Generalised key vault config

cli/config-cli/src/test/java/com/quorum/tessera/config/cli/OverrideUtilTest.java

@@ -170,7 +170,8 @@ public void buildOptions() {
                         "server.influxConfig.sslConfig.sslConfigType",
                         "server.influxConfig.sslConfig.excludeCipherSuites",
                         "features.enableRemoteKeyValidation",
-                        "encryptor.type");
+                        "encryptor.type",
+                        "keys.keyVaultConfig.keyVaultType");
 
         final Map<String, Class> results = OverrideUtil.buildConfigOptions();
 

config/src/main/java/com/quorum/tessera/config/AzureKeyVaultConfig.java

@@ -6,6 +6,7 @@
 import javax.xml.bind.annotation.XmlAccessorType;
 import javax.xml.bind.annotation.XmlAttribute;
 
+@Deprecated
 @XmlAccessorType(XmlAccessType.FIELD)
 public class AzureKeyVaultConfig extends ConfigItem implements KeyVaultConfig {
 
@@ -34,4 +35,5 @@ public KeyVaultType getKeyVaultType() {
         return KeyVaultType.AZURE;
     }
 
+
 }

config/src/main/java/com/quorum/tessera/config/DefaultKeyVaultConfig.java

@@ -0,0 +1,47 @@
+package com.quorum.tessera.config;
+
+import com.quorum.tessera.config.adapters.MapAdapter;
+
+import javax.validation.constraints.NotNull;
+import javax.xml.bind.annotation.*;
+import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+@XmlType(name = "keyVaultConfig")
+@XmlAccessorType(XmlAccessType.FIELD)
+public class DefaultKeyVaultConfig extends ConfigItem implements KeyVaultConfig {
+
+    @NotNull
+    @XmlAttribute
+    private KeyVaultType keyVaultType;
+
+    @XmlJavaTypeAdapter(MapAdapter.class)
+    @XmlElement
+    private Map<String, String> properties = new HashMap<>();
+
+    public DefaultKeyVaultConfig() {}
+
+    public DefaultKeyVaultConfig setProperty(String name, String value) {
+        this.properties.put(name, value);
+        return this;
+    }
+
+    public void setProperties(Map<String, String> properties) {
+        this.properties = properties;
+    }
+
+    public Map<String, String> getProperties() {
+        return Collections.unmodifiableMap(properties);
+    }
+
+    @Override
+    public KeyVaultType getKeyVaultType() {
+        return keyVaultType;
+    }
+
+    public void setKeyVaultType(KeyVaultType keyVaultType) {
+        this.keyVaultType = keyVaultType;
+    }
+}

config/src/main/java/com/quorum/tessera/config/HashicorpKeyVaultConfig.java

@@ -12,17 +12,13 @@
 import javax.xml.bind.annotation.adapters.XmlJavaTypeAdapter;
 import java.nio.file.Path;
 
+@Deprecated
 @XmlAccessorType(XmlAccessType.FIELD)
 public class HashicorpKeyVaultConfig extends ConfigItem implements KeyVaultConfig {
 
-    @Valid
-    @NotNull
-    @XmlAttribute
-    private String url;
+    @Valid @NotNull @XmlAttribute private String url;
 
-    @Valid
-    @XmlElement
-    private String approlePath;
+    @Valid @XmlElement private String approlePath;
 
     @Valid
     @ValidPath(checkExists = true, message = "File does not exist")
@@ -43,8 +39,7 @@ public HashicorpKeyVaultConfig(String url, String approlePath, Path tlsKeyStoreP
         this.tlsTrustStorePath = tlsTrustStorePath;
     }
 
