4d9a26498e
Paste a secret, get a link, send it. The first person to open it and press
Reveal sees the secret; the link dies at that moment. The recipient needs a
browser and nothing else — no account, no client, no installed tooling.
The server cannot read what it stores. AES-256-GCM happens in the browser and
the key lives in the URL fragment, which browsers never transmit, so hushd
holds ciphertext and no key material. That is a property of where the key sits
rather than a promise about our conduct, which is why there is deliberately no
endpoint accepting a plaintext secret and no server-side-encryption fallback:
two guarantees behind one URL would be worse than one honest guarantee.
Three decisions carry the design:
* GET /s/{id} touches NO storage, not even to check existence. Slack, Teams,
WhatsApp, iMessage and Outlook Safe Links all fetch a URL before a human
sees it, so destroying on GET would destroy most secrets in transit and the
recipient's "already used" would be indistinguishable from interception.
Only POST /reveal consumes. Bot user-agent detection is an arms race;
removing the side effect from GET is not. Pinned by
TestGettingTheRevealPageNeverConsumesTheSecret.
* Destruction is one Redis GETDEL, which is atomic. GET-then-DEL has a window
where two simultaneous readers both win, and for a one-time secret that
window is the product. The store contract demands atomicity and the same
concurrency test runs against both implementations.
* Missing, already-revealed, expired and evicted are ONE indistinguishable
410. Separating them would confirm to a prober that a given link was real.
The secret id IS the capability, so secret.ID is a struct whose every
accidental path — %v, %s, String(), slog, json.Marshal — emits a redacted
handle or refuses, and the raw value needs an explicit Value(). The first
version tried to prevent leaks by implementing no String() at all; its own test
caught that Go's fmt prints unexported fields anyway, so forbidding the method
had removed the control rather than the leak.
Operationally: structured JSON on stdout in the fleet's wire format, which
Vector already collects with no annotation; six hush_* metrics on the chassis
registry with no id, IP or path in any label; five alert rules wired into
vmalert. The public Ingress enumerates /, /s/ and /api/ so /metrics, /healthz
and /readyz share the port but are unreachable from the internet — no
basic-auth middleware to maintain and get wrong.
Dependencies are vendored because go-chassis is private: the Woodpecker test
step and the in-cluster Kaniko build both run -mod=vendor with GOPROXY=off and
hold no git credential.
cmd/hush-mcp is a stdio MCP server doing the same client-side crypto locally,
so using hush from an agent preserves the same guarantee as using it from a
browser.
81 lines
2.5 KiB
Go
81 lines
2.5 KiB
Go
package store
|
|
|
|
import (
|
|
"context"
|
|
"sync"
|
|
"time"
|
|
|
|
"github.com/orchard9/hush/internal/secret"
|
|
)
|
|
|
|
// Memory is an in-process Store for tests and `make dev` without Redis.
|
|
//
|
|
// It is NOT a deployment option, and the deployment path cannot select it: the
|
|
// store is chosen by whether REDIS_URL is set, and REDIS_URL is Required in
|
|
// config, so a misconfigured pod fails to boot rather than silently serving
|
|
// secrets from a store that dies with the process. This type exists so the
|
|
// handler tests do not need a container.
|
|
type Memory struct {
|
|
mu sync.Mutex
|
|
items map[string]memItem
|
|
now func() time.Time
|
|
}
|
|
|
|
type memItem struct {
|
|
ciphertext string
|
|
expiresAt time.Time
|
|
}
|
|
|
|
// NewMemory returns an empty store using the real clock.
|
|
func NewMemory() *Memory {
|
|
return &Memory{items: map[string]memItem{}, now: time.Now}
|
|
}
|
|
|
|
// NewMemoryAt returns a store driven by a caller-supplied clock, so expiry is
|
|
// testable without sleeping.
|
|
func NewMemoryAt(now func() time.Time) *Memory {
|
|
return &Memory{items: map[string]memItem{}, now: now}
|
|
}
|
|
|
|
func (m *Memory) Put(_ context.Context, id secret.ID, ciphertext string, ttl time.Duration) error {
|
|
m.mu.Lock()
|
|
defer m.mu.Unlock()
|
|
k := id.StorageKey()
|
|
// Mirror Redis SET NX semantics, including that an EXPIRED key is treated
|
|
// as absent and may be overwritten. A memory store that rejected a write
|
|
// against a stale entry would pass tests Redis fails.
|
|
if it, ok := m.items[k]; ok && m.now().Before(it.expiresAt) {
|
|
return ErrIDCollision
|
|
}
|
|
m.items[k] = memItem{ciphertext: ciphertext, expiresAt: m.now().Add(ttl)}
|
|
return nil
|
|
}
|
|
|
|
// Take mirrors GETDEL: the read and the delete happen under one lock, so the
|
|
// atomicity the one-time guarantee depends on holds here too and the
|
|
// concurrency test is meaningful against both implementations.
|
|
func (m *Memory) Take(_ context.Context, id secret.ID) (string, error) {
|
|
m.mu.Lock()
|
|
defer m.mu.Unlock()
|
|
k := id.StorageKey()
|
|
it, ok := m.items[k]
|
|
if !ok {
|
|
return "", ErrGone
|
|
}
|
|
delete(m.items, k)
|
|
if !m.now().Before(it.expiresAt) {
|
|
return "", ErrGone
|
|
}
|
|
return it.ciphertext, nil
|
|
}
|
|
|
|
func (m *Memory) Ping(context.Context) error { return nil }
|
|
func (m *Memory) Close() error { return nil }
|
|
|
|
// AllowN is an always-allow limiter: rate limiting is an abuse control on the
|
|
// public deployment, and silently enforcing one in tests would make handler
|
|
// tests order-dependent and flaky.
|
|
func (m *Memory) AllowN(context.Context, string, int, time.Duration) (bool, time.Duration, error) {
|
|
return true, 0, nil
|
|
}
|