18687372255

Committed 21 Oct 2025 02:31PM UTC coverage: 57.125% (-0.004%) from 57.129%

Build # 18687372255

Build Type

push

github

Committed by

web-flow

Commit Message

Allow RSA keys to be accessed via network shares (#2245)

* update key

* tidy up

Run Details

11415 of 21459 branches covered (53.19%)

Branch coverage included in aggregate %.

1 of 3 new or added lines in 1 file covered. (33.33%)

1 existing line in 1 file now uncovered.

32411 of 55260 relevant lines covered (58.65%)

8865.25 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

58.67

/Rdmp.Core/Repositories/Managers/PasswordEncryptionKeyLocation.cs

// Copyright (c) The University of Dundee 2018-2019
// This file is part of the Research Data Management Platform (RDMP).
// RDMP is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
// RDMP is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
// You should have received a copy of the GNU General Public License along with RDMP. If not, see <https://www.gnu.org/licenses/>.

using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using Rdmp.Core.Curation;
using Rdmp.Core.MapsDirectlyToDatabaseTable.Injection;

namespace Rdmp.Core.Repositories.Managers;

/// <summary>
/// The file system location of the RSA private decryption key used to decrypt passwords stored in RDMP database.  There can only ever be one PasswordEncryptionKeyLocation
/// and this is used by all SimpleStringValueEncryption.  This means that passwords can be securely held in the RDMP database so long as suitable windows account management
/// takes place (only providing access to the key file location to users who should be able to use the passwords).
/// 
/// <para>See PasswordEncryptionKeyLocationUI for more information.</para>
/// </summary>
public class PasswordEncryptionKeyLocation : IEncryptionManager, IInjectKnown
{
    private readonly ICatalogueRepository _catalogueRepository;

    public const string RDMP_KEY_LOCATION = "RDMP_KEY_LOCATION";

    /// <summary>
    /// Prepares to retrieve/create the key file for the given platform database
    /// </summary>
    /// <param name="catalogueRepository"></param>
    public PasswordEncryptionKeyLocation(ICatalogueRepository catalogueRepository)
    {
        _catalogueRepository = catalogueRepository;

        ClearAllInjections();
    }

    public IEncryptStrings GetEncrypter() => new SimpleStringValueEncryption(OpenKeyFile());

    private Lazy<string> _knownKeyFileLocation;

    /// <summary>
    /// Gets the physical file path to the currently configured RSA private key for encrypting/decrypting passwords or null if no
    /// custom keyfile has been created yet.  The answer to this question is cached, call <see cref="ClearAllInjections"/> to reset
    /// the cache
    /// </summary>
    /// <returns></returns>
    public string GetKeyFileLocation() => _knownKeyFileLocation.Value;

    private string GetKeyFileLocationImpl()
    {
        // Prefer to get it from the environment variable
        var fromEnvVar = Environment.GetEnvironmentVariable(RDMP_KEY_LOCATION);

        return fromEnvVar ?? _catalogueRepository.GetEncryptionKeyPath();
    }


    /// <summary>
    /// Connects to the private key location and returns the encryption/decryption parameters stored in it
    /// </summary>
    /// <returns></returns>
    public string OpenKeyFile()
    {
        var location = GetKeyFileLocation();
        return location is null ? null : File.ReadAllText($@"{location}");
    }

    private static void DeserializeFromLocation(string keyLocation)
    {
        if (string.IsNullOrWhiteSpace(keyLocation))
            return;
        try
        {
            new RSACryptoServiceProvider().FromXmlString(File.ReadAllText($@"{keyLocation}"));
        }
        catch (Exception ex)
        {
            throw new Exception(
                $"Failed to open and read key file {keyLocation} (possibly it is not in a shared network location or the current user ({Environment.UserName}) does not have access to the file?)",
                ex);
        }
    }