-    public HashicorpKeyVaultConfig() {
-    }
+    public HashicorpKeyVaultConfig() {}
 
     public String getUrl() {
         return this.url;
@@ -71,7 +66,7 @@ public void setTlsTrustStorePath(Path tlsTrustStorePath) {
     }
 
     public String getApprolePath() {
-        if(approlePath == null) {
+        if (approlePath == null) {
             return "approle";
         }
         return approlePath;
@@ -85,4 +80,6 @@ public void setApprolePath(String approlePath) {
     public KeyVaultType getKeyVaultType() {
         return KeyVaultType.HASHICORP;
     }
+
+
 }

config/src/main/java/com/quorum/tessera/config/KeyConfiguration.java

@@ -2,6 +2,7 @@
 
 import com.quorum.tessera.config.adapters.KeyDataAdapter;
 import com.quorum.tessera.config.adapters.PathAdapter;
+import com.quorum.tessera.config.constraints.ValidKeyVaultConfig;
 import com.quorum.tessera.config.constraints.ValidPath;
 import com.quorum.tessera.config.keypairs.ConfigKeyPair;
 
@@ -35,6 +36,8 @@ public class KeyConfiguration extends ConfigItem {
     @XmlJavaTypeAdapter(KeyDataAdapter.class)
     private List<@Valid ConfigKeyPair> keyData;
 
+    @ValidKeyVaultConfig @XmlElement private DefaultKeyVaultConfig keyVaultConfig;
+
     @Valid @XmlElement private AzureKeyVaultConfig azureKeyVaultConfig;
 
     @Valid @XmlElement private HashicorpKeyVaultConfig hashicorpKeyVaultConfig;
@@ -50,6 +53,11 @@ public KeyConfiguration(
         this.keyData = keyData;
         this.azureKeyVaultConfig = azureKeyVaultConfig;
         this.hashicorpKeyVaultConfig = hashicorpKeyVaultConfig;
+        if (null != azureKeyVaultConfig) {
+            this.keyVaultConfig = KeyVaultConfigConverter.convert(azureKeyVaultConfig);
+        } else if (null != hashicorpKeyVaultConfig) {
+            this.keyVaultConfig = KeyVaultConfigConverter.convert(hashicorpKeyVaultConfig);
+        }
     }
 
     public KeyConfiguration() {}
@@ -88,9 +96,27 @@ public void setKeyData(List<ConfigKeyPair> keyData) {
 
     public void setAzureKeyVaultConfig(AzureKeyVaultConfig azureKeyVaultConfig) {
         this.azureKeyVaultConfig = azureKeyVaultConfig;
+        this.keyVaultConfig = KeyVaultConfigConverter.convert(azureKeyVaultConfig);
     }
 
     public void setHashicorpKeyVaultConfig(HashicorpKeyVaultConfig hashicorpKeyVaultConfig) {
         this.hashicorpKeyVaultConfig = hashicorpKeyVaultConfig;
+        this.keyVaultConfig = KeyVaultConfigConverter.convert(hashicorpKeyVaultConfig);
+    }
+
+    public DefaultKeyVaultConfig getKeyVaultConfig() {
+        if (keyVaultConfig != null) {
+            return keyVaultConfig;
+        }
+        if (null != azureKeyVaultConfig) {
+            return KeyVaultConfigConverter.convert(azureKeyVaultConfig);
+        } else if (null != hashicorpKeyVaultConfig) {
+            return KeyVaultConfigConverter.convert(hashicorpKeyVaultConfig);
+        }
+        return null;
+    }
+
+    public void setKeyVaultConfig(DefaultKeyVaultConfig keyVaultConfig) {
+        this.keyVaultConfig = keyVaultConfig;
     }
 }

config/src/main/java/com/quorum/tessera/config/KeyVaultConfig.java

@@ -1,7 +1,29 @@
 package com.quorum.tessera.config;
 
+import java.util.Collections;
+import java.util.Map;
+import java.util.Optional;
+import java.util.stream.Stream;
+
 public interface KeyVaultConfig {
 
     KeyVaultType getKeyVaultType();
 
