Securely signed releases PRD (#1249)

* Add custom_keys

* Fix error messages

* Add spec

* Add audit logging

* Adjust custom key audit

Author: AndriiMysko

lib/travis/api/v3/models/custom_key.rb

@@ -0,0 +1,45 @@
+module Travis::API::V3
+  class Models::CustomKey < Model
+    belongs_to :owner, polymorphic: true
+
+    serialize :private_key, Travis::Model::EncryptedColumn.new
+
+    validates_each :private_key do |record, attr, private_key|
+      record.errors.add(attr, :missing_attr, message: 'missing_attr') if private_key.blank?
+      record.errors.add(attr, :invalid_pem, message: 'invalid_pem') unless record.valid_pem?
+    end
+
+    def save_key!(owner_type, owner_id, name, description, private_key, added_by)
+      self.owner_type = owner_type
+      self.owner_id = owner_id
+      self.private_key = private_key
+      self.name = name
+      self.description = description
+      self.added_by = added_by
+
+      if self.valid?
+        self.fingerprint = calculate_fingerprint(private_key)
+        self.public_key = OpenSSL::PKey::RSA.new(private_key).public_key.to_s
+
+        self.save!
+      end
+
+      self
+    end
+
+    def valid_pem?
+      private_key && OpenSSL::PKey::RSA.new(private_key)
+      true
+    rescue OpenSSL::PKey::RSAError
+      false
+    end
+
+    private
+
+    def calculate_fingerprint(source)
+      rsa_key = OpenSSL::PKey::RSA.new(source)
+      public_ssh_rsa = "\x00\x00\x00\x07ssh-rsa" + rsa_key.e.to_s(0) + rsa_key.n.to_s(0)
+      OpenSSL::Digest::MD5.new(public_ssh_rsa).hexdigest.scan(/../).join(':')
+    end
+  end
+end

lib/travis/api/v3/models/organization.rb

@@ -29,6 +29,11 @@ def build_priorities_enabled?
       Travis::Features.owner_active?(:build_priorities_org, self)
     end
 
+    def custom_keys
+      return @custom_keys if defined? @custom_keys
+      @custom_keys = Models::CustomKey.where(owner_type: 'Organization', owner_id: id)
+    end
+
     alias members users
   end
 end

lib/travis/api/v3/models/user.rb

@@ -82,5 +82,10 @@ def installation
     def github?
       vcs_type == 'GithubUser'
     end
+
+    def custom_keys
+      return @custom_keys if defined? @custom_keys
+      @custom_keys = Models::CustomKey.where(owner_type: 'User', owner_id: id)
+    end
   end
 end

lib/travis/api/v3/queries/custom_key.rb

@@ -0,0 +1,65 @@
+module Travis::API::V3
+  class Queries::CustomKey < Query
+    def create(params, current_user)
+      raise UnprocessableEntity, 'Key with this identifier already exists.' unless Travis::API::V3::Models::CustomKey.where(name: params['name'], owner_id: params['owner_id'], owner_type: params['owner_type']).count.zero?
+
+      if params['owner_type'] == 'User'
+        org_ids = User.find(params['owner_id']).organizations.map(&:id)
+
+        raise UnprocessableEntity, 'Key with this identifier already exists in one of your organizations.' unless Travis::API::V3::Models::CustomKey.where(name: params['name'], owner_id: org_ids, owner_type: 'Organization').count.zero?
+      elsif params['owner_type'] == 'Organization'
+        user_ids = Membership.where(organization_id: params['owner_id']).map(&:user_id)
+
+        raise UnprocessableEntity, 'Key with this identifier already exists for your user.' unless Travis::API::V3::Models::CustomKey.where(name: params['name'], owner_id: user_ids, owner_type: 'User').count.zero?
+      end
+
+      key = Travis::API::V3::Models::CustomKey.new.save_key!(
+        params['owner_type'],
+        params['owner_id'],
+        params['name'],
+        params['description'],
+        params['private_key'],
+        params['added_by']
+      )
+      handle_errors(key) unless key.valid?
+
+      Travis::API::V3::Models::Audit.create!(
+        owner: current_user,
+        change_source: 'travis-api',
+        source: key,
+        source_changes: {
+          action: 'create',
+          fingerprint: key.fingerprint
+        }
+      )
+
+      key
+    end
+
+    def delete(params, current_user)
+      key = Travis::API::V3::Models::CustomKey.find(params['id'])
+      Travis::API::V3::Models::Audit.create!(
+        owner: current_user,
+        change_source: 'travis-api',
+        source: key,
+        source_changes: {
+          action: 'delete',
+          name: key.name,
+          owner_type: key.owner_type,
+          owner_id: key.owner_id,
+          fingerprint: key.fingerprint
+        }
+      )
+
+      key.destroy
+    end
+
+    private
+
+    def handle_errors(key)
+      private_key = key.errors[:private_key]
+      raise UnprocessableEntity, 'This key is not a private key.' if private_key.include?('invalid_pem')
+      raise WrongParams         if private_key.include?('missing_attr')
+    end
+  end
+end

