Package org.springframework.vault.core

Class ReactiveVaultTransitTemplate

java.lang.Object

org.springframework.vault.core.ReactiveVaultTransitTemplate

All Implemented Interfaces:

ReactiveVaultTransitOperations

public class ReactiveVaultTransitTemplate
extends Object
implements ReactiveVaultTransitOperations

Default implementation of ReactiveVaultTransitOperations.

Since:

3.1

Author:

James Luke

Constructor Summary

Constructors

Constructor	Description
ReactiveVaultTransitTemplate(ReactiveVaultOperations reactiveVaultOperations, String path)

Method Summary

Modifier and Type	Method	Description
Mono<Void>	configureKey(String keyName, VaultTransitKeyConfiguration keyConfiguration)	Create a new named encryption key given a name.
Mono<Void>	createKey(String keyName)	Create a new named encryption key given a name.
Mono<Void>	createKey(String keyName, VaultTransitKeyCreationRequest createKeyRequest)	Create a new named encryption key given a name and VaultTransitKeyCreationRequest.
Mono<String>	decrypt(String keyName, String ciphertext)	Decrypts the provided plain text using the named key.
Mono<byte[]>	decrypt(String keyName, String ciphertext, VaultTransitContext transitContext)	Decrypts the provided ciphertext using the named key.
Flux<VaultDecryptionResult>	decrypt(String keyName, List<Ciphertext> batchRequest)	Decrypts the provided batch of cipher text using the named key and context.
Mono<Plaintext>	decrypt(String keyName, Ciphertext ciphertext)	Decrypts the provided cipher text using the named key.
Mono<Void>	deleteKey(String keyName)	Deletes a named encryption key.
Mono<String>	encrypt(String keyName, byte[] plaintext, VaultTransitContext transitContext)	Encrypts the provided plaintext using the named key.
Mono<String>	encrypt(String keyName, String plaintext)	Encrypts the provided plain text using the named key.
Flux<VaultEncryptionResult>	encrypt(String keyName, List<Plaintext> batchRequest)	Encrypts the provided batch of plaintext using the named key and context.
Mono<Ciphertext>	encrypt(String keyName, Plaintext plaintext)	Encrypts the provided plaintext using the named key.
Mono<RawTransitKey>	exportKey(String keyName, TransitKeyType type)	Returns the value of the named encryption key.
Mono<Hmac>	getHmac(String keyName, Plaintext plaintext)	Create a HMAC using keyName of given Plaintext using the default hash algorithm.
Mono<Hmac>	getHmac(String keyName, VaultHmacRequest hmacRequest)	Create a HMAC using keyName of given VaultHmacRequest using the default hash algorithm.
Mono<VaultTransitKey>	getKey(String keyName)	Return information about a named encryption key.
Flux<String>	getKeys()	Get a Flux of transit key names.
Mono<String>	rewrap(String keyName, String ciphertext)	Rewrap the provided cipher text using the latest version of the named key.
Mono<String>	rewrap(String keyName, String ciphertext, VaultTransitContext transitContext)	Rewrap the provided cipher text using the latest version of the named key.
Flux<VaultEncryptionResult>	rewrap(String keyName, List<Ciphertext> batchRequest)	Rewrap the provided batch of cipher text using the latest version of the named key.
Mono<Void>	rotate(String keyName)	Rotates the version of the named key.
Mono<Signature>	sign(String keyName, Plaintext plaintext)	Create a cryptographic signature using keyName of the given Plaintext and the default hash algorithm.
Mono<Signature>	sign(String keyName, VaultSignRequest signRequest)	Create a cryptographic signature using keyName of the given VaultSignRequest and the specified hash algorithm.
Mono<Boolean>	verify(String keyName, Plaintext plaintext, Signature signature)	Verify the cryptographic signature using keyName of the given Plaintext and Signature.
Mono<SignatureValidation>	verify(String keyName, VaultSignatureVerificationRequest verificationRequest)	Verify the cryptographic signature using keyName of the given VaultSignRequest.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ReactiveVaultTransitTemplate

public ReactiveVaultTransitTemplate(ReactiveVaultOperations reactiveVaultOperations,
 String path)

Method Details

createKey

public Mono<Void> createKey(String keyName)

Description copied from interface: ReactiveVaultTransitOperations

Create a new named encryption key given a name.

Specified by:

createKey in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

createKey

public Mono<Void> createKey(String keyName,
 VaultTransitKeyCreationRequest createKeyRequest)

Description copied from interface: ReactiveVaultTransitOperations

Create a new named encryption key given a name and VaultTransitKeyCreationRequest. The key options set here cannot be changed after key creation.

