Secrets module (Lombiq Technologies: OCORE-124)

OrchardCore.sln

@@ -507,11 +507,9 @@ Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "OrchardCore.Sms", "src\Orch
 EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "OrchardCore.Sms.Core", "src\OrchardCore\OrchardCore.Sms.Core\OrchardCore.Sms.Core.csproj", "{20356393-B16D-466C-8203-877A534E287D}"
 EndProject
-Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "OrchardCore.Secrets.Abstractions", "src\OrchardCore\OrchardCore.Secrets.Abstractions\OrchardCore.Secrets.Abstractions.csproj", "{E19C8D65-7C32-43FA-BB3D-41F12EB4259D}"
-EndProject
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "OrchardCore.Secrets", "src\OrchardCore.Modules\OrchardCore.Secrets\OrchardCore.Secrets.csproj", "{7DC59AC8-E9EE-4015-AA63-8E18DB4AD88F}"
 EndProject
-Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "OrchardCore.Secrets.KeyVault", "src\OrchardCore.Modules\OrchardCore.Secrets.KeyVault\OrchardCore.Secrets.KeyVault.csproj", "{854511CE-6DC6-4AE1-A135-B21A94D7E784}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "OrchardCore.Secrets.Azure", "src\OrchardCore.Modules\OrchardCore.Secrets.KeyVault\OrchardCore.Secrets.Azure.csproj", "{854511CE-6DC6-4AE1-A135-B21A94D7E784}"
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
@@ -1341,10 +1339,6 @@ Global
 		{20356393-B16D-466C-8203-877A534E287D}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{20356393-B16D-466C-8203-877A534E287D}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{20356393-B16D-466C-8203-877A534E287D}.Release|Any CPU.Build.0 = Release|Any CPU
-		{E19C8D65-7C32-43FA-BB3D-41F12EB4259D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{E19C8D65-7C32-43FA-BB3D-41F12EB4259D}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{E19C8D65-7C32-43FA-BB3D-41F12EB4259D}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{E19C8D65-7C32-43FA-BB3D-41F12EB4259D}.Release|Any CPU.Build.0 = Release|Any CPU
 		{7DC59AC8-E9EE-4015-AA63-8E18DB4AD88F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{7DC59AC8-E9EE-4015-AA63-8E18DB4AD88F}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{7DC59AC8-E9EE-4015-AA63-8E18DB4AD88F}.Release|Any CPU.ActiveCfg = Release|Any CPU
@@ -1584,7 +1578,6 @@ Global
 		{2D93F509-1FB3-4E22-92F0-588D0EFBA921} = {F23AC6C2-DE44-4699-999D-3C478EF3D691}
 		{CBF6DB53-FD0C-47F8-9E60-A1D247ACFD05} = {A066395F-6F73-45DC-B5A6-B4E306110DCE}
 		{20356393-B16D-466C-8203-877A534E287D} = {F23AC6C2-DE44-4699-999D-3C478EF3D691}
-		{E19C8D65-7C32-43FA-BB3D-41F12EB4259D} = {F23AC6C2-DE44-4699-999D-3C478EF3D691}
 		{7DC59AC8-E9EE-4015-AA63-8E18DB4AD88F} = {A066395F-6F73-45DC-B5A6-B4E306110DCE}
 		{854511CE-6DC6-4AE1-A135-B21A94D7E784} = {A066395F-6F73-45DC-B5A6-B4E306110DCE}
 	EndGlobalSection

