Package io.quarkus.vault.runtime

Class VaultTransitManager

java.lang.Object

io.quarkus.vault.runtime.VaultTransitManager

All Implemented Interfaces:

VaultTransitSecretReactiveEngine

@ApplicationScoped
public class VaultTransitManager
extends Object
implements VaultTransitSecretReactiveEngine

Constructor Summary

Constructors

Constructor	Description
VaultTransitManager()

Method Summary

Modifier and Type	Method	Description
io.smallrye.mutiny.Uni<Void>	createKey(String keyName, KeyCreationRequestDetail detail)	Create a new Transit key.
io.smallrye.mutiny.Uni<ClearData>	decrypt(String keyName, String ciphertext)	Decrypt the encrypted data with the specified key, and return unencrypted data.
io.smallrye.mutiny.Uni<ClearData>	decrypt(String keyName, String ciphertext, TransitContext transitContext)	Decrypt the encrypted data with the specified key and a transit context used for key derivation.
io.smallrye.mutiny.Uni<Map<DecryptionRequest,ClearData>>	decrypt(String keyName, List<DecryptionRequest> requests)	Decrypt a list of encrypted data items.
io.smallrye.mutiny.Uni<Void>	deleteKey(String keyName)	Delete a Transit key.
io.smallrye.mutiny.Uni<String>	encrypt(String keyName, ClearData clearData, TransitContext transitContext)	Encrypt a regular string with a Vault key configured in the transit secret engine.
io.smallrye.mutiny.Uni<String>	encrypt(String keyName, String clearData)	Encrypt a regular string with a Vault key configured in the transit secret engine.
io.smallrye.mutiny.Uni<Map<EncryptionRequest,String>>	encrypt(String keyName, List<EncryptionRequest> requests)	Encrypt a list of elements.
io.smallrye.mutiny.Uni<VaultTransitKeyExportDetail>	exportKey(String keyName, VaultTransitExportKeyType keyType, String keyVersion)	Export a Transit Key.
io.smallrye.mutiny.Uni<List<String>>	listKeys()	List all Transit keys.
protected VaultTransitKeyDetail<?>	map(VaultTransitReadKeyData data)
io.smallrye.mutiny.Uni<Optional<VaultTransitKeyDetail<?>>>	readKey(String keyName)	Read the configuration of a Transit key.
io.smallrye.mutiny.Uni<String>	rewrap(String keyName, String ciphertext)	Reencrypt into a new cipher text a cipher text that was obtained from encryption using an old key version with the last key version
io.smallrye.mutiny.Uni<String>	rewrap(String keyName, String ciphertext, TransitContext transitContext)	Reencrypt into a new cipher text a cipher text that was obtained from encryption using an old key version with the last key version and an optional transit context used for key derivation
io.smallrye.mutiny.Uni<Map<RewrappingRequest,String>>	rewrap(String keyName, List<RewrappingRequest> requests)	Reencrypt a list of encrypted data items with the last version of the specified key.
io.smallrye.mutiny.Uni<String>	sign(String keyName, SigningInput input, SignVerifyOptions options, TransitContext transitContext)	Sign the input with the specified key and an optional explicit sign/verify options and an optional transit context used for key derivation, if applicable.
io.smallrye.mutiny.Uni<String>	sign(String keyName, SigningInput input, TransitContext transitContext)	Sign the input with the specified key and an optional transit context used for key derivation, if applicable.
io.smallrye.mutiny.Uni<String>	sign(String keyName, String input)	Sign an input string with the specified key.
io.smallrye.mutiny.Uni<Map<SigningRequest,String>>	sign(String keyName, List<SigningRequest> requests)	Sign a list of inputs items.
io.smallrye.mutiny.Uni<Map<SigningRequest,String>>	sign(String keyName, List<SigningRequest> requests, SignVerifyOptions options)	Sign a list of inputs items and an optional explicit sign/verify options.
io.smallrye.mutiny.Uni<Void>	updateKeyConfiguration(String keyName, KeyConfigRequestDetail detail)	Update the configuration of a Transit key.
io.smallrye.mutiny.Uni<Void>	verifySignature(String keyName, String signature, SigningInput input, SignVerifyOptions options, TransitContext transitContext)	Checks that the signature was obtained from signing the input with the specified key an an optional explicit sign/verify options.
io.smallrye.mutiny.Uni<Void>	verifySignature(String keyName, String signature, SigningInput input, TransitContext transitContext)	Checks that the signature was obtained from signing the input with the specified key.
io.smallrye.mutiny.Uni<Void>	verifySignature(String keyName, String signature, String input)	Checks that the signature was obtained from signing the input with the specified key.
io.smallrye.mutiny.Uni<Void>	verifySignature(String keyName, List<VerificationRequest> requests)	Checks a list of verification requests.
io.smallrye.mutiny.Uni<Void>	verifySignature(String keyName, List<VerificationRequest> requests, SignVerifyOptions options)	Checks a list of verification requests.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