Specified by:

createKey in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

createKeyRequest - must not be null.

rotate

public Mono<Void> rotate(String keyName)

Description copied from interface: ReactiveVaultTransitOperations

Rotates the version of the named key. After rotation, new plain text requests will be encrypted with the new version of the key. To upgrade ciphertext to be encrypted with the latest version of the key, use ReactiveVaultTransitOperations.rewrap(String, String).

Specified by:

rotate in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

See Also:

• ReactiveVaultTransitOperations.rewrap(String, String)

encrypt

public Mono<String> encrypt(String keyName,
 String plaintext)

Description copied from interface: ReactiveVaultTransitOperations

Encrypts the provided plain text using the named key. The given plaintext is encoded into bytes using the default charset. Use ReactiveVaultTransitOperations.encrypt(String, org.springframework.vault.support.Plaintext) to construct a Plaintext object from bytes to avoid Charset mismatches.

Specified by:

encrypt in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

plaintext - must not be empty or null.

Returns:

cipher text.

configureKey

public Mono<Void> configureKey(String keyName,
 VaultTransitKeyConfiguration keyConfiguration)

Description copied from interface: ReactiveVaultTransitOperations

Create a new named encryption key given a name.

Specified by:

configureKey in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

keyConfiguration - must not be null.

deleteKey

public Mono<Void> deleteKey(String keyName)

Description copied from interface: ReactiveVaultTransitOperations

Deletes a named encryption key. It will no longer be possible to decrypt any data encrypted with the named key.

Specified by:

deleteKey in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

getKeys

public Flux<String> getKeys()

Description copied from interface: ReactiveVaultTransitOperations

Get a Flux of transit key names.

Specified by:

getKeys in interface ReactiveVaultTransitOperations

Returns:

Flux of transit key names.

encrypt

public Mono<String> encrypt(String keyName,
 byte[] plaintext,
 VaultTransitContext transitContext)

Description copied from interface: ReactiveVaultTransitOperations

Encrypts the provided plaintext using the named key.

Specified by:

encrypt in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

plaintext - must not be empty or null.

transitContext - must not be null. Use VaultTransitContext.empty() if no request options provided.

Returns:

cipher text.

encrypt

public Mono<Ciphertext> encrypt(String keyName,
 Plaintext plaintext)

Description copied from interface: ReactiveVaultTransitOperations

Encrypts the provided plaintext using the named key.

Specified by:

encrypt in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

plaintext - must not be null.

Returns:

cipher text.

decrypt

public Mono<String> decrypt(String keyName,
 String ciphertext)

Description copied from interface: ReactiveVaultTransitOperations

Decrypts the provided plain text using the named key. The decoded plaintext is decoded into String the default charset. Use ReactiveVaultTransitOperations.decrypt(String, org.springframework.vault.support.Ciphertext) to obtain a Ciphertext object that allows to control the Charset for later consumption.

Specified by:

decrypt in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

ciphertext - must not be empty or null.

Returns:

plain text.

decrypt

public Mono<Plaintext> decrypt(String keyName,
 Ciphertext ciphertext)

Description copied from interface: ReactiveVaultTransitOperations

Decrypts the provided cipher text using the named key.

Specified by:

decrypt in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

ciphertext - must not be null.

Returns:

plain text.

decrypt

public Mono<byte[]> decrypt(String keyName,
 String ciphertext,
 VaultTransitContext transitContext)

Description copied from interface: ReactiveVaultTransitOperations

Decrypts the provided ciphertext using the named key.

Specified by:

decrypt in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

ciphertext - must not be empty or null.

transitContext - must not be null. Use VaultTransitContext.empty() if no request options provided.

Returns:

cipher text.

rewrap

public Mono<String> rewrap(String keyName,
 String ciphertext)

Description copied from interface: ReactiveVaultTransitOperations

Rewrap the provided cipher text using the latest version of the named key. Because this never returns plain text, it is possible to delegate this functionality to untrusted users or scripts.

Specified by:

rewrap in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

ciphertext - must not be empty or null.

Returns:

cipher text.

See Also:

• ReactiveVaultTransitOperations.rotate(String)

rewrap

public Mono<String> rewrap(String keyName,
 String ciphertext,
 VaultTransitContext transitContext)

Description copied from interface: ReactiveVaultTransitOperations

Rewrap the provided cipher text using the latest version of the named key. Because this never returns plain text, it is possible to delegate this functionality to untrusted users or scripts.

Specified by:

rewrap in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

ciphertext - must not be empty or null.

transitContext - must not be null. Use VaultTransitContext.empty() if no request options provided.

Returns:

cipher text.

See Also:

• ReactiveVaultTransitOperations.rotate(String)

rewrap

public Flux<VaultEncryptionResult> rewrap(String keyName,
 List<Ciphertext> batchRequest)

Description copied from interface: ReactiveVaultTransitOperations

Rewrap the provided batch of cipher text using the latest version of the named key.

