public async Task EncryptionResourceTokenAuthRestricted() { TestDoc testDoc = await EncryptionTests.CreateItemAsync(EncryptionTests.itemContainerCore, EncryptionTests.dekId, TestDoc.PathsToEncrypt); User restrictedUser = EncryptionTests.databaseCore.GetUser(Guid.NewGuid().ToString()); await EncryptionTests.databaseCore.CreateUserAsync(restrictedUser.Id); PermissionProperties restrictedUserPermission = await restrictedUser.CreatePermissionAsync( new PermissionProperties(Guid.NewGuid().ToString(), PermissionMode.All, EncryptionTests.itemContainer)); CosmosDataEncryptionKeyProvider dekProvider = new CosmosDataEncryptionKeyProvider(new TestKeyWrapProvider()); TestEncryptor encryptor = new TestEncryptor(dekProvider); (string endpoint, string _) = TestCommon.GetAccountInfo(); CosmosClient clientForRestrictedUser = new CosmosClientBuilder(endpoint, restrictedUserPermission.Token) .WithEncryptor(encryptor) .Build(); Database databaseForRestrictedUser = clientForRestrictedUser.GetDatabase(EncryptionTests.databaseCore.Id); Container containerForRestrictedUser = databaseForRestrictedUser.GetContainer(EncryptionTests.itemContainer.Id); await EncryptionTests.PerformForbiddenOperationAsync(() => dekProvider.InitializeAsync(databaseForRestrictedUser, EncryptionTests.keyContainer.Id), "CosmosDekProvider.InitializeAsync"); await EncryptionTests.PerformOperationOnUninitializedDekProviderAsync(() => dekProvider.DataEncryptionKeyContainer.ReadDataEncryptionKeyAsync(EncryptionTests.dekId), "DEK.ReadAsync"); await EncryptionTests.PerformOperationOnUninitializedDekProviderAsync(() => containerForRestrictedUser.ReadItemAsync <TestDoc>(testDoc.Id, new PartitionKey(testDoc.PK)), "ReadItemAsync"); await EncryptionTests.PerformOperationOnUninitializedDekProviderAsync(() => containerForRestrictedUser.ReadItemStreamAsync(testDoc.Id, new PartitionKey(testDoc.PK)), "ReadItemStreamAsync"); }
public async Task EncryptionCreateDek() { string dekId = "anotherDek"; DataEncryptionKeyProperties dekProperties = await EncryptionTests.CreateDekAsync(EncryptionTests.dekProvider, dekId); Assert.IsNotNull(dekProperties); Assert.IsNotNull(dekProperties.CreatedTime); Assert.IsNotNull(dekProperties.LastModified); Assert.IsNotNull(dekProperties.SelfLink); // Assert.IsNotNull(dekProperties.ResourceId); // Assert.AreEqual(dekProperties.LastModified, dekProperties.CreatedTime); Assert.AreEqual( new EncryptionKeyWrapMetadata(EncryptionTests.metadata1.Value + EncryptionTests.metadataUpdateSuffix), dekProperties.EncryptionKeyWrapMetadata); // Use different DEK provider to avoid (unintentional) cache impact CosmosDataEncryptionKeyProvider dekProvider = new CosmosDataEncryptionKeyProvider(new TestKeyWrapProvider()); await dekProvider.InitializeAsync(EncryptionTests.databaseCore, EncryptionTests.keyContainer.Id); DataEncryptionKeyProperties readProperties = await dekProvider.DataEncryptionKeyContainer.ReadDataEncryptionKeyAsync(dekId); Assert.AreEqual(dekProperties, readProperties); }
public async Task EncryptionResourceTokenAuthAllowed() { User keyManagerUser = EncryptionTests.databaseCore.GetUser(Guid.NewGuid().ToString()); await EncryptionTests.databaseCore.CreateUserAsync(keyManagerUser.Id); PermissionProperties keyManagerUserPermission = await keyManagerUser.CreatePermissionAsync( new PermissionProperties(Guid.NewGuid().ToString(), PermissionMode.All, EncryptionTests.keyContainer)); CosmosDataEncryptionKeyProvider dekProvider = new CosmosDataEncryptionKeyProvider(new TestKeyWrapProvider()); TestEncryptor encryptor = new TestEncryptor(dekProvider); (string endpoint, string _) = TestCommon.GetAccountInfo(); CosmosClient clientForKeyManagerUser = new CosmosClientBuilder(endpoint, keyManagerUserPermission.Token) .WithEncryptor(encryptor) .Build(); Database databaseForKeyManagerUser = clientForKeyManagerUser.GetDatabase(EncryptionTests.databaseCore.Id); await dekProvider.InitializeAsync(databaseForKeyManagerUser, EncryptionTests.keyContainer.Id); DataEncryptionKeyProperties readDekProperties = await dekProvider.DataEncryptionKeyContainer.ReadDataEncryptionKeyAsync(EncryptionTests.dekId); Assert.AreEqual(EncryptionTests.dekProperties, readDekProperties); }
public async Task EncryptionDekReadFeed() { Container newKeyContainer = await EncryptionTests.databaseCore.CreateContainerAsync(Guid.NewGuid().ToString(), "/id", 400); try { CosmosDataEncryptionKeyProvider dekProvider = new CosmosDataEncryptionKeyProvider(new TestKeyWrapProvider()); await dekProvider.InitializeAsync(EncryptionTests.databaseCore, newKeyContainer.Id); string contosoV1 = "Contoso_v001"; string contosoV2 = "Contoso_v002"; string fabrikamV1 = "Fabrikam_v001"; string fabrikamV2 = "Fabrikam_v002"; await EncryptionTests.CreateDekAsync(dekProvider, contosoV1); await EncryptionTests.CreateDekAsync(dekProvider, contosoV2); await EncryptionTests.CreateDekAsync(dekProvider, fabrikamV1); await EncryptionTests.CreateDekAsync(dekProvider, fabrikamV2); // Test getting all keys await EncryptionTests.IterateDekFeedAsync( dekProvider, new List <string> { contosoV1, contosoV2, fabrikamV1, fabrikamV2 }, isExpectedDeksCompleteSetForRequest : true, isResultOrderExpected : false, "SELECT * from c"); // Test getting specific subset of keys await EncryptionTests.IterateDekFeedAsync( dekProvider, new List <string> { contosoV2 }, isExpectedDeksCompleteSetForRequest : false, isResultOrderExpected : true, "SELECT TOP 1 * from c where c.id >= 'Contoso_v000' and c.id <= 'Contoso_v999' ORDER BY c.id DESC"); // Ensure only required results are returned await EncryptionTests.IterateDekFeedAsync( dekProvider, new List <string> { contosoV1, contosoV2 }, isExpectedDeksCompleteSetForRequest : true, isResultOrderExpected : true, "SELECT * from c where c.id >= 'Contoso_v000' and c.id <= 'Contoso_v999' ORDER BY c.id ASC"); // Test pagination await EncryptionTests.IterateDekFeedAsync( dekProvider, new List <string> { contosoV1, contosoV2, fabrikamV1, fabrikamV2 }, isExpectedDeksCompleteSetForRequest : true, isResultOrderExpected : false, "SELECT * from c", itemCountInPage : 3); } finally { await newKeyContainer.DeleteContainerStreamAsync(); } }