src/OrchardCore.Build/Dependencies.props

@@ -14,10 +14,10 @@
     <PackageManagement Include="AWSSDK.SecurityToken" Version="3.7.101.60" />
     <PackageManagement Include="Azure.Extensions.AspNetCore.Configuration.Secrets" Version="1.3.0" />
     <PackageManagement Include="Azure.Extensions.AspNetCore.DataProtection.Blobs" Version="1.3.2" />
-    <PackageManagement Include="Azure.Identity" Version="1.10.2" />
+    <PackageManagement Include="Azure.Identity" Version="1.10.4" />
     <PackageManagement Include="Azure.Security.KeyVault.Secrets" Version="4.1.0" />
-    <PackageManagement Include="Azure.Storage.Blobs" Version="12.18.0" />
-    <PackageManagement Include="BenchmarkDotNet" Version="0.13.9" />
+    <PackageManagement Include="Azure.Storage.Blobs" Version="12.19.1" />
+    <PackageManagement Include="BenchmarkDotNet" Version="0.13.11" />
     <PackageManagement Include="Castle.Core" Version="5.1.1" />
     <PackageManagement Include="DocumentFormat.OpenXml" Version="3.0.0" />
     <PackageManagement Include="Fluid.Core" Version="2.5.0" />

src/OrchardCore.Cms.Web/appsettings.json

@@ -258,10 +258,17 @@
     //},
     //"OrchardCore_Secrets": {
     //  "Secrets": {
-    //    "configuredRsaSecret1": {
+    //    "OrchardCore.Deployment.Remote.Encryption.SomeClientName": {
     //      "PublicKey": "...",
     //      "PrivateKey": "...",
-    //      "KeyType": "PublicPrivatePair"
+    //      "KeyType": "PublicPrivate"
+    //    },
+    //    "OrchardCore.Deployment.Remote.Signing.SomeClientName": {
+    //      "PublicKey": "...",
+    //      "KeyType": "Public"
+    //    },
+    //    "OrchardCore.Deployment.Remote.ApiKey.SomeClientName": {
+    //      "Text": "..."
     //    }
     //  },
     //  "KeyVault": {

src/OrchardCore.Modules/OrchardCore.AdminMenu/Controllers/MenuController.cs

@@ -72,7 +72,7 @@ public async Task<IActionResult> List(ContentOptions options, PagerParameters pa
             var pageSize = pager.PageSize;
             IEnumerable<Models.AdminMenu> results = new List<Models.AdminMenu>();
 
-            // Todo: handle the case where there is a deserialization exception on some of the presets.
+            //todo: handle the case where there is a deserialization exception on some of the presets.
             // load at least the ones without error. Provide a way to delete the ones on error.
             try
             {

src/OrchardCore.Modules/OrchardCore.Deployment.Remote/Controllers/ExportRemoteInstanceController.cs

@@ -1,4 +1,3 @@
-using System;
 using System.IO;
 using System.IO.Compression;
 using System.Net;
@@ -26,28 +25,28 @@ public class ExportRemoteInstanceController : Controller
     {
         private static readonly HttpClient _httpClient = new();
 
+        private readonly RemoteInstanceService _remoteInstanceService;
         private readonly IDeploymentManager _deploymentManager;
         private readonly IAuthorizationService _authorizationService;
         private readonly ISession _session;
-        private readonly RemoteInstanceService _service;
         private readonly ISecretService _secretService;
         private readonly INotifier _notifier;
         protected readonly IHtmlLocalizer H;
 
         public ExportRemoteInstanceController(
+            RemoteInstanceService remoteInstanceService,
             IAuthorizationService authorizationService,
-            ISession session,
-            RemoteInstanceService service,
             IDeploymentManager deploymentManager,
             ISecretService secretService,
+            ISession session,
             INotifier notifier,
             IHtmlLocalizer<ExportRemoteInstanceController> localizer)
         {
+            _remoteInstanceService = remoteInstanceService;
             _authorizationService = authorizationService;
             _deploymentManager = deploymentManager;
-            _session = session;
-            _service = service;
             _secretService = secretService;
+            _session = session;
             _notifier = notifier;
             H = localizer;
         }
@@ -61,27 +60,29 @@ public async Task<IActionResult> Execute(long id, string remoteInstanceId, strin
             }
 
             var deploymentPlan = await _session.GetAsync<DeploymentPlan>(id);
-
-            if (deploymentPlan == null)
+            if (deploymentPlan is null)
             {
                 return NotFound();
             }
 
