From d86fb7c8dc3e7dc84147255f872309f3004cace8 Mon Sep 17 00:00:00 2001 From: marcocapozzoli Date: Thu, 10 Sep 2026 20:53:45 -0300 Subject: [PATCH 1/7] Create Keychain --- src/atomdb/auth/BUILD | 9 ++++++++ src/atomdb/auth/Keychain.cc | 20 +++++++++++++++++ src/atomdb/auth/Keychain.h | 40 ++++++++++++++++++++++++++++++++++ src/tests/cpp/BUILD | 15 +++++++++++++ src/tests/cpp/keychain_test.cc | 29 ++++++++++++++++++++++++ 5 files changed, 113 insertions(+) create mode 100644 src/atomdb/auth/Keychain.cc create mode 100644 src/atomdb/auth/Keychain.h create mode 100644 src/tests/cpp/keychain_test.cc diff --git a/src/atomdb/auth/BUILD b/src/atomdb/auth/BUILD index 95bf0e9fd..77634c6bf 100644 --- a/src/atomdb/auth/BUILD +++ b/src/atomdb/auth/BUILD @@ -7,6 +7,8 @@ cc_library( includes = ["."], deps = [ ":authorization_manifest", + ":authorization_types", + ":keychain", ":mongodb_authorization_persistence", ], ) @@ -60,3 +62,10 @@ cc_library( "//commons/atoms:atoms_lib", ], ) + +cc_library( + name = "keychain", + srcs = ["Keychain.cc"], + hdrs = ["Keychain.h"], + includes = ["."], +) diff --git a/src/atomdb/auth/Keychain.cc b/src/atomdb/auth/Keychain.cc new file mode 100644 index 000000000..9b27a6f76 --- /dev/null +++ b/src/atomdb/auth/Keychain.cc @@ -0,0 +1,20 @@ +#include "Keychain.h" + +using namespace std; +using namespace atomdb; + +// ------------------------------------------------------------------------------------------------- +// Constructor + +Keychain::Keychain(map keys) : keys_(keys) {} + +// ------------------------------------------------------------------------------------------------- +// Public methods + +Keychain::PublicKey Keychain::get_public_key(const Keychain::AtomDB_UID& uid) const { + auto it = this->keys_.find(uid); + if (it != this->keys_.end()) { + return it->second; + } + return ""; +} diff --git a/src/atomdb/auth/Keychain.h b/src/atomdb/auth/Keychain.h new file mode 100644 index 000000000..25ed7756a --- /dev/null +++ b/src/atomdb/auth/Keychain.h @@ -0,0 +1,40 @@ +#pragma once + +#include +#include + +using namespace std; + +namespace atomdb { + +/** + * @brief Caller credentials: public keys keyed by AtomDB UID. + * + * Keychain is the identity token passed into ProtectedAtomDB. + * AuthorizationManifest looks up the public key for a given + * database UID and checks the corresponding AuthorizationProfile. + */ +class Keychain { + public: + using AtomDB_UID = string; + using PublicKey = string; + + explicit Keychain(map keys); + ~Keychain() = default; + + /** + * @brief Returns the public key registered for `uid`. + * + * Empty string means no usable key: the UID is missing or its stored + * value is empty. + * + * @param uid AtomDB UID to look up. + * @return The stored public key, or empty string. + */ + PublicKey get_public_key(const AtomDB_UID& uid) const; + + private: + map keys_; +}; + +} // namespace atomdb diff --git a/src/tests/cpp/BUILD b/src/tests/cpp/BUILD index c4bfb23af..261cf5b9c 100644 --- a/src/tests/cpp/BUILD +++ b/src/tests/cpp/BUILD @@ -874,6 +874,21 @@ cc_test( ], ) +cc_test( + name = "keychain_test", + size = "small", + srcs = ["keychain_test.cc"], + copts = [ + "-Iexternal/gtest/googletest/include", + "-Iexternal/gtest/googletest", + ], + linkstatic = 1, + deps = [ + "//atomdb/auth:keychain", + "@com_github_google_googletest//:gtest_main", + ], +) + cc_test( name = "authorization_test", size = "small", diff --git a/src/tests/cpp/keychain_test.cc b/src/tests/cpp/keychain_test.cc new file mode 100644 index 000000000..cec2402cd --- /dev/null +++ b/src/tests/cpp/keychain_test.cc @@ -0,0 +1,29 @@ +#include "Keychain.h" + +#include + +#include +#include + +using namespace atomdb; +using namespace std; + +TEST(KeychainTest, GetPublicKeyReturnsEmpty) { + Keychain empty_keychain({}); + EXPECT_EQ(empty_keychain.get_public_key("blah"), ""); + EXPECT_EQ(empty_keychain.get_public_key(""), ""); + + Keychain keychain(map{{"uid1", "key1"}}); + EXPECT_EQ(keychain.get_public_key("uid2"), ""); + EXPECT_EQ(keychain.get_public_key("uid"), ""); + EXPECT_EQ(keychain.get_public_key(""), ""); + + Keychain empty_stored_key(map{{"uid", ""}}); + EXPECT_EQ(empty_stored_key.get_public_key("uid"), ""); +} + +TEST(KeychainTest, GetPublicKeyReturnsStoredKey) { + Keychain keychain(map{{"uid1", "key1"}, {"uid2", "key2"}}); + EXPECT_EQ(keychain.get_public_key("uid1"), "key1"); + EXPECT_EQ(keychain.get_public_key("uid2"), "key2"); +} From 7b7bce9c792517ed3a35f5946fa04f08bdb3ea4e Mon Sep 17 00:00:00 2001 From: marcocapozzoli Date: Fri, 11 Sep 2026 09:13:41 -0300 Subject: [PATCH 2/7] Move the constructor parameter into keys_ --- src/atomdb/auth/Keychain.