Add command to add/rotate JWT secrets (#139)

src/main/java/com/nike/cerberus/ConfigConstants.java

@@ -33,6 +33,7 @@ public class ConfigConstants {
     public static final String CERT_PART_PUBKEY = "pubkey.pem";
     public static final String CERT_ACME_ACCOUNT_PRIVATE_KEY = "certificates/acme/account-private-key-pkcs1.pem";
     public static final String CMS_ENV_CONFIG_PATH = "cms/environment.properties";
+    public static final String JWT_SECRETS_PATH = "jwt-secrets.json";
     public static final String VERSION_PROPERTY = "cli.version";
     public static final String CMS_ADMIN_GROUP_KEY = "cms.admin.group";
     public static final String ROOT_USER_ARN_KEY = "root.user.arn";

src/main/java/com/nike/cerberus/cli/CerberusRunner.java

@@ -42,29 +42,12 @@
 import com.nike.cerberus.command.composite.*;
 import com.nike.cerberus.command.certificates.GenerateAndRotateCertificatesCommand;
 import com.nike.cerberus.command.certificates.RotateCertificatesCommand;
-import com.nike.cerberus.command.core.CreateAlbLogAthenaDbAndTableCommand;
-import com.nike.cerberus.command.core.InitializeEnvironmentCommand;
-import com.nike.cerberus.command.core.SyncConfigCommand;
+import com.nike.cerberus.command.core.*;
 import com.nike.cerberus.command.rds.CleanUpRdsSnapshotsCommand;
 import com.nike.cerberus.command.rds.CopyRdsSnapshotsCommand;
 import com.nike.cerberus.command.rds.CreateDatabaseCommand;
-import com.nike.cerberus.command.core.CreateEdgeDomainRecordCommand;
-import com.nike.cerberus.command.core.CreateLoadBalancerCommand;
-import com.nike.cerberus.command.core.CreateRoute53Command;
-import com.nike.cerberus.command.core.CreateSecurityGroupsCommand;
-import com.nike.cerberus.command.core.CreateVpcCommand;
-import com.nike.cerberus.command.core.CreateWafCommand;
 import com.nike.cerberus.command.certificates.DeleteOldestCertificatesCommand;
-import com.nike.cerberus.command.core.DeleteStackCommand;
-import com.nike.cerberus.command.core.GenerateCertificateFilesCommand;
-import com.nike.cerberus.command.core.PrintStackInfoCommand;
-import com.nike.cerberus.command.core.RestoreCerberusBackupCommand;
-import com.nike.cerberus.command.core.RebootCmsCommand;
-import com.nike.cerberus.command.core.UpdateStackCommand;
 import com.nike.cerberus.command.certificates.UploadCertificateFilesCommand;
-import com.nike.cerberus.command.core.ViewConfigCommand;
-import com.nike.cerberus.command.core.WhitelistCidrForVpcAccessCommand;
-import com.nike.cerberus.command.core.UpdateStackTagsCommand;
 import com.nike.cerberus.command.rds.XRegionDatabaseReplicationCommand;
 import com.nike.cerberus.domain.input.EnvironmentConfig;
 import com.nike.cerberus.logging.LoggingConfigurer;
@@ -257,6 +240,7 @@ private void registerAllCommands() {
         registerCommand(new CreateAlbLogAthenaDbAndTableCommand());
         registerCommand(new CreateCmsResourcesForRegionCommand());
         registerCommand(new XRegionDatabaseReplicationCommand());
+        registerCommand(new AddJwtSecretCommand());
     }
 
     /**

src/main/java/com/nike/cerberus/cli/EnvironmentConfigToArgsMapper.java

@@ -177,6 +177,9 @@ public static List<String> getArgsForCommand(EnvironmentConfig environmentConfig
             case XRegionDatabaseReplicationCommand.COMMAND_NAME:
                 args = Arrays.asList(passedArgs);
                 break;
+            case AddJwtSecretCommand.COMMAND_NAME:
+                args = Arrays.asList(passedArgs);
+                break;
             default:
                 break;
         }