-            var remoteInstance = await _service.GetRemoteInstanceAsync(remoteInstanceId);
-
-            if (remoteInstance == null)
+            var remoteInstance = await _remoteInstanceService.GetRemoteInstanceAsync(remoteInstanceId);
+            if (remoteInstance is null)
             {
                 return NotFound();
             }
 
             string archiveFileName;
-            var filename = deploymentPlan.Name.ToSafeName() + ".zip";
 
+            var filename = deploymentPlan.Name.ToSafeName() + ".zip";
             using (var fileBuilder = new TemporaryFileBuilder())
             {
                 archiveFileName = PathExtensions.Combine(Path.GetTempPath(), filename);
 
-                var deploymentPlanResult = new DeploymentPlanResult(fileBuilder, new RecipeDescriptor(), remoteInstance.RsaEncryptionSecret, remoteInstance.RsaSigningSecret);
+                var deploymentPlanResult = new DeploymentPlanResult(
+                    fileBuilder,
+                    new RecipeDescriptor(),
+                    $"{RemoteSecret.Namespace}.{remoteInstance.ClientName}");
+
                 await _deploymentManager.ExecuteDeploymentPlanAsync(deploymentPlan, deploymentPlanResult);
 
                 if (System.IO.File.Exists(archiveFileName))
@@ -93,7 +94,6 @@ public async Task<IActionResult> Execute(long id, string remoteInstanceId, strin
             }
 
             HttpResponseMessage response;
-
             try
             {
                 using (var requestContent = new MultipartFormDataContent())
@@ -111,16 +111,14 @@ public async Task<IActionResult> Execute(long id, string remoteInstanceId, strin
 
                     requestContent.Add(new StringContent(remoteInstance.ClientName), nameof(ImportViewModel.ClientName));
 
-                    if (!string.IsNullOrEmpty(remoteInstance.ApiKeySecret))
+                    var secret = await _secretService.GetSecretAsync<TextSecret>($"{RemoteSecret.Namespace}.{remoteInstance.ClientName}.ApiKey");
+                    if (secret is null)
                     {
-                        var secret = await _secretService.GetSecretAsync<TextSecret>(remoteInstance.ApiKeySecret);
-                        requestContent.Add(new StringContent(secret?.Text), nameof(ImportViewModel.ApiKey));
-                    }
-                    else
-                    {
-                        requestContent.Add(new StringContent(remoteInstance.ApiKey), nameof(ImportViewModel.ApiKey));
+                        return StatusCode((int)HttpStatusCode.BadRequest, "The Api Key doesn't exist.");
                     }
 
+                    requestContent.Add(new StringContent(secret.Text), nameof(ImportViewModel.ApiKey));
+
                     response = await _httpClient.PostAsync(remoteInstance.Url, requestContent);
                 }
 
@@ -130,7 +128,10 @@ public async Task<IActionResult> Execute(long id, string remoteInstanceId, strin
                 }
                 else
                 {
-                    await _notifier.ErrorAsync(H["An error occurred while sending the deployment to the remote instance: \"{0} ({1})\"", response.ReasonPhrase, (int)response.StatusCode]);
+                    await _notifier.ErrorAsync(
+                        H["An error occurred while sending the deployment to the remote instance: \"{0} ({1})\".",
+                        response.ReasonPhrase,
+                        (int)response.StatusCode]);
                 }
             }
             finally

src/OrchardCore.Modules/OrchardCore.Deployment.Remote/Controllers/ImportRemoteInstanceController.cs

@@ -1,14 +1,10 @@
-using System;
 using System.IO;
 using System.IO.Compression;
 using System.Linq;
 using System.Net;
-using System.Text;
 using System.Threading.Tasks;
-using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.FileProviders;
-using Microsoft.Extensions.Logging;
 using OrchardCore.Deployment.Remote.Services;
 using OrchardCore.Deployment.Remote.ViewModels;
 using OrchardCore.Deployment.Services;
@@ -21,22 +17,16 @@ public class ImportRemoteInstanceController : Controller
     {
         private readonly RemoteClientService _remoteClientService;
         private readonly IDeploymentManager _deploymentManager;
-        private readonly IDataProtector _dataProtector;
         private readonly ISecretService _secretService;
-        private readonly ILogger _logger;
 
