Package: open-alchemy.package-security
SecurityPerforms calculations for creating pubic and secret keys. A credential is made
up of a public and secret key, a salt and a hash of the secret key that is safe
to store.Service SecretFor certain operations, such as the creation of secret keys, a service secret
is retrieved which required access to AWS secrets manager.CreateCreate a new credential.Input:sub: unique identifier for the user.Output:public_key: a unique public identifier for the key,secret_key: a secret key for the public key,salt: a random value used to create the credential andsecret_key_hash: a value derived from the secret key that is safe to store.Retrieve SecretRe-calculates the secret key based on known values.Input:subandsalt.Output:secret_key.Calculate Secret HashCalculate the secret key has for a secret.Input:secret_keyandsalt.Output:secret_key_hash.Compare Secret HashesSafely compare two secret key hashesInput:left: asecret_key_hashandright: asecret_key_hash.Output:Whetherleft==right.Algorithm:usehttps://docs.python.org/3/library/hmac.html#hmac.compare_digestto
compare the secret key hashes.SaltA salt is a random string generated usinghttps://docs.python.org/3/library/secrets.html#secrets.token_bytes.Public KeyThe public key is a hash based on thesubof the user and a salt. The
following algorithm is used:create a message by combining thesuband a random salt created usinghttps://docs.python.org/3/library/secrets.html#secrets.token_bytes,digest the message usingsha256usinghttps://docs.python.org/3/library/hashlib.html#hash-algorithmsandconvert to string usinghttps://docs.python.org/3/library/base64.html#base64.urlsafe_b64encodedecoding and and pre-pending it withpk_.Secret KeyThe secret key is a hash based on thesub,saltand a secret associated
with the service. The following algorithm is used:retrieve the service secret,create a message by combiningsub,saltand the service secret,digest the message usingsha256usinghttps://docs.python.org/3/library/hashlib.html#hash-algorithmsandconvert to string usinghttps://docs.python.org/3/library/base64.html#base64.urlsafe_b64encodedecoding and and pre-pending it withsk_.Secret Key HashThe secret key itself is not stored but a value that is derived from it but
hard to reverse is. The following function is used to calculate it:https://docs.python.org/3/library/hashlib.html#hashlib.pbkdf2_hmacwhere:hash_nameissha256,passwordis thesecret_key,saltis the credential salt,iterationsis 10k.CI-CDThe workflow is defined here:../.github/workflows/ci-cd-security.yaml.There are a few groups of jobs in the CI-CD:test: runs the tests for the package in supported python versions,build: builds the security package,deploy: deploys security infrastructure to AWS,release-required: determines whether a release to PyPI is required andrelease: a combination of deploying to test and production PyPI and
executing tests on the published packagestestExecutes the tests defined attests.buildBuilds the security package defined at..release-requiredHas 2 outputs:result: whether a release to PyPI is required based on the latest released
version and the version configured in the project andproject-version: the version configured in the code base.deployDeploys the CloudFormation stack for the security defined at../infrastructure/lib/security-stack.ts.releaseIf theresultoutput fromrelease-requiredis true, the package is deployed
to both test and production PyPI.Irrespective of whether the release was executed, the version of the package
defined in the code base is installed from both test and production PyPI and
the tests defined at../test/security/testsare
executed against the deployed infrastructure on AWS.Periodic Production TestsThe workflow is defined here:../.github/workflows/production-test-security.yaml.Executes the tests defined at../test/security/testsagainst a configured version of the package and against the currently deployed
infrastructure on AWS.Pytest PluginA pytest plugin is made available to make testing easier. It is defined atopen_alchemy/package_security/pytest_plugin.py.FixturesAll fixtures that have an effect but yieldNoneare prefixed with_so that
tools like pylint do not complain about unused arguments for test functions.service_secretConfigures the package to use a dummy service secret and yields it._service_secretThe same asservice_secretexcept that it is prefix with a leading_.access_tokenProvides an access token with admin access to the package api. Requires the
following environment variables:TEST_USERNAME: a username from the user pool.TEST_PASSWORD: the password for the user.