    /// <summary>
    /// Creates a new private RSA encryption key certificate at the given location and sets the catalogue repository to use it for encrypting passwords.
    /// This will make any existing serialized passwords irretrievable unless you restore and reset the original key file location.
    /// </summary>
    /// <param name="path"></param>
    /// <returns></returns>
    public FileInfo CreateNewKeyFile(string path)
    {
        ClearAllInjections();

        var existingKey = GetKeyFileLocation();
        if (existingKey != null)
            throw new NotSupportedException($"There is already a key file at location:{existingKey}");

        var provider = new RSACryptoServiceProvider(4096);

        var fi = new FileInfo(path);

        if (fi.Directory is { Exists: false })
            fi.Directory.Create();

        using (var stream = fi.Create())
        {
            stream.Write(Encoding.UTF8.GetBytes(provider.ToXmlString(true)));
        }

        var fileInfo = new FileInfo(path);

        if (!fileInfo.Exists)
            throw new Exception("Created file but somehow it didn't exist!?!");

        _catalogueRepository.SetEncryptionKeyPath(fileInfo.FullName);

        ClearAllInjections();

        return fileInfo;
    }

    /// <summary>
    /// Changes the location of the RSA private key file to a physical location on disk (which must exist)
    /// </summary>
    /// <param name="newLocation"></param>
    public void ChangeLocation(string newLocation)
    {
        ClearAllInjections();
        
        if (!File.Exists($@"{newLocation}"))
            throw new FileNotFoundException($"Could not find key file at:{newLocation}");

        //confirms that it is accessible and deserializable
        DeserializeFromLocation(newLocation);

        _catalogueRepository.SetEncryptionKeyPath(newLocation);

        ClearAllInjections();
    }

    /// <summary>
    /// Deletes the location of the RSA private key file from the platform database (does not delete the physical
    /// file).
    /// </summary>
    public void DeleteKey()
    {
        ClearAllInjections();

        if (GetKeyFileLocation() == null)
            throw new NotSupportedException("Cannot delete key because there is no key file configured");

        _catalogueRepository.DeleteEncryptionKeyPath();

        ClearAllInjections();
    }

    public void ClearAllInjections()
    {
        _knownKeyFileLocation = new Lazy<string>(GetKeyFileLocationImpl);
    }
}