         public ImportRemoteInstanceController(
             RemoteClientService remoteClientService,
             IDeploymentManager deploymentManager,
-            IDataProtectionProvider dataProtectionProvider,
-            ISecretService secretService,
-            ILogger<ImportRemoteInstanceController> logger)
+            ISecretService secretService)
         {
             _remoteClientService = remoteClientService;
             _deploymentManager = deploymentManager;
-            _dataProtector = dataProtectionProvider.CreateProtector("OrchardCore.Deployment").ToTimeLimitedDataProtector();
             _secretService = secretService;
-            _logger = logger;
         }
 
         /// <remarks>
@@ -49,32 +39,16 @@ public async Task<IActionResult> Import(ImportViewModel model)
         {
             var remoteClientList = await _remoteClientService.GetRemoteClientListAsync();
 
-            var remoteClient = remoteClientList.RemoteClients.FirstOrDefault(x => x.ClientName == model.ClientName);
-            if (remoteClient == null)
+            var remoteClient = remoteClientList.RemoteClients.FirstOrDefault(remote => remote.ClientName == model.ClientName);
+            if (remoteClient is null)
             {
-                return StatusCode((int)HttpStatusCode.BadRequest, "The remote client was not provided");
+                return StatusCode((int)HttpStatusCode.BadRequest, "The remote client was not provided.");
             }
 
-            var apiKey = string.Empty;
-            if (!string.IsNullOrEmpty(remoteClient.ApiKeySecret))
+            var secret = await _secretService.GetSecretAsync<TextSecret>($"{RemoteSecret.Namespace}.{model.ClientName}.ApiKey");
+            if (secret is null || secret.Text != model.ApiKey)
             {
-                apiKey = (await _secretService.GetSecretAsync<TextSecret>(remoteClient.ApiKeySecret))?.Text;
-            }
-            else
-            {
-                try
-                {
-                    apiKey = Encoding.UTF8.GetString(_dataProtector.Unprotect(remoteClient.ProtectedApiKey));
-                }
-                catch
-                {
-                    _logger.LogError("The Api Key could not be decrypted. It may have been encrypted using a different key.");
-                }
-            }
-
-            if (model.ApiKey != apiKey || model.ClientName != remoteClient.ClientName)
-            {
-                return StatusCode((int)HttpStatusCode.BadRequest, "The Api Key was not recognized");
+                return StatusCode((int)HttpStatusCode.BadRequest, "The Api Key was not recognized.");
             }
 
             // Create a temporary filename to save the archive

src/OrchardCore.Modules/OrchardCore.Deployment.Remote/Controllers/RemoteClientController.cs

@@ -1,10 +1,8 @@
 using System;
 using System.Collections.Generic;
 using System.Linq;
-using System.Text;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authorization;
-using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Localization;
 using Microsoft.AspNetCore.Mvc.Rendering;
@@ -18,41 +16,44 @@
 using OrchardCore.DisplayManagement.Notify;
 using OrchardCore.Navigation;
 using OrchardCore.Routing;
+using OrchardCore.Secrets;
+using OrchardCore.Secrets.Models;
 
 namespace OrchardCore.Deployment.Remote.Controllers
 {
     [Admin]
     public class RemoteClientController : Controller
     {
-        private readonly IDataProtector _dataProtector;
+        private readonly RemoteClientService _remoteClientService;
+        private readonly ISecretService _secretService;
         private readonly IAuthorizationService _authorizationService;
         private readonly PagerOptions _pagerOptions;
-        private readonly RemoteClientService _remoteClientService;
         private readonly INotifier _notifier;
 
         protected readonly dynamic New;
         protected readonly IStringLocalizer S;
         protected readonly IHtmlLocalizer H;
 