Specified by:

rewrap in interface ReactiveVaultTransitOperations

batchRequest - a list of Ciphertext which includes cipher text and a context

Returns:

the rewrapped result in the order of batchRequest ciphertexts.

See Also:

• ReactiveVaultTransitOperations.rewrap(String, String)

encrypt

public Flux<VaultEncryptionResult> encrypt(String keyName,
 List<Plaintext> batchRequest)

Description copied from interface: ReactiveVaultTransitOperations

Encrypts the provided batch of plaintext using the named key and context. The encryption is done using transit backend's batch operation.

Specified by:

encrypt in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

batchRequest - a list of Plaintext which includes plain text and an optional context.

Returns:

the encrypted result in the order of batchRequest plaintexts.

decrypt

public Flux<VaultDecryptionResult> decrypt(String keyName,
 List<Ciphertext> batchRequest)

Description copied from interface: ReactiveVaultTransitOperations

Decrypts the provided batch of cipher text using the named key and context. The* decryption is done using transit backend's batch operation.

Specified by:

decrypt in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

batchRequest - a list of Ciphertext which includes plain text and an optional context.

Returns:

the decrypted result in the order of batchRequest ciphertexts.

getHmac

public Mono<Hmac> getHmac(String keyName,
 Plaintext plaintext)

Description copied from interface: ReactiveVaultTransitOperations

Create a HMAC using keyName of given Plaintext using the default hash algorithm. The key can be of any type supported by transit; the raw key will be marshaled into bytes to be used for the HMAC function. If the key is of a type that supports rotation, the latest (current) version will be used.

Specified by:

getHmac in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

plaintext - must not be null.

Returns:

the digest of given data the default hash algorithm and the named key.

getHmac

public Mono<Hmac> getHmac(String keyName,
 VaultHmacRequest hmacRequest)

Description copied from interface: ReactiveVaultTransitOperations

Create a HMAC using keyName of given VaultHmacRequest using the default hash algorithm. The key can be of any type supported by transit; the raw key will be marshaled into bytes to be used for the HMAC function. If the key is of a type that supports rotation, configured VaultHmacRequest.getKeyVersion() will be used.

Specified by:

getHmac in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

hmacRequest - the VaultHmacRequest, must not be null.

Returns:

the digest of given data the default hash algorithm and the named key.

sign

public Mono<Signature> sign(String keyName,
 Plaintext plaintext)

Description copied from interface: ReactiveVaultTransitOperations

Create a cryptographic signature using keyName of the given Plaintext and the default hash algorithm. The key must be of a type that supports signing.

Specified by:

sign in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

plaintext - must not be empty or null.

Returns:

Signature for Plaintext.

sign

public Mono<Signature> sign(String keyName,
 VaultSignRequest signRequest)

Description copied from interface: ReactiveVaultTransitOperations

Create a cryptographic signature using keyName of the given VaultSignRequest and the specified hash algorithm. The key must be of a type that supports signing.

Specified by:

sign in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

signRequest - VaultSignRequest must not be empty or null.

Returns:

Signature for VaultSignRequest.

verify

public Mono<Boolean> verify(String keyName,
 Plaintext plaintext,
 Signature signature)

Description copied from interface: ReactiveVaultTransitOperations

Verify the cryptographic signature using keyName of the given Plaintext and Signature.

Specified by:

verify in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

plaintext - must not be null.

signature - Signature to be verified, must not be null.

Returns:

true if the signature is valid, false otherwise.

verify

public Mono<SignatureValidation> verify(String keyName,
 VaultSignatureVerificationRequest verificationRequest)

Description copied from interface: ReactiveVaultTransitOperations

Verify the cryptographic signature using keyName of the given VaultSignRequest.

Specified by:

verify in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

verificationRequest - VaultSignatureVerificationRequest must not be null.

Returns:

the resulting SignatureValidation.

exportKey

public Mono<RawTransitKey> exportKey(String keyName,
 TransitKeyType type)

Description copied from interface: ReactiveVaultTransitOperations

Returns the value of the named encryption key. Depending on the type of key, different information may be returned. The key must be exportable to support this operation.

Specified by:

exportKey in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

type - must not be null.

Returns:

the RawTransitKey. Empty if key does not exist

getKey

public Mono<VaultTransitKey> getKey(String keyName)

Description copied from interface: ReactiveVaultTransitOperations

Return information about a named encryption key.

Specified by:

getKey in interface ReactiveVaultTransitOperations

Parameters:

keyName - must not be empty or null.

Returns:

the VaultTransitKey. Empty if key does not exist.