1	// Copyright (c) The University of Dundee 2018-2019
2	// This file is part of the Research Data Management Platform (RDMP).
3	// RDMP is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
4	// RDMP is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
5	// You should have received a copy of the GNU General Public License along with RDMP. If not, see <https://www.gnu.org/licenses/>.
6
7	using System;
8	using System.IO;
9	using System.Security.Cryptography;
10	using System.Text;
11	using Rdmp.Core.Curation;
12	using Rdmp.Core.MapsDirectlyToDatabaseTable.Injection;
13
14	namespace Rdmp.Core.Repositories.Managers;
15
16	/// <summary>
17	/// The file system location of the RSA private decryption key used to decrypt passwords stored in RDMP database. There can only ever be one PasswordEncryptionKeyLocation
18	/// and this is used by all SimpleStringValueEncryption. This means that passwords can be securely held in the RDMP database so long as suitable windows account management
19	/// takes place (only providing access to the key file location to users who should be able to use the passwords).
20	///
21	/// <para>See PasswordEncryptionKeyLocationUI for more information.</para>
22	/// </summary>
23	public class PasswordEncryptionKeyLocation : IEncryptionManager, IInjectKnown
24	{
25	private readonly ICatalogueRepository _catalogueRepository;
26
27	public const string RDMP_KEY_LOCATION = "RDMP_KEY_LOCATION";
28
29	/// <summary>
30	/// Prepares to retrieve/create the key file for the given platform database
31	/// </summary>
32	/// <param name="catalogueRepository"></param>
33	public PasswordEncryptionKeyLocation(ICatalogueRepository catalogueRepository)	482✔
34	{
35	_catalogueRepository = catalogueRepository;	482✔
36
37	ClearAllInjections();	482✔
38	}	482✔
39
40	public IEncryptStrings GetEncrypter() => new SimpleStringValueEncryption(OpenKeyFile());	5,030✔
41
42	private Lazy<string> _knownKeyFileLocation;
43
44	/// <summary>
45	/// Gets the physical file path to the currently configured RSA private key for encrypting/decrypting passwords or null if no
46	/// custom keyfile has been created yet. The answer to this question is cached, call <see cref="ClearAllInjections"/> to reset
47	/// the cache
48	/// </summary>
49	/// <returns></returns>
50	public string GetKeyFileLocation() => _knownKeyFileLocation.Value;	5,788✔
51
52	private string GetKeyFileLocationImpl()
53	{
54	// Prefer to get it from the environment variable
55	var fromEnvVar = Environment.GetEnvironmentVariable(RDMP_KEY_LOCATION);	986✔
56
57	return fromEnvVar ?? _catalogueRepository.GetEncryptionKeyPath();	986✔
58	}
59
60
61	/// <summary>
62	/// Connects to the private key location and returns the encryption/decryption parameters stored in it
63	/// </summary>
64	/// <returns></returns>
65	public string OpenKeyFile()
66	{
67	var location = GetKeyFileLocation();	5,031✔
68	return location is null ? null : File.ReadAllText($@"{location}");	5,031!
69	}
70
71	private static void DeserializeFromLocation(string keyLocation)
72	{
73	if (string.IsNullOrWhiteSpace(keyLocation))	×
74	return;	×
75	try
76	{
NEW 77	new RSACryptoServiceProvider().FromXmlString(File.ReadAllText($@"{keyLocation}"));	×
78	}	×
79	catch (Exception ex)	×
80	{
81	throw new Exception(	×
82	$"Failed to open and read key file {keyLocation} (possibly it is not in a shared network location or the current user ({Environment.UserName}) does not have access to the file?)",	×
83	ex);	×
84	}
85	}	×
86
87	/// <summary>
88	/// Creates a new private RSA encryption key certificate at the given location and sets the catalogue repository to use it for encrypting passwords.
89	/// This will make any existing serialized passwords irretrievable unless you restore and reset the original key file location.
90	/// </summary>
91	/// <param name="path"></param>
92	/// <returns></returns>
93	public FileInfo CreateNewKeyFile(string path)
94	{
95	ClearAllInjections();	2✔
96
97	var existingKey = GetKeyFileLocation();	2✔
98	if (existingKey != null)	2!
99	throw new NotSupportedException($"There is already a key file at location:{existingKey}");	×
100
101	var provider = new RSACryptoServiceProvider(4096);	2✔
102
103	var fi = new FileInfo(path);	2✔
104
105	if (fi.Directory is { Exists: false })	2!
106	fi.Directory.Create();	×
107
108	using (var stream = fi.Create())	2✔
109	{
110	stream.Write(Encoding.UTF8.GetBytes(provider.ToXmlString(true)));	2✔
111	}	2✔
112
113	var fileInfo = new FileInfo(path);	2✔
114
115	if (!fileInfo.Exists)	2!
116	throw new Exception("Created file but somehow it didn't exist!?!");	×
117
118	_catalogueRepository.SetEncryptionKeyPath(fileInfo.FullName);	2✔
119
120	ClearAllInjections();	2✔
121
122	return fileInfo;	2✔
123	}
124
125	/// <summary>
126	/// Changes the location of the RSA private key file to a physical location on disk (which must exist)
127	/// </summary>
128	/// <param name="newLocation"></param>
129	public void ChangeLocation(string newLocation)
130	{
131	ClearAllInjections();	×
132
NEW 133	if (!File.Exists($@"{newLocation}"))	×
UNCOV 134	throw new FileNotFoundException($"Could not find key file at:{newLocation}");	×
135
136	//confirms that it is accessible and deserializable
137	DeserializeFromLocation(newLocation);	×
138
139	_catalogueRepository.SetEncryptionKeyPath(newLocation);	×
140
141	ClearAllInjections();	×
142	}	×
143
144	/// <summary>
145	/// Deletes the location of the RSA private key file from the platform database (does not delete the physical
146	/// file).
147	/// </summary>
148	public void DeleteKey()
149	{
150	ClearAllInjections();	3✔
151
152	if (GetKeyFileLocation() == null)	3✔
153	throw new NotSupportedException("Cannot delete key because there is no key file configured");	1✔
154
155	_catalogueRepository.DeleteEncryptionKeyPath();	2✔
156
157	ClearAllInjections();	2✔
158	}	2✔
159
160	public void ClearAllInjections()
161	{
162	_knownKeyFileLocation = new Lazy<string>(GetKeyFileLocationImpl);	1,238✔
163	}	1,238✔
164	}

HicServices / RDMP / 18687372255

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous