Skip to content

Commit 59e164f

Browse files
ashwin2002ashwin2002
committed
Adding encryption_at_rest endpoints under the standard rest package
Change-Id: Ie16d8811a0d2466201c7a46e98b415543d9db4a4 Reviewed-on: https://review.couchbase.org/c/TAF/+/245053 Tested-by: Build Bot <build@couchbase.com> Reviewed-by: <pulkit.matta@couchbase.com> Tested-by: Ashwin <ashwin.govindarajulu@couchbase.com>
1 parent 5deeb36 commit 59e164f

4 files changed

Lines changed: 164 additions & 5 deletions

File tree

‎AGENTS.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,11 @@ agents/
262262
### Available agents & skills
263263
See [agents/AGENTS.md](agents/AGENTS.md) for the full list of agents and skills.
264264

265+
### AGENTS.md-first rule
266+
Before opening any `.py` file in a directory, read that directory's `AGENTS.md` if one exists.
267+
AGENTS.md files pre-compile file-to-class mappings, method inventories, inheritance chains, and known stubs — reading them first avoids redundant file reads.
268+
If the subdirectory also has an AGENTS.md (e.g. `buckets/AGENTS.md`), read that too before its `.py` files.
269+
265270
---
266271

267272
## Supporting Documentation

‎couchbase_utils/cb_server_rest_util/security/AGENTS.md‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,19 @@ No REST methods implemented yet — placeholder class.
4545
| Method | Verb | Path |
4646
|---|---|---|
4747
| `list_encryption_at_rest_keys` | GET | `/settings/encryptionKeys/` |
48+
| `get_encryption_at_rest_key` | GET | `/settings/encryptionKeys/{KEY_ID}` |
4849
| `create_encryption_at_rest_key` | POST | `/settings/encryptionKeys` |
49-
| `update_encryption_at_rest_key` | PUT | `/settings/encryptionKeys/{keyId}` |
50-
| `test_encryption_at_rest_key` | POST | `/settings/encryptionKeys/{keyId}/test` |
50+
| `update_encryption_at_rest_key` | PUT | `/settings/encryptionKeys/{KEY_ID}` |
51+
| `delete_encryption_at_rest_key` | DELETE | `/settings/encryptionKeys/{KEY_ID}` |
52+
| `test_encryption_at_rest_key` | POST | `/settings/encryptionKeys/{KEY_ID}/test` |
53+
| `test_encryption_at_rest_key_changes` | PUT | `/settings/encryptionKeys/{KEY_ID}/test` |
54+
| `get_encryption_at_rest_settings` | GET | `/settings/security/encryptionAtRest` |
55+
| `set_encryption_at_rest_settings` | POST | `/settings/security/encryptionAtRest` |
56+
| `drop_encryption_deks_for_bucket` | POST | `/controller/dropEncryptionAtRestDeks/bucket/{BUCKET_NAME}` |
57+
| `drop_encryption_deks_for_type` | POST | `/controller/dropEncryptionAtRestDeks/{TYPE}` — `audit\|config\|log` |
58+
| `rotate_encryption_at_rest_key` | POST | `/controller/rotateEncryptionKey/{KEY_ID}` |
59+
| `force_encryption_at_rest_for_bucket` | POST | `/controller/forceEncryptionAtRest/bucket/{BUCKET_NAME}` |
60+
| `force_encryption_at_rest_for_type` | POST | `/controller/forceEncryptionAtRest/{TYPE}` — `audit\|config\|log` |
5161

5262
### jwt.py — `JWTAPI`
5363

@@ -94,6 +104,6 @@ If you encounter such an import, warn the user and replace it with `self.request
94104

95105
## Notes
96106

97-
- `EncryptionAtRest` is not yet included in `SecurityRestAPI`'s inheritance chain — verify before using via `rest.security`.
107+
- `EncryptionAtRest` is included in `SecurityRestAPI` — all encryption methods are accessible via `rest.security`.
98108
- `disable_jwt` makes two sequential requests (GET then PUT) — this is a known pattern exception; do not split.
99109
- `Auditing` class is a stub; REST methods for `/settings/audit` are not yet implemented.