lib/travis/api/v3/renderer/custom_key.rb

@@ -0,0 +1,10 @@
+module Travis::API::V3
+  class Renderer::CustomKey < ModelRenderer
+    representation :standard, :id, :name, :description, :public_key, :fingerprint, :added_by_login, :created_at
+    representation :minimal, *representations[:standard]
+
+    def added_by_login
+      model.added_by.nil? ? '' : User.find(model.added_by).login
+    end
+  end
+end

lib/travis/api/v3/renderer/owner.rb

@@ -6,7 +6,7 @@ class Renderer::Owner < ModelRenderer
 
     representation(:minimal,    :id, :login, :name, :vcs_type, :ro_mode)
     representation(:standard,   :id, :login, :name, :github_id, :vcs_id, :vcs_type, :avatar_url, :education,
-                   :allow_migration, :allowance, :ro_mode)
+                   :allow_migration, :allowance, :ro_mode, :custom_keys)
     representation(:additional, :repositories, :installation)
 
     def initialize(*)

lib/travis/api/v3/renderer/user.rb

@@ -2,7 +2,7 @@
 
 module Travis::API::V3
   class Renderer::User < Renderer::Owner
-    representation(:standard, :email, :is_syncing, :synced_at, :recently_signed_up, :secure_user_hash, :ro_mode, :confirmed_at)
+    representation(:standard, :email, :is_syncing, :synced_at, :recently_signed_up, :secure_user_hash, :ro_mode, :confirmed_at, :custom_keys)
     representation(:additional, :emails)
 
     def email

lib/travis/api/v3/routes.rb

@@ -311,6 +311,16 @@ module Routes
       end
     end
 
+    hidden_resource :custom_keys do
+      route '/custom_keys'
+      post   :create
+    end
+
+    hidden_resource :custom_key do
+      route '/custom_key/{id}'
+      delete   :delete
+    end
+
     hidden_resource :beta_migration_requests do
       route '/beta_migration_requests'
 

lib/travis/api/v3/services.rb

@@ -23,6 +23,8 @@ module Services
     CreditsCalculator     = Module.new { extend Services }
     Cron                  = Module.new { extend Services }
     Crons                 = Module.new { extend Services }
+    CustomKey             = Module.new { extend Services }
+    CustomKeys            = Module.new { extend Services }
     EmailSubscription     = Module.new { extend Services }
     EnvVar                = Module.new { extend Services }
     EnvVars               = Module.new { extend Services }

lib/travis/api/v3/services/custom_key/delete.rb

@@ -0,0 +1,10 @@
+module Travis::API::V3
+  class Services::CustomKey::Delete < Service
+    def run!
+      raise LoginRequired unless access_control.full_access_or_logged_in?
+
+      query(:custom_key).delete(params, access_control.user)
+      deleted
+    end
+  end
+end