VaultTransitManager

public VaultTransitManager()

Method Detail

encrypt

public io.smallrye.mutiny.Uni<String> encrypt(String keyName,
                                              String clearData)

Description copied from interface: VaultTransitSecretReactiveEngine

Encrypt a regular string with a Vault key configured in the transit secret engine. Equivalent to: encrypt(keyName, ClearData.from(clearData), null);

This method is usually used in conjunction with VaultTransitSecretReactiveEngine.decrypt(String, String)

Specified by:

encrypt in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key to encrypt the data with

clearData - the string to encrypt

Returns:

cipher text

See Also:

encrypt data

encrypt

public io.smallrye.mutiny.Uni<String> encrypt(String keyName,
                                              ClearData clearData,
                                              TransitContext transitContext)

Description copied from interface: VaultTransitSecretReactiveEngine

Encrypt a regular string with a Vault key configured in the transit secret engine. If the key does not exist, and the policy specifies a create capability the key will be lazily created (i.e. upsert). The key can be further customized by specifying transit encryption-key configuration properties.

Specified by:

encrypt in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key to encrypt the data with

clearData - the data to encrypt

transitContext - optional transit context used for key derivation

Returns:

cipher text

See Also:

encrypt data

encrypt

public io.smallrye.mutiny.Uni<Map<EncryptionRequest,String>> encrypt(String keyName,
                                                                           List<EncryptionRequest> requests)

Description copied from interface: VaultTransitSecretReactiveEngine

Encrypt a list of elements. This will return a list of cipher texts. Each element shall specify the data to encrypt, an optional key version and an optional transit context, used for key derivation if applicable. If any error occurs, the service will throw a VaultEncryptionBatchException

Specified by:

encrypt in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key to encrypt the data with

requests - the list of elements to encrypt

Returns:

a map of each request and its corresponding cipher text

See Also:

encrypt data

decrypt

public io.smallrye.mutiny.Uni<ClearData> decrypt(String keyName,
                                                 String ciphertext)

Description copied from interface: VaultTransitSecretReactiveEngine

Decrypt the encrypted data with the specified key, and return unencrypted data.

Specified by:

decrypt in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key that was used to encrypt the original data

ciphertext - the encrypted data

Returns:

the unencrypted data

See Also:

decrypt data

decrypt

public io.smallrye.mutiny.Uni<ClearData> decrypt(String keyName,
                                                 String ciphertext,
                                                 TransitContext transitContext)

Description copied from interface: VaultTransitSecretReactiveEngine

Decrypt the encrypted data with the specified key and a transit context used for key derivation.

Specified by:

decrypt in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key that was used to encrypt the original data

ciphertext - data to decrypt

transitContext - optional transit context used for key derivation

Returns:

the unencrypted data

See Also:

decrypt data, create key derived attribute

decrypt

public io.smallrye.mutiny.Uni<Map<DecryptionRequest,ClearData>> decrypt(String keyName,
                                                                              List<DecryptionRequest> requests)

Description copied from interface: VaultTransitSecretReactiveEngine

Decrypt a list of encrypted data items. Each item shall specify the encrypted data plus an optional transit context used for key derivation (if applicable). If any error occurs, the service will throw a VaultDecryptionBatchException

Specified by:

decrypt in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key that was used to encrypt the original data

requests - the list of encrypted data items

Returns:

a map of each request with its corresponding decrypted data item

See Also:

decrypt data

rewrap

public io.smallrye.mutiny.Uni<String> rewrap(String keyName,
                                             String ciphertext)

Description copied from interface: VaultTransitSecretReactiveEngine

Reencrypt into a new cipher text a cipher text that was obtained from encryption using an old key version with the last key version

Specified by:

rewrap in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the encryption key that was used for the previous encryption

ciphertext - the old cipher text that needs rewrapping

Returns:

the reencrypted cipher text with last key version as a new cipher text

See Also:

rewrap data, working set management

rewrap

public io.smallrye.mutiny.Uni<String> rewrap(String keyName,
                                             String ciphertext,
                                             TransitContext transitContext)

Description copied from interface: VaultTransitSecretReactiveEngine

Reencrypt into a new cipher text a cipher text that was obtained from encryption using an old key version with the last key version and an optional transit context used for key derivation

Specified by:

rewrap in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the encryption key that was used for the previous encryption

ciphertext - the old cipher text that needs rewrapping

transitContext - optional transit context used for key derivation

Returns:

the reencrypted cipher text with last key version as a new cipher text

See Also:

rewrap data, working set management

rewrap

public io.smallrye.mutiny.Uni<Map<RewrappingRequest,String>> rewrap(String keyName,
                                                                          List<RewrappingRequest> requests)

Description copied from interface: VaultTransitSecretReactiveEngine

Reencrypt a list of encrypted data items with the last version of the specified key. Each item shall specify a cipher text to reencrypt, an optional key version, and an optional transit context used for key derivation, if applicable. If any error occurs, the service will throw a VaultRewrappingBatchException

Specified by:

rewrap in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the encryption key that was used for the previous encryptions

requests - the list of items to reencrypt

Returns:

a map of each request with its corresponding reencrypted data item

See Also:

rewrap data, working set management

sign

public io.smallrye.mutiny.Uni<String> sign(String keyName,
                                           String input)

Description copied from interface: VaultTransitSecretReactiveEngine

Sign an input string with the specified key.

Specified by:

sign in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the signing key to use

input - String to sign

Returns:

the signature

See Also:

sign data

sign

public io.smallrye.mutiny.Uni<String> sign(String keyName,
                                           SigningInput input,
                                           TransitContext transitContext)

Description copied from interface: VaultTransitSecretReactiveEngine

Sign the input with the specified key and an optional transit context used for key derivation, if applicable.

Specified by:

sign in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the signing key to use

input - data to sign

transitContext - optional transit context used for key derivation

Returns:

the signature

See Also:

sign data

sign

public io.smallrye.mutiny.Uni<String> sign(String keyName,
                                           SigningInput input,
                                           SignVerifyOptions options,
                                           TransitContext transitContext)

Description copied from interface: VaultTransitSecretReactiveEngine

Sign the input with the specified key and an optional explicit sign/verify options and an optional transit context used for key derivation, if applicable.

Specified by:

sign in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the signing key to use

input - data to sign

options - optional explicit sign/verify options

transitContext - optional transit context used for key derivation

Returns:

the signature

See Also:

sign data

sign

public io.smallrye.mutiny.Uni<Map<SigningRequest,String>> sign(String keyName,
                                                                     List<SigningRequest> requests)

Description copied from interface: VaultTransitSecretReactiveEngine

Sign a list of inputs items. Each item shall specify the input to sign, an optional key version, and an optional transit context used for key derivation, if applicable. If any error occurs, the service will throw a VaultSigningBatchException

Specified by:

sign in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the signing key to use

requests - the list of inputs to sign

Returns:

a map of each request with its corresponding signature item

See Also:

sign data

sign

public io.smallrye.mutiny.Uni<Map<SigningRequest,String>> sign(String keyName,
                                                                     List<SigningRequest> requests,
                                                                     SignVerifyOptions options)

Description copied from interface: VaultTransitSecretReactiveEngine

Sign a list of inputs items and an optional explicit sign/verify options. Each item shall specify the input to sign, an optional key version, and an optional transit context used for key derivation, if applicable. If any error occurs, the service will throw a VaultSigningBatchException

Specified by:

sign in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the signing key to use

requests - the list of inputs to sign

options - optional explicit sign/verify options

Returns:

a map of each request with its corresponding signature item

See Also:

sign data

verifySignature

public io.smallrye.mutiny.Uni<Void> verifySignature(String keyName,
                                                    String signature,
                                                    String input)

Description copied from interface: VaultTransitSecretReactiveEngine

Checks that the signature was obtained from signing the input with the specified key. The service will throw a VaultException if this is not the case.

Specified by:

verifySignature in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key that was used to sign the input

signature - the signature obtained from one of the sign methods

input - the original input data

See Also:

verify signed data

verifySignature

public io.smallrye.mutiny.Uni<Void> verifySignature(String keyName,
                                                    String signature,
                                                    SigningInput input,
                                                    TransitContext transitContext)

Description copied from interface: VaultTransitSecretReactiveEngine

Checks that the signature was obtained from signing the input with the specified key. The service will throw a VaultException if this is not the case.

Specified by:

verifySignature in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key that was used to sign the input

signature - the signature obtained from one of the sign methods

input - the original input data

transitContext - optional transit context used for key derivation

See Also:

verify signed data

verifySignature

public io.smallrye.mutiny.Uni<Void> verifySignature(String keyName,
                                                    String signature,
                                                    SigningInput input,
                                                    SignVerifyOptions options,
                                                    TransitContext transitContext)

Description copied from interface: VaultTransitSecretReactiveEngine

Checks that the signature was obtained from signing the input with the specified key an an optional explicit sign/verify options. The service will throw a VaultException if this is not the case.

Specified by:

verifySignature in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key that was used to sign the input

signature - the signature obtained from one of the sign methods

input - the original input data

options - optional explicit sign/verify options

transitContext - optional transit context used for key derivation

See Also:

verify signed data

verifySignature

public io.smallrye.mutiny.Uni<Void> verifySignature(String keyName,
                                                    List<VerificationRequest> requests)

Description copied from interface: VaultTransitSecretReactiveEngine

Checks a list of verification requests. Each request shall specify an input and the signature we want to match against, and an optional transit context used for key derivation, if applicable. If the signature does not match, or if any other error occurs, the service will throw a VaultVerificationBatchException

Specified by:

verifySignature in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key that was used to sign the input

requests - a list of items specifying an input and a signature to match against

See Also:

verify signed data

verifySignature

public io.smallrye.mutiny.Uni<Void> verifySignature(String keyName,
                                                    List<VerificationRequest> requests,
                                                    SignVerifyOptions options)

Description copied from interface: VaultTransitSecretReactiveEngine

Checks a list of verification requests. Each request shall specify an input and the signature we want to match against, and an optional explicit sign/verify options and an optionals transit context used for key derivation, if applicable. If the signature does not match, or if any other error occurs, the service will throw a VaultVerificationBatchException

Specified by:

verifySignature in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - the key that was used to sign the input

requests - a list of items specifying an input and a signature to match against

options - optional explicit sign/verify options

See Also:

verify signed data

createKey

public io.smallrye.mutiny.Uni<Void> createKey(String keyName,
                                              KeyCreationRequestDetail detail)

Description copied from interface: VaultTransitSecretReactiveEngine

Create a new Transit key.

Specified by:

createKey in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - key name

detail - key creation detail or null

See Also:

create key

updateKeyConfiguration

public io.smallrye.mutiny.Uni<Void> updateKeyConfiguration(String keyName,
                                                           KeyConfigRequestDetail detail)

Description copied from interface: VaultTransitSecretReactiveEngine

Update the configuration of a Transit key. The key must exist.

Specified by:

updateKeyConfiguration in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - key name

detail - key configuration detail

See Also:

update key configuration

deleteKey

public io.smallrye.mutiny.Uni<Void> deleteKey(String keyName)

Description copied from interface: VaultTransitSecretReactiveEngine

Delete a Transit key. Key must have been configured with deletion allowed. The key must exist.

Specified by:

deleteKey in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - key name

See Also:

delete key

exportKey

public io.smallrye.mutiny.Uni<VaultTransitKeyExportDetail> exportKey(String keyName,
                                                                     VaultTransitExportKeyType keyType,
                                                                     String keyVersion)

Description copied from interface: VaultTransitSecretReactiveEngine

Export a Transit Key. Key must have made exportable through creation or configuration update. The key must exist.

Specified by:

exportKey in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - name of the key

keyType - key type

keyVersion - null, "latest" or a valid version number as a String. If null all versions will be returned

Returns:

All specified key versions

See Also:

export key

readKey

public io.smallrye.mutiny.Uni<Optional<VaultTransitKeyDetail<?>>> readKey(String keyName)

Description copied from interface: VaultTransitSecretReactiveEngine

Read the configuration of a Transit key.

Specified by:

readKey in interface VaultTransitSecretReactiveEngine

Parameters:

keyName - key name

Returns:

key detail, or null if the key does not exist

See Also:

read key

listKeys

public io.smallrye.mutiny.Uni<List<String>> listKeys()

Description copied from interface: VaultTransitSecretReactiveEngine

List all Transit keys.

Specified by:

listKeys in interface VaultTransitSecretReactiveEngine

Returns:

key names

See Also:

list keys

map

protected VaultTransitKeyDetail<?> map(VaultTransitReadKeyData data)