transit: warn when key_usages is supplied on key config writes - #32073
Open
SashaMIT wants to merge 1 commit into
Open
transit: warn when key_usages is supplied on key config writes#32073SashaMIT wants to merge 1 commit into
SashaMIT wants to merge 1 commit into
Conversation
The keys/<name>/config endpoint declares key_usages as a writable field, but the write handler never reads it: usages are derived from the key type. Because the field is declared, Vault's unused-parameter warning never fires, so an operator who POSTs key_usages believing they restricted a key's operations gets a silent no-op. Emit a warning when the field is supplied, matching the existing warning pattern for forced min-version adjustments. Made-with: Cursor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
dosubot
Bot
added
the
size:XS
|
Deployment failed for project vault-ui with the following error: Learn More: https://vercel.com/docs/concepts/projects/project-configuration |
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
transit/keys/<name>/configdeclareskey_usagesas a writable field, but the write handler never reads it. Usages are derived from the key type (p.Type.KeyUsages()), which is also what the response returns.Because the field is declared in the schema, Vault's unused/ignored-parameter warning never fires when a client supplies it. An operator can POST
key_usages=["digital-signature"]to an encryption key's config, receive a successful response, and believe the key is now signature-only when nothing changed. That is a silent failure on a security-relevant setting.Fix
Emit a warning when
key_usagesis supplied on the write path, matching the existing warning pattern used for forced min-version adjustments:This keeps API compatibility (clients that send the field do not break) while surfacing the no-op.
Test plan
key_usageson config write returns the warningTestTransit_KeyUsages*,TestTransit_ConfigSettings,TestTransit_UpdateKeyConfigWithAutorotationpassMade with Cursor