|
2 | 2 | // SPDX-License-Identifier: Apache-2.0 |
3 | 3 | package software.amazon.encryption.s3.internal; |
4 | 4 |
|
| 5 | +import software.amazon.awssdk.protocols.jsoncore.JsonWriter; |
| 6 | +import software.amazon.awssdk.services.s3.model.CreateMultipartUploadRequest; |
| 7 | +import software.amazon.awssdk.services.s3.model.PutObjectRequest; |
| 8 | +import software.amazon.encryption.s3.S3EncryptionClientException; |
| 9 | +import software.amazon.encryption.s3.materials.EncryptedDataKey; |
5 | 10 | import software.amazon.encryption.s3.materials.EncryptionMaterials; |
6 | 11 |
|
| 12 | +import java.nio.charset.StandardCharsets; |
| 13 | +import java.util.Base64; |
| 14 | +import java.util.HashMap; |
7 | 15 | import java.util.Map; |
8 | 16 |
|
9 | | -@FunctionalInterface |
10 | | -public interface ContentMetadataEncodingStrategy { |
| 17 | +public class ContentMetadataEncodingStrategy { |
11 | 18 |
|
12 | | - Map<String, String> encodeMetadata(EncryptionMaterials materials, byte[] iv, |
13 | | - Map<String, String> metadata); |
| 19 | + private static final Base64.Encoder ENCODER = Base64.getEncoder(); |
| 20 | + private final InstructionFileConfig _instructionFileConfig; |
| 21 | + |
| 22 | + public ContentMetadataEncodingStrategy(InstructionFileConfig instructionFileConfig) { |
| 23 | + _instructionFileConfig = instructionFileConfig; |
| 24 | + } |
| 25 | + |
| 26 | + public PutObjectRequest encodeMetadata(EncryptionMaterials materials, byte[] iv, PutObjectRequest putObjectRequest) { |
| 27 | + if (_instructionFileConfig.isInstructionFilePutEnabled()) { |
| 28 | + final String metadataString = metadataToString(materials, iv); |
| 29 | + _instructionFileConfig.putInstructionFile(putObjectRequest, metadataString); |
| 30 | + // the original request object is returned as-is |
| 31 | + return putObjectRequest; |
| 32 | + } else { |
| 33 | + Map<String, String> newMetadata = addMetadataToMap(putObjectRequest.metadata(), materials, iv); |
| 34 | + return putObjectRequest.toBuilder() |
| 35 | + .metadata(newMetadata) |
| 36 | + .build(); |
| 37 | + } |
| 38 | + } |
| 39 | + |
| 40 | + public CreateMultipartUploadRequest encodeMetadata(EncryptionMaterials materials, byte[] iv, CreateMultipartUploadRequest createMultipartUploadRequest) { |
| 41 | + if(_instructionFileConfig.isInstructionFilePutEnabled()) { |
| 42 | + final String metadataString = metadataToString(materials, iv); |
| 43 | + PutObjectRequest putObjectRequest = ConvertSDKRequests.convertRequest(createMultipartUploadRequest); |
| 44 | + _instructionFileConfig.putInstructionFile(putObjectRequest, metadataString); |
| 45 | + // the original request object is returned as-is |
| 46 | + return createMultipartUploadRequest; |
| 47 | + } else { |
| 48 | + Map<String, String> newMetadata = addMetadataToMap(createMultipartUploadRequest.metadata(), materials, iv); |
| 49 | + return createMultipartUploadRequest.toBuilder() |
| 50 | + .metadata(newMetadata) |
| 51 | + .build(); |
| 52 | + } |
| 53 | + } |
| 54 | + private String metadataToString(EncryptionMaterials materials, byte[] iv) { |
| 55 | + // this is just the metadata map serialized as JSON |
| 56 | + // so first get the Map |
| 57 | + final Map<String, String> metadataMap = addMetadataToMap(new HashMap<>(), materials, iv); |
| 58 | + // then serialize it |
| 59 | + try (JsonWriter jsonWriter = JsonWriter.create()) { |
| 60 | + jsonWriter.writeStartObject(); |
| 61 | + for (Map.Entry<String, String> entry : metadataMap.entrySet()) { |
| 62 | + jsonWriter.writeFieldName(entry.getKey()).writeValue(entry.getValue()); |
| 63 | + } |
| 64 | + jsonWriter.writeEndObject(); |
| 65 | + |
| 66 | + return new String(jsonWriter.getBytes(), StandardCharsets.UTF_8); |
| 67 | + } catch (JsonWriter.JsonGenerationException e) { |
| 68 | + throw new S3EncryptionClientException("Cannot serialize materials to JSON.", e); |
| 69 | + } |
| 70 | + } |
| 71 | + |
| 72 | + private Map<String, String> addMetadataToMap(Map<String, String> map, EncryptionMaterials materials, byte[] iv) { |
| 73 | + Map<String, String> metadata = new HashMap<>(map); |
| 74 | + EncryptedDataKey edk = materials.encryptedDataKeys().get(0); |
| 75 | + metadata.put(MetadataKeyConstants.ENCRYPTED_DATA_KEY_V2, ENCODER.encodeToString(edk.encryptedDatakey())); |
| 76 | + metadata.put(MetadataKeyConstants.CONTENT_IV, ENCODER.encodeToString(iv)); |
| 77 | + metadata.put(MetadataKeyConstants.CONTENT_CIPHER, materials.algorithmSuite().cipherName()); |
| 78 | + metadata.put(MetadataKeyConstants.CONTENT_CIPHER_TAG_LENGTH, Integer.toString(materials.algorithmSuite().cipherTagLengthBits())); |
| 79 | + metadata.put(MetadataKeyConstants.ENCRYPTED_DATA_KEY_ALGORITHM, new String(edk.keyProviderInfo(), StandardCharsets.UTF_8)); |
| 80 | + |
| 81 | + try (JsonWriter jsonWriter = JsonWriter.create()) { |
| 82 | + jsonWriter.writeStartObject(); |
| 83 | + for (Map.Entry<String, String> entry : materials.encryptionContext().entrySet()) { |
| 84 | + jsonWriter.writeFieldName(entry.getKey()).writeValue(entry.getValue()); |
| 85 | + } |
| 86 | + jsonWriter.writeEndObject(); |
| 87 | + |
| 88 | + String jsonEncryptionContext = new String(jsonWriter.getBytes(), StandardCharsets.UTF_8); |
| 89 | + metadata.put(MetadataKeyConstants.ENCRYPTED_DATA_KEY_CONTEXT, jsonEncryptionContext); |
| 90 | + } catch (JsonWriter.JsonGenerationException e) { |
| 91 | + throw new S3EncryptionClientException("Cannot serialize encryption context to JSON.", e); |
| 92 | + } |
| 93 | + return metadata; |
| 94 | + } |
14 | 95 | } |
0 commit comments