,7 +350,8 @@ func requireSettingInputs(setting *CompiledSetting, body map[string]any) error { details[field.Name] = []string{"The " + field.Name + " field is invalid."} continue } - if field.Required && !present { + // An absent secret keeps its stored value, so required never applies. + if field.Required && !present && field.Type != passwordFieldType { details[field.Name] = []string{"The " + field.Name + " field is required."} } } diff --git a/modules/cabana/settings_secret.go b/modules/cabana/settings_secret.go new file mode 100644 index 0000000..b3ab665 --- /dev/null +++ b/modules/cabana/settings_secret.go @@ -0,0 +1,212 @@ +package cabana + +import ( + "context" + "fmt" + "reflect" + + "git.golem15.com/golem15/summercms/modules/compass" + "git.golem15.com/golem15/summercms/modules/lagoon" + "git.golem15.com/golem15/summercms/modules/phrasebook" + "git.golem15.com/golem15/summercms/modules/seaglass" +) + +// passwordFieldType is the write-only secret type on a settings form. +const passwordFieldType = "password" + +// SecretFallbacks is implemented by a settings model whose write-only +// password fields fall back to host configuration when the column is empty +// (Phase 18 D-13). The map is field name to compass config key; SUMMER_* +// environment variables map onto those keys as everywhere else. A field +// whose column is empty and whose key resolves to a non-empty value reports +// the env state; the value itself is never read by cabana beyond that check. +type SecretFallbacks interface { + SecretFallbacks() map[string]string +} + +// The states of a write-only settings secret in SettingsMeta.Secrets. +const ( + // SecretStored means the column holds a value. + SecretStored = "stored" + // SecretEnv means the column is empty and the model's SecretFallbacks + // config key resolves to a non-empty value. + SecretEnv = "env" + // SecretEmpty means the column is empty and no fallback applies. + SecretEmpty = "empty" +) + +// SettingsMeta is the meta of a settings result: the state of every +// write-only password field (never its value) and the save notices of the +// richeditor fields. The key is omitted when there is nothing to report. +type SettingsMeta struct { + // Secrets maps each password field to stored, env or empty. + Secrets map[string]string `json:"secrets,omitempty"` + // Notices are what the seaglass sanitizer removed from richeditor + // values on this save. + Notices []FieldNotice `json:"notices,omitempty"` +} + +var encryptedGoType = reflect.TypeOf(lagoon.Encrypted{}) + +// checkSecretType refuses a password field of a settings form whose model +// column is not a lagoon.Encrypted (or a pointer to one). +func checkSecretType(model any, field FormField) error { + sf, ok := structFieldByColumn(model, field.Name) + if !ok { + return fmt.Errorf("field %s is not a model column", field.Name) + } + t := sf.Type + if t.Kind() == reflect.Pointer { + t = t.Elem() + } + if t != encryptedGoType { + return fmt.Errorf("field %s: password on a settings form needs a lagoon.Encrypted column, found %s", field.Name, sf.Type) + } + return nil +} + +// secretStates reports the state of every password field of the setting on +// the loaded model: stored when the column holds a value, env when it is +// empty and the model's fallback key resolves in cfg, else empty. The +// result is nil when the form has no password field. +func secretStates(setting *CompiledSetting, model any, cfg *compass.Config) map[string]string { + if setting == nil || len(setting.Secrets) == 0 { + return nil + } + var fallbacks map[string]string + if provider, ok := model.(SecretFallbacks); ok && provider != nil { + fallbacks = provider.SecretFallbacks() + } + states := make(map[string]string, len(setting.Secrets)) + for _, name := range setting.Secrets { + states[name] = SecretEmpty + if secretStored(model, name) { + states[name] = SecretStored + continue + } + if key := fallbacks[name]; key != "" && cfg != nil && cfg.String(key) != "" { + states[name] = SecretEnv + } + } + return states +} + +// secretStored reports whether the model's Encrypted column holds a value. +func secretStored(model any, column string) bool { + v := reflect.ValueOf(model) + for v.Kind() == reflect.Pointer { + if v.IsNil() { + return false + } + v = v.Elem() + } + f := fieldByColumn(v, column) + if !f.IsValid() || !f.CanInterface() { + return false + } + switch e := f.Interface().