src/main/java/com/nike/cerberus/command/core/AddJwtSecretCommand.java

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2019 Nike, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.nike.cerberus.command.core;
+
+import com.beust.jcommander.Parameter;
+import com.beust.jcommander.Parameters;
+import com.nike.cerberus.command.Command;
+import com.nike.cerberus.operation.Operation;
+import com.nike.cerberus.operation.core.AddJwtSecretOperation;
+
+import static com.nike.cerberus.command.core.AddJwtSecretCommand.COMMAND_NAME;
+
+/**
+ * Command for add/rotate JWT secret for CMS
+ */
+@Parameters(commandNames = COMMAND_NAME, commandDescription = "Add/rotate JWT secret for CMS")
+public class AddJwtSecretCommand implements Command {
+
+    public static final String COMMAND_NAME = "add-jwt-secret";
+    public static final String ACTIVATION_DELAY_LONG_ARG = "--activation-delay";
+
+    @Override
+    public String getCommandName() {
+        return COMMAND_NAME;
+    }
+
+    @Parameter(names = ACTIVATION_DELAY_LONG_ARG, description = "delay in second before the secret can be used to sign JWT")
+    private long activationDelay = 5 * 60;
+
+    public long getActivationDelay() {
+        return activationDelay;
+    }
+
+    @Override
+    public Class<? extends Operation<?>> getOperationClass() {
+        return AddJwtSecretOperation.class;
+    }
+}

src/main/java/com/nike/cerberus/domain/environment/JwtSecret.java

@@ -0,0 +1,69 @@
+/*
+ * Copyright (c) 2019 Nike, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.nike.cerberus.domain.environment;
+
+public class JwtSecret {
+    private String id;
+
+    private String secret;
+
+    private String algorithm;
+
+    private long effectiveTs;
+
+    private long createdTs;
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public String getSecret() {
+        return secret;
+    }
+
+    public void setSecret(String secret) {
+        this.secret = secret;
+    }
+
+    public long getEffectiveTs() {
+        return effectiveTs;
+    }
+
+    public void setEffectiveTs(long effectiveTs) {
+        this.effectiveTs = effectiveTs;
+    }
+
+    public long getCreatedTs() {
+        return createdTs;
+    }
+
+    public void setCreatedTs(long createdTs) {
+        this.createdTs = createdTs;
+    }
+
+    public String getAlgorithm() {
+        return algorithm;
+    }
+
+    public void setAlgorithm(String algorithm) {
+        this.algorithm = algorithm;
+    }
+}

src/main/java/com/nike/cerberus/domain/environment/JwtSecretData.java

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2019 Nike, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.nike.cerberus.domain.environment;
+
+import java.util.LinkedList;
+
+
+public class JwtSecretData {
+    private LinkedList<JwtSecret> jwtSecrets = new LinkedList<>();
+
+    public LinkedList<JwtSecret> getJwtSecrets() {
+        return jwtSecrets;
+    }
+
+    public void setJwtSecrets(LinkedList<JwtSecret> jwtSecrets) {
+        this.jwtSecrets = jwtSecrets;
+    }
+}

src/main/java/com/nike/cerberus/operation/core/AddJwtSecretOperation.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2019 Nike, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.nike.cerberus.operation.core;
+
+import com.nike.cerberus.command.core.AddJwtSecretCommand;
+import com.nike.cerberus.operation.Operation;
+import com.nike.cerberus.store.ConfigStore;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import javax.inject.Inject;
+
+/**
+ * Operation for add/rotate JWT secrets.
+ */
+public class AddJwtSecretOperation implements Operation<AddJwtSecretCommand> {
+
+
+    private final Logger logger = LoggerFactory.getLogger(getClass());
+
+    private final ConfigStore configStore;
+
+    @Inject
+    public AddJwtSecretOperation(ConfigStore configStore) {
+
+        this.configStore = configStore;
+    }
+
+    @Override
+    public void run(AddJwtSecretCommand command) {
+        long activationDelay = command.getActivationDelay();
+        configStore.addJwtKey(activationDelay);
+
+    }
+
+    @Override
+    public boolean isRunnable(AddJwtSecretCommand command) {
+        return true;
+    }
+}

src/main/java/com/nike/cerberus/service/KeyGenerator.java

@@ -0,0 +1,38 @@
+/*
+ * Copyright (c) 2019 Nike, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.nike.cerberus.service;
+
+import javax.crypto.SecretKey;
+import java.security.NoSuchAlgorithmException;
+
+/**
+ * Generate a key
+ */
+public class KeyGenerator {
+    public static final String HMACSHA512 = "HmacSHA512";
+
+
+    public SecretKey generateKey(String algorithm) {
+        javax.crypto.KeyGenerator gen;
+        try {
+            gen = javax.crypto.KeyGenerator.getInstance(algorithm);
+            return gen.generateKey();
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException("The " + algorithm + " algorithm is not available.");
+        }
+    }
+}