+    default Map<String, String> getProperties() {
+        return Collections.EMPTY_MAP;
+    }
+
+    default boolean hasProperty(String... name) {
+        return Stream.of(name)
+            .allMatch(n -> getProperties().containsKey(n));
+    }
+
+    default Optional<String> getProperty(String name) {
+        return Optional.ofNullable(getProperties().get(name));
+    }
+
+    static KeyVaultConfig create() {
+        return new DefaultKeyVaultConfig();
+    }
+
 }

config/src/main/java/com/quorum/tessera/config/KeyVaultConfigConverter.java

@@ -0,0 +1,41 @@
+package com.quorum.tessera.config;
+
+import java.util.Objects;
+import java.util.Optional;
+
+public interface KeyVaultConfigConverter {
+
+    /*
+    TODO: Remove these when AzureKeyVaultConfig is removed
+     */
+    static DefaultKeyVaultConfig convert(AzureKeyVaultConfig azureKeyVaultConfig) {
+        DefaultKeyVaultConfig config = new DefaultKeyVaultConfig();
+        config.setKeyVaultType(azureKeyVaultConfig.getKeyVaultType());
+        config.setProperty("url", azureKeyVaultConfig.getUrl());
+        return config;
+    }
+
+    /*
+    TODO: Remove these when HashicorpKeyVaultConfig is removed
+     */
+    static DefaultKeyVaultConfig convert(HashicorpKeyVaultConfig hashicorpKeyVaultConfig) {
+        DefaultKeyVaultConfig config = new DefaultKeyVaultConfig();
+        config.setKeyVaultType(hashicorpKeyVaultConfig.getKeyVaultType());
+        config.setProperty("url",hashicorpKeyVaultConfig.getUrl());
+        config.setProperty("approlePath",hashicorpKeyVaultConfig.getApprolePath());
+
+        Optional.ofNullable(hashicorpKeyVaultConfig.getTlsKeyStorePath())
+            .map(Objects::toString)
+            .ifPresent(v -> {
+                config.setProperty("tlsKeyStorePath",v);
+            });
+
+        Optional.ofNullable(hashicorpKeyVaultConfig.getTlsTrustStorePath())
+            .map(Objects::toString)
+            .ifPresent(v -> {
+                config.setProperty("tlsTrustStorePath",v);
+            });
+
+        return config;
+    }
+}

config/src/main/java/com/quorum/tessera/config/constraints/KeyVaultConfigValidator.java

@@ -0,0 +1,71 @@
+package com.quorum.tessera.config.constraints;
+
+import com.quorum.tessera.config.DefaultKeyVaultConfig;
+import com.quorum.tessera.config.KeyVaultType;
+
+import javax.validation.ConstraintValidator;
+import javax.validation.ConstraintValidatorContext;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+
+// Define here to be used during path validation
+@ValidPath(checkExists = true, message = "File does not exist")
+public class KeyVaultConfigValidator implements ConstraintValidator<ValidKeyVaultConfig, DefaultKeyVaultConfig> {
+
+    private ValidKeyVaultConfig config;
+
+    @Override
+    public void initialize(ValidKeyVaultConfig config) {
+        this.config = config;
+    }
+
+    @Override
+    public boolean isValid(
+            DefaultKeyVaultConfig keyVaultConfig, ConstraintValidatorContext constraintValidatorContext) {
+        if (keyVaultConfig == null || keyVaultConfig.getKeyVaultType() == null) {
+            return true;
+        }
+
+        KeyVaultType keyVaultType = keyVaultConfig.getKeyVaultType();
+
+        List<Boolean> outcomes = new ArrayList<>();
+        if (keyVaultType == KeyVaultType.AZURE) {
+
+            if (!keyVaultConfig.getProperties().containsKey("url")) {
+                constraintValidatorContext.disableDefaultConstraintViolation();
+                constraintValidatorContext
+                        .buildConstraintViolationWithTemplate("URL is required")
+                        .addConstraintViolation();
+                outcomes.add(Boolean.FALSE);
+            }
+        }
+
+        if (keyVaultType == KeyVaultType.HASHICORP) {
+
+            if (!keyVaultConfig.getProperties().containsKey("url")) {
+                constraintValidatorContext.disableDefaultConstraintViolation();
+                constraintValidatorContext
+                        .buildConstraintViolationWithTemplate("URL is required")
+                        .addConstraintViolation();
+                outcomes.add(Boolean.FALSE);
+            }
+
+            PathValidator pathValidator = new PathValidator();
+            ValidPath validPath = this.getClass().getAnnotation(ValidPath.class);
+            pathValidator.initialize(validPath);
+
+            if (keyVaultConfig.getProperties().containsKey("tlsKeyStorePath")) {
+                Path tlsKeyStorePath = Paths.get(keyVaultConfig.getProperties().get("tlsKeyStorePath"));
+                outcomes.add(pathValidator.isValid(tlsKeyStorePath, constraintValidatorContext));
+            }
+            if (keyVaultConfig.getProperties().containsKey("tlsTrustStorePath")) {
+                Path tlsKeyStorePath = Paths.get(keyVaultConfig.getProperties().get("tlsTrustStorePath"));
+                outcomes.add(pathValidator.isValid(tlsKeyStorePath, constraintValidatorContext));
+            }
+        }
+
+        return outcomes.stream().allMatch(Boolean::booleanValue);
+    }
+}

config/src/main/java/com/quorum/tessera/config/constraints/ValidKeyVaultConfig.java

@@ -0,0 +1,22 @@
+package com.quorum.tessera.config.constraints;
+
+import javax.validation.Constraint;
+import javax.validation.Payload;
+import java.lang.annotation.Documented;
+import java.lang.annotation.Retention;
+import java.lang.annotation.Target;
+
+import static java.lang.annotation.ElementType.*;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+
+@Target({FIELD, PARAMETER, ANNOTATION_TYPE})
+@Retention(RUNTIME)
+@Constraint(validatedBy = KeyVaultConfigValidator.class)
+@Documented
+public @interface ValidKeyVaultConfig {
+    String message() default "{ValidKeyVaultConfig.message}";
+
+    Class<?>[] groups() default {};
+
+    Class<? extends Payload>[] payload() default {};
+}

config/src/main/java/com/quorum/tessera/config/util/JaxbUtil.java

@@ -40,7 +40,8 @@ public final class JaxbUtil {
                 SslAuthenticationMode.class,
                 SslConfig.class,
                 SslTrustMode.class,
-                ConfigProperties.class
+                ConfigProperties.class,
+                DefaultKeyVaultConfig.class
             };
 
     private JaxbUtil() {}

config/src/test/java/com/quorum/tessera/config/DefaultKeyVaultConfigTest.java

@@ -0,0 +1,32 @@
+package com.quorum.tessera.config;
+
+import com.quorum.tessera.config.util.JaxbUtil;
+import org.junit.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+
+public class DefaultKeyVaultConfigTest {
+
+    @Test
+    public void defaultInstance() {
+        DefaultKeyVaultConfig defaultKeyVaultConfig = new DefaultKeyVaultConfig();
+        assertThat(defaultKeyVaultConfig.getKeyVaultType()).isNull();
+        assertThat(defaultKeyVaultConfig.getProperties()).isEmpty();
+    }
+
+    @Test
+    public void keyVaultConfigDefaultGetPropertiesIsEmpty() {
+        KeyVaultConfig keyVaultConfig = mock(KeyVaultConfig.class);
+        assertThat(keyVaultConfig.getKeyVaultType()).isNull();
+        assertThat(keyVaultConfig.getProperties()).isEmpty();
+    }
+
+    @Test
+    public void doStuff() {
+        DefaultKeyVaultConfig defaultKeyVaultConfig = new DefaultKeyVaultConfig();
+        defaultKeyVaultConfig.setKeyVaultType(KeyVaultType.HASHICORP);
+        defaultKeyVaultConfig.setProperty("url","someurl");
+        JaxbUtil.marshalWithNoValidation(defaultKeyVaultConfig, System.out);
+    }
+}