feat: filebrowser with encfs

encfs/kms.go

@@ -0,0 +1,129 @@
+package encfs
+
+import (
+	"bytes"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+)
+
+const LOCAL_MINI_KMS_ADDRESS = "LOCAL_MINI_KMS_ADDRESS"
+const DISABLE_ENCRYPTION_MASTER_KEY = "DISABLE_ENCRYPTION_MASTER_KEY"
+const ENCRYPTED_ENCRYPTION_MASTER_KEY = "ENCRYPTED_ENCRYPTION_MASTER_KEY"
+
+type MultiViewValue struct {
+	ValueHex    string `json:"value_hex"`
+	ValueBase64 string `json:"value_base64"`
+}
+
+type EncryptRequest struct {
+	EncryptedValue string `json:"encrypted_value"`
+}
+
+var cachedcEncryptionMasterKey *EncryptionMasterKey = nil
+var cachedcEncryptionMasterKeyLock sync.Mutex
+
+func GetCachedEncryptionMasterKey() (*EncryptionMasterKey, error) {
+	cachedcEncryptionMasterKeyLock.Lock()
+	defer cachedcEncryptionMasterKeyLock.Unlock()
+	if cachedcEncryptionMasterKey == nil {
+		var err error
+		cachedcEncryptionMasterKey, err = GetEncryptionMasterKey()
+		if err != nil {
+			return nil, err
+		}
+	}
+	return cachedcEncryptionMasterKey, nil
+}
+
+func GetEncryptionMasterKey() (*EncryptionMasterKey, error) {
+	disableEncryptionMasterKey := os.Getenv(DISABLE_ENCRYPTION_MASTER_KEY)
+	if disableEncryptionMasterKey == "1" ||
+		disableEncryptionMasterKey == "on" ||
+		disableEncryptionMasterKey == "yes" ||
+		disableEncryptionMasterKey == "true" {
+		return nil, nil
+	}
+	encryptedEncryptionMasterKey := os.Getenv(ENCRYPTED_ENCRYPTION_MASTER_KEY)
+	if encryptedEncryptionMasterKey == "" {
+		fmt.Println("[ERROR] encrypted encryption master key is not present")
+		return nil, errors.New("encrypted encryption master key is not present")
+	}
+	key, err := DecryptBytes(encryptedEncryptionMasterKey)
+	if err != nil {
+		return nil, err
+	}
+	return &EncryptionMasterKey{
+		key: key,
+	}, nil
+}
+
+func DecryptBytes(encryptedValue string) ([]byte, error) {
+	localMiniKmsAddress := os.Getenv(LOCAL_MINI_KMS_ADDRESS)
+	if localMiniKmsAddress == "" {
+		localMiniKmsAddress = "127.0.0.1:5567"
+	}
+	if !strings.HasPrefix(strings.ToLower(localMiniKmsAddress), "http://") {
+		localMiniKmsAddress = fmt.Sprintf("http://%s", localMiniKmsAddress)
+	}
+	multiViewValue, err := Decrypt(localMiniKmsAddress, encryptedValue)
+	if err != nil {
+		fmt.Println("[ERROR] Decrypt from", localMiniKmsAddress, "failed, error:", err)
+		return nil, err
+	}
+	valueBytes, err := hex.DecodeString(multiViewValue.ValueHex)
+	if err != nil {
+		return nil, err
+	}
+	return valueBytes, nil
+}
+
+func Decrypt(endpoint, encryptedValue string) (*MultiViewValue, error) {
+	encryptRequest := EncryptRequest{
+		EncryptedValue: encryptedValue,
+	}
+	encryptRequestBytes, err := json.Marshal(&encryptRequest)
+	if err != nil {
+		return nil, err
+	}
+	encryptRequestReader := bytes.NewReader(encryptRequestBytes)
+	client := http.Client{
+		Timeout: 5 * time.Second,
+	}
+	encryptResponse, err := client.Post(joinEnpointPath(endpoint, "/decrypt"), "application/json", encryptRequestReader)
+	if err != nil {
+		return nil, err
+	}
+	if encryptResponse.StatusCode != 200 {
+		return nil, fmt.Errorf("decrypt failed, http status: %d", encryptResponse.StatusCode)
+	}
+	encryptResponseBodyBytes, err := io.ReadAll(encryptResponse.Body)
+	if err != nil {
+		return nil, err
+	}
+	var multiViewValue MultiViewValue
+	err = json.Unmarshal(encryptResponseBodyBytes, &multiViewValue)
+	if err != nil {
+		return nil, err
+	}
+	return &multiViewValue, nil
+}
+
+func joinEnpointPath(endpoint, path string) string {
+	endpointEndsWithSlash := strings.HasSuffix(endpoint, "/")
+	pathStartsWithSlash := strings.HasPrefix(path, "/")
+	if endpointEndsWithSlash && pathStartsWithSlash {
+		return fmt.Sprintf("%s%s", endpoint, path[1:])
+	} else if endpointEndsWithSlash || pathStartsWithSlash {
+		return fmt.Sprintf("%s%s", endpoint, path)
+	} else {
+		return fmt.Sprintf("%s/%s", endpoint, path)
+	}
+}