‎couchbase_utils/cb_server_rest_util/security/encryption_at_rest.py‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
"""
2+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/encryption-at-rest.html
3+
"""
4+
from cb_server_rest_util.connection import CBRestConnection
5+
6+
7+
class EncryptionAtRest(CBRestConnection):
8+
def __init__(self):
9+
super(EncryptionAtRest, self).__init__()
10+
11+
def list_encryption_at_rest_keys(self):
12+
"""
13+
GET /settings/encryptionKeys/
14+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/manage-encryption-keys.html#list-keys
15+
"""
16+
api = self.base_url + "/settings/encryptionKeys"
17+
status, content, _ = self.request(api, self.GET)
18+
return status, content
19+
20+
def get_encryption_at_rest_key(self, key_id):
21+
"""
22+
GET /settings/encryptionKeys/{KEY_ID}
23+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/manage-encryption-keys.html#list-keys
24+
"""
25+
api = self.base_url + f"/settings/encryptionKeys/{key_id}"
26+
status, content, _ = self.request(api, self.GET)
27+
return status, content
28+
29+
def create_encryption_at_rest_key(self, params):
30+
"""
31+
POST /settings/encryptionKeys
32+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/manage-encryption-keys.html#create-key
33+
"""
34+
api = self.base_url + '/settings/encryptionKeys'
35+
status, content, _ = self.request(api, method=self.POST, params=params)
36+
return status, content
37+
38+
def update_encryption_at_rest_key(self, key_id, params):
39+
"""
40+
PUT /settings/encryptionKeys/{KEY_ID}
41+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/manage-encryption-keys.html#create-key
42+
"""
43+
api = self.base_url + f'/settings/encryptionKeys/{key_id}'
44+
status, content, _ = self.request(api, method=self.PUT, params=params)
45+
return status, content
46+
47+
def delete_encryption_at_rest_key(self, key_id):
48+
"""
49+
DELETE /settings/encryptionKeys/{KEY_ID}
50+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/manage-encryption-keys.html#delete-key
51+
"""
52+
api = self.base_url + f'/settings/encryptionKeys/{key_id}'
53+
status, content, _ = self.request(api, method=self.DELETE)
54+
return status, content
55+
56+
def test_encryption_at_rest_key(self, key_id):
57+
"""
58+
POST /settings/encryptionKeys/{KEY_ID}/test
59+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/manage-encryption-keys.html#test-key
60+
"""
61+
api = self.base_url + f'/settings/encryptionKeys/{key_id}/test'
62+
status, content, _ = self.request(api, method=self.POST)
63+
return status, content
64+
65+
def test_encryption_at_rest_key_changes(self, key_id, params):
66+
"""
67+
PUT /settings/encryptionKeys/{KEY_ID}/test
68+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/manage-encryption-keys.html#test-key-changes
69+
:param params: updated key config (name, type, data, usage)
70+
"""
71+
api = self.base_url + f'/settings/encryptionKeys/{key_id}/test'
72+
status, content, _ = self.request(api, method=self.PUT, params=params)
73+
return status, content
74+
75+
def get_encryption_at_rest_settings(self):
76+
"""
77+
GET /settings/security/encryptionAtRest
78+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/manage-system-encryption-at-rest.html#get-settings
79+
Returns audit, config, and log encryption-at-rest settings.
80+
"""
81+
api = self.base_url + "/settings/security/encryptionAtRest"
82+
status, content, _ = self.request(api, self.GET)
83+
return status, content
84+
85+
def set_encryption_at_rest_settings(self, params):
86+
"""
87+
POST /settings/security/encryptionAtRest
88+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/manage-system-encryption-at-rest.html#change-settings
89+
:param params: dict with keys like audit.encryptionMethod, config.encryptionKeyId, etc.
90+
"""
91+
api = self.base_url + "/settings/security/encryptionAtRest"
92+
status, content, _ = self.request(api, method=self.POST, params=params)
93+
return status, content
94+
95+
def drop_encryption_deks_for_bucket(self, bucket_name):
96+
"""
97+
POST /controller/dropEncryptionAtRestDeks/bucket/{BUCKET_NAME}
98+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/drop-encryption-deks.html#drop-bucket
99+
Rotates DEKs for a bucket and re-encrypts its data.
100+
"""
101+
api = self.base_url + f"/controller/dropEncryptionAtRestDeks/bucket/{bucket_name}"
102+
status, content, _ = self.request(api, method=self.POST)
103+
return status, content
104+
105+
def drop_encryption_deks_for_type(self, data_type):
106+
"""
107+
POST /controller/dropEncryptionAtRestDeks/{TYPE}
108+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/drop-encryption-deks.html#drop-type
109+
:param data_type: "audit" | "config" | "log"
110+
"""
111+
api = self.base_url + f"/controller/dropEncryptionAtRestDeks/{data_type}"
112+
status, content, _ = self.request(api, method=self.POST)
113+
return status, content
114+
115+
def rotate_encryption_at_rest_key(self, key_id):
116+
"""
117+
POST /controller/rotateEncryptionKey/{KEY_ID}
118+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/rotate-encryption-at-rest-key.html#rotate-key
119+
Creates a new key version and re-encrypts all DEKs encrypted with the previous version.
120+
"""
121+
api = self.base_url + f"/controller/rotateEncryptionKey/{key_id}"
122+
status, content, _ = self.request(api, method=self.POST)
123+
return status, content
124+
125+
def force_encryption_at_rest_for_bucket(self, bucket_name):
126+
"""
127+
POST /controller/forceEncryptionAtRest/bucket/{BUCKET_NAME}
128+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/force-encryption-at-rest.html#bucket
129+
Forces encryption of unencrypted data in a bucket.
130+
"""
131+
api = self.base_url + f"/controller/forceEncryptionAtRest/bucket/{bucket_name}"
132+
status, content, _ = self.request(api, method=self.POST)
133+
return status, content
134+
135+
def force_encryption_at_rest_for_type(self, data_type):
136+
"""
137+
POST /controller/forceEncryptionAtRest/{TYPE}
138+
https://docs.couchbase.com/server/current/rest-api/security/encryption-at-rest/force-encryption-at-rest.html#type
139+
:param data_type: "audit" | "config" | "log"
140+
"""
141+
api = self.base_url + f"/controller/forceEncryptionAtRest/{data_type}"
142+
status, content, _ = self.request(api, method=self.POST)
143+
return status, content

‎couchbase_utils/cb_server_rest_util/security/security_api.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
from cb_server_rest_util.security.auditing import Auditing
22
from cb_server_rest_util.security.certificate_management import CertificateMangementAPI
3+
from cb_server_rest_util.security.encryption_at_rest import EncryptionAtRest
34
from cb_server_rest_util.security.rbac_authorization import RbacAuthorization
45
from cb_server_rest_util.security.restrict_node_addition import \
56
NodeInitAddition
67

78

8-
class SecurityRestAPI(Auditing, CertificateMangementAPI, NodeInitAddition,
9-
RbacAuthorization):
9+
class SecurityRestAPI(Auditing, CertificateMangementAPI, EncryptionAtRest,
10+
NodeInitAddition, RbacAuthorization):
1011
def __init__(self, server):
1112
super(SecurityRestAPI, self).__init__()
1213

0 commit comments

Comments
 (0)