         public RemoteClientController(
-            IDataProtectionProvider dataProtectionProvider,
             RemoteClientService remoteClientService,
+            ISecretService secretService,
             IAuthorizationService authorizationService,
             IOptions<PagerOptions> pagerOptions,
+            INotifier notifier,
             IShapeFactory shapeFactory,
             IStringLocalizer<RemoteClientController> stringLocalizer,
-            IHtmlLocalizer<RemoteClientController> htmlLocalizer,
-            INotifier notifier
+            IHtmlLocalizer<RemoteClientController> htmlLocalizer
             )
         {
+            _remoteClientService = remoteClientService;
+            _secretService = secretService;
             _authorizationService = authorizationService;
             _pagerOptions = pagerOptions.Value;
+            _notifier = notifier;
+
             New = shapeFactory;
             S = stringLocalizer;
             H = htmlLocalizer;
-            _notifier = notifier;
-            _remoteClientService = remoteClientService;
-            _dataProtector = dataProtectionProvider.CreateProtector("OrchardCore.Deployment").ToTimeLimitedDataProtector();
         }
 
         public async Task<IActionResult> Index(ContentOptions options, PagerParameters pagerParameters)
@@ -134,7 +135,7 @@ public async Task<IActionResult> Create(EditRemoteClientViewModel model)
 
             if (ModelState.IsValid)
             {
-                await _remoteClientService.CreateRemoteClientAsync(model.ClientName, model.ApiKey, model.ApiKeySecret);
+                await _remoteClientService.CreateRemoteClientAsync(model.ClientName, model.ApiKey);
 
                 await _notifier.SuccessAsync(H["Remote client created successfully."]);
                 return RedirectToAction(nameof(Index));
@@ -152,24 +153,19 @@ public async Task<IActionResult> Edit(string id)
             }
 
             var remoteClient = await _remoteClientService.GetRemoteClientAsync(id);
-
-            if (remoteClient == null)
+            if (remoteClient is null)
             {
                 return NotFound();
             }
 
+            var secret = await _secretService.GetSecretAsync<TextSecret>($"{RemoteSecret.Namespace}.{remoteClient.ClientName}.ApiKey");
             var model = new EditRemoteClientViewModel
             {
                 Id = remoteClient.Id,
                 ClientName = remoteClient.ClientName,
-                ApiKeySecret = remoteClient.ApiKeySecret,
+                ApiKey = secret?.Text,
             };
 
-            if (remoteClient.ProtectedApiKey?.Length > 0)
-            {
-                model.ApiKey = Encoding.UTF8.GetString(_dataProtector.Unprotect(remoteClient.ProtectedApiKey));
-            }
-
             return View(model);
         }
 
@@ -195,7 +191,7 @@ public async Task<IActionResult> Edit(EditRemoteClientViewModel model)
 
             if (ModelState.IsValid)
             {
-                await _remoteClientService.TryUpdateRemoteClient(model.Id, model.ClientName, model.ApiKey, model.ApiKeySecret);
+                await _remoteClientService.UpdateRemoteClientAsync(model.Id, model.ClientName, model.ApiKey);
 
                 await _notifier.SuccessAsync(H["Remote client updated successfully."]);
 
@@ -230,7 +226,7 @@ public async Task<IActionResult> Delete(string id)
 
         [HttpPost, ActionName("Index")]
         [FormValueRequired("submit.BulkAction")]
-        public async Task<ActionResult> IndexPost(ViewModels.ContentOptions options, IEnumerable<string> itemIds)
+        public async Task<ActionResult> IndexPost(ContentOptions options, IEnumerable<string> itemIds)
         {
             if (!await _authorizationService.AuthorizeAsync(User, Permissions.ManageRemoteInstances))
             {
@@ -268,7 +264,7 @@ private void ValidateViewModel(EditRemoteClientViewModel model)
                 ModelState.AddModelError(nameof(EditRemoteClientViewModel.ClientName), S["The client name is mandatory."]);
             }
 
-            if (string.IsNullOrWhiteSpace(model.ApiKey) && string.IsNullOrWhiteSpace(model.ApiKeySecret))
+            if (string.IsNullOrWhiteSpace(model.ApiKey))
             {
                 ModelState.AddModelError(nameof(EditRemoteClientViewModel.ApiKey), S["The api key is mandatory."]);
             }