(type) { + case lagoon.Encrypted: + return e.Reveal() != "" + case *lagoon.Encrypted: + return e != nil && e.Reveal() != "" + } + return false +} + +// liftSecretValues applies the write-only semantics to the settings body +// before projection (D-13): an absent key or an empty string keeps the +// stored value, so the key is dropped; JSON null clears it and stays; any +// other string replaces it; a value that is neither is a 422 on the field. +// The body is edited in place and the value is never copied anywhere else. +func liftSecretValues(setting *CompiledSetting, body map[string]any) error { + for _, name := range setting.Secrets { + value, present := body[name] + if !present { + continue + } + switch v := value.(type) { + case nil: + case string: + if v == "" { + delete(body, name) + } + default: + return &ValidationError{Details: fillTypeDetails(name)} + } + } + return nil +} + +// withoutSecrets is the settings data projection without the password +// fields: a secret never leaves the server, in a GET or a PUT answer. +func withoutSecrets(setting *CompiledSetting, data map[string]any) map[string]any { + if setting == nil || len(setting.Secrets) == 0 { + return data + } + out := make(map[string]any, len(data)) + for key, value := range data { + out[key] = value + } + for _, name := range setting.Secrets { + delete(out, name) + } + return out +} + +// checkSettingRichEditors refuses a submitted richeditor value of a settings +// form that is neither a string nor null, before anything is written. +func checkSettingRichEditors(setting *CompiledSetting, body map[string]any) error { + for _, field := range setting.Form.Fields { + if field.Type != richEditorType { + continue + } + value, present := body[field.Name] + if !present { + continue + } + switch value.(type) { + case nil, string: + default: + return &ValidationError{Details: fillTypeDetails(field.Name)} + } + } + return nil +} + +// sanitizeSettingRichEditors runs every projected richeditor value of a +// settings form through seaglass, the gate the controller save uses, and +// writes the clean value back; what the policy removed comes back as +// notices on the field. +func sanitizeSettingRichEditors(setting *CompiledSetting, projected map[string]any) []pluginNotice { + var notices []pluginNotice + for _, field := range setting.Form.Fields { + if field.Type != richEditorType { + continue + } + key := field.Name + for _, w := range setting.Writable { + if w.Name == field.Name { + key = w.FillKey + } + } + text, ok := projected[key].(string) + if !ok { + continue + } + clean, report := seaglass.SanitizeReport(text) + projected[key] = clean + for _, notice := range richEditorNotices(report) { + notices = append(notices, pluginNotice{field: field.Name, notice: notice}) + } + } + return notices +} + +// settingsMeta builds the result meta, nil when there is nothing to report. +func settingsMeta(ctx context.Context, tr *phrasebook.Translator, secrets map[string]string, notices []pluginNotice) *SettingsMeta { + localized := localizeNotices(ctx, tr, notices) + if len(secrets) == 0 && len(localized) == 0 { + return nil + } + return &SettingsMeta{Secrets: secrets, Notices: localized} +} diff --git a/modules/cabana/settings_secret_test.go b/modules/cabana/settings_secret_test.go new file mode 100644 index 0000000..a0faa4b --- /dev/null +++ b/modules/cabana/settings_secret_test.go @@ -0,0 +1,99 @@ +package cabana + +import ( + "strings" + "testing" + "testing/fstest" + + "git.golem15.com/golem15/summercms/modules/lagoon" + "git.golem15.com/golem15/summercms/modules/pact" +) + +// secretSettings is a settings model with one lagoon.Encrypted column and +// one plain string column, for the write-only password compile gate. +type secretSettings struct { + ID uint `gorm:"column:id;primaryKey"` + APIKey lagoon.Encrypted `gorm:"column:api_key;type:text"` + Token string `gorm:"column:token"` + Notes string `gorm:"column:notes"` +} + +func (secretSettings) TableName() string { return "cabana_secret_settings" } +func (secretSettings) Fillable() []string { return []string{"api_key", "token", "notes"} } +func (secretSettings) Rules() map[string]string { return map[string]string{} } + +// SecretFallbacks maps each secret field to the config key the application +// reads when the column is empty; SUMMER_* variables map onto those keys. +func (secretSettings) SecretFallbacks() map[string]string { + return map[string]string{"api_key": "acme.secret.api_key"} +} + +func secretSettingsItem(fields string) (pact.SettingsItem, fstest.MapFS) { + fsys := fstest.MapFS{"models/settings/fields.yaml": &fstest.MapFile{Data: []byte(fields)}} + item := pact.SettingsItem{Code: "secret", Label: "Secret", Form: "models/settings/fields.yaml", Model: "SecretSettings", NewModel: func() any { return &secretSettings{} }} + return item, fsys +} + +// TestSettingsSecretCompile checks the D-13 boot gate without a database: a +// password field on a settings form binds a lagoon.Encrypted column as a +// write-only secret, keeps its tab, and is refused on any other column type +// naming the field. +func TestSettingsSecretCompile(t *testing.T) { + item, fsys := secretSettingsItem("fields:\n api_key:\n label: API key\n type: password\n tab: Keys\n notes:\n type: richeditor\n") + setting, err := compileSetting("acme.unit", item, fsys) + if err != nil { + t.Fatal(err) + } + if len(setting.Secrets) != 1 || setting.Secrets[0] != "api_key" { + t.Fatalf("secrets = %v", setting.Secrets) + } + names := map[string]bool{} + for _, w := range setting.Writable { + names[w.Name] = true + } + if !names["api_key"] || !names["notes"] { + t.Fatalf("writable = %+v", setting.Writable) + } + if setting.Form.Fields[0].Tab != "Keys" { + t.Fatalf("tab dropped: %+v", setting.Form.Fields[0]) + } + data := withoutSecrets(setting, map[string]any{"api_key": lagoon.NewEncrypted("x"), "notes": "n"}) + if _, leaked := data["api_key"]; leaked || data["notes"] != "n" { + t.Fatalf("projection = %#v", data) + } + if (secretSettings{}).SecretFallbacks()["api_key"] != "acme.secret.api_key" { + t.Fatal("fallback key") + } + states := secretStates(setting, &secretSettings{}, nil) + if states["api_key"] != SecretEmpty { + t.Fatalf("states = %v", states) + } + states = secretStates(setting, &secretSettings{APIKey: lagoon.NewEncrypted("sk")}, nil) + if states["api_key"] != SecretStored { + t.Fatalf("states = %v", states) + } + + item, fsys = secretSettingsItem("fields:\n token:\n type: password\n") + _, err = compileSetting("acme.unit", item, fsys) + if err == nil || !strings.Contains(err.Error(), "field token: password on a settings form needs a lagoon.Encrypted column") { + t.Fatalf("password on a string column: %v", err) + } + + body := map[string]any{"api_key": "", "notes": "n"} + if err := liftSecretValues(setting, body); err != nil { + t.Fatal(err) + } + if _, kept := body["api_key"]; kept { + t.Fatalf("empty string did not keep the stored value: %#v", body) + } + body = map[string]any{"api_key": nil} + if err := liftSecretValues(setting, body); err != nil { + t.Fatal(err) + } + if value, present := body["api_key"]; !present || value != nil { + t.Fatalf("null did not stay as the clear: %#v", body) + } + if err := liftSecretValues(setting, map[string]any{"api_key": 5}); err == nil { + t.Fatal("a non-string secret was accepted") + } +} diff --git a/modules/cabana/testdata/payments/models/vault/fields.yaml b/modules/cabana/testdata/payments/models/vault/fields.yaml new file mode 100644 index 0000000..78d6f5c --- /dev/null +++ b/modules/cabana/testdata/payments/models/vault/fields.yaml @@ -0,0 +1,12 @@ +fields: + api_key: + label: API key + type: password + tab: Live keys + test_api_key: + label: Test API key + type: password + tab: Test keys + notes: + label: Notes + type: richeditor diff --git a/modules/phrasebook/backend/lang/en/lang.yaml b/modules/phrasebook/backend/lang/en/lang.yaml index ca0eaff..f471514 100644 --- a/modules/phrasebook/backend/lang/en/lang.yaml +++ b/modules/phrasebook/backend/lang/en/lang.yaml @@ -144,6 +144,14 @@ money: too_precise: "Use at most :scale decimal places. Amounts are never rounded." too_large: "This amount is larger than the field can store (at most :max)." currency: "Currency: :code" +secret: + stored: "A value is stored. Leave the field empty to keep it." + env: "Nothing is stored here, so the value from the server configuration is used." + empty: "Not set." + clear: "Remove stored value" + clear_pending: "The stored value will be removed when you save." + undo: "Keep stored value" + placeholder_stored: "Enter a new value to replace it" fileupload: attachment: Attachment details help: Add a title and description for this attachment. diff --git a/modules/phrasebook/backend/lang/pl/lang.yaml b/modules/phrasebook/backend/lang/pl/lang.yaml index c3136c1..84802d6 100644 --- a/modules/phrasebook/backend/lang/pl/lang.yaml +++ b/modules/phrasebook/backend/lang/pl/lang.yaml @@ -154,6 +154,14 @@ money: too_precise: "Użyj najwyżej :scale miejsc po przecinku. Kwoty nie są zaokrąglane." too_large: "Ta kwota jest większa, niż pole może zapisać (najwyżej :max)." currency: "Waluta: :code" +secret: + stored: "Wartość jest zapisana. Pozostaw pole puste, aby jej nie zmieniać." + env: "Nic tu nie zapisano, więc używana jest wartość z konfiguracji serwera." + empty: "Nie ustawiono." + clear: "Usuń zapisaną wartość" + clear_pending: "Zapisana wartość zostanie usunięta po zapisaniu." + undo: "Zachowaj zapisaną wartość" + placeholder_stored: "Wpisz nową wartość, aby ją zastąpić" fileupload: attachment: Szczegóły załącznika help: Dodaj tytuł oraz opis załącznika.