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/atomdb/auth/Keychain.cc b/src/atomdb/auth/Keychain.cc index 9b27a6f76..fa78ade8e 100644 --- a/src/atomdb/auth/Keychain.cc +++ b/src/atomdb/auth/Keychain.cc @@ -6,7 +6,7 @@ using namespace atomdb; // ------------------------------------------------------------------------------------------------- // Constructor -Keychain::Keychain(map keys) : keys_(keys) {} +Keychain::Keychain(map keys) : keys_(std::move(keys)) {} // ------------------------------------------------------------------------------------------------- // Public methods From 166efca23cdef68b98285b9609188d7cf279d5c8 Mon Sep 17 00:00:00 2001 From: marcocapozzoli Date: Fri, 11 Sep 2026 10:35:12 -0300 Subject: [PATCH 3/7] Improve doc --- src/atomdb/auth/Keychain.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/atomdb/auth/Keychain.h b/src/atomdb/auth/Keychain.h index 25ed7756a..baa9f35d8 100644 --- a/src/atomdb/auth/Keychain.h +++ b/src/atomdb/auth/Keychain.h @@ -8,11 +8,11 @@ using namespace std; namespace atomdb { /** - * @brief Caller credentials: public keys keyed by AtomDB UID. + * @brief Caller credentials: one public key per AtomDB UID. * - * Keychain is the identity token passed into ProtectedAtomDB. - * AuthorizationManifest looks up the public key for a given - * database UID and checks the corresponding AuthorizationProfile. + * Holds the map `uid → public_key` that identifies the caller to each + * AtomDB. `get_public_key(uid)` returns the key for that database, or + * an empty string if the UID is absent or stored as empty. */ class Keychain { public: From 4ea057fbad1edc432fdd3bc6a07a04717366b1ae Mon Sep 17 00:00:00 2001 From: marcocapozzoli Date: Fri, 11 Sep 2026 10:35:35 -0300 Subject: [PATCH 4/7] Improve doc --- src/atomdb/auth/Keychain.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/atomdb/auth/Keychain.h b/src/atomdb/auth/Keychain.h index baa9f35d8..01aa84ebc 100644 --- a/src/atomdb/auth/Keychain.h +++ b/src/atomdb/auth/Keychain.h @@ -10,7 +10,7 @@ namespace atomdb { /** * @brief Caller credentials: one public key per AtomDB UID. * - * Holds the map `uid → public_key` that identifies the caller to each + * Holds the map `uid -> public_key` that identifies the caller to each * AtomDB. `get_public_key(uid)` returns the key for that database, or * an empty string if the UID is absent or stored as empty. */ From 2dd44a7e16a8042491451517f464f5792e945091 Mon Sep 17 00:00:00 2001 From: Marco Capozzoli <55926220+marcocapozzoli@users.noreply.github.com> Date: Mon, 14 Sep 2026 09:21:22 -0300 Subject: [PATCH 5/7] Update src/atomdb/auth/Keychain.cc Co-authored-by: Andre Luiz de Senna --- src/atomdb/auth/Keychain.cc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/atomdb/auth/Keychain.cc b/src/atomdb/auth/Keychain.cc index fa78ade8e..bbe954b37 100644 --- a/src/atomdb/auth/Keychain.cc +++ b/src/atomdb/auth/Keychain.cc @@ -6,7 +6,9 @@ using namespace atomdb; // ------------------------------------------------------------------------------------------------- // Constructor -Keychain::Keychain(map keys) : keys_(std::move(keys)) {} +Keychain::Keychain(const map& keys) { + this->keys_ = keys; +} // ------------------------------------------------------------------------------------------------- // Public methods From e017bca0901561a114effdfeb3c644e4371c21b2 Mon Sep 17 00:00:00 2001 From: Marco Capozzoli <55926220+marcocapozzoli@users.noreply.github.com> Date: Mon, 14 Sep 2026 09:21:32 -0300 Subject: [PATCH 6/7] Update src/atomdb/auth/Keychain.h Co-authored-by: Andre Luiz de Senna --- src/atomdb/auth/Keychain.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/atomdb/auth/Keychain.h b/src/atomdb/auth/Keychain.h index 01aa84ebc..88496cc54 100644 --- a/src/atomdb/auth/Keychain.h +++ b/src/atomdb/auth/Keychain.h @@ -19,7 +19,7 @@ class Keychain { using AtomDB_UID = string; using PublicKey = string; - explicit Keychain(map keys); + explicit Keychain(const map& keys); ~Keychain() = default; /** From 2375c78c368c86887352f512e9478cd056b09b68 Mon Sep 17 00:00:00 2001 From: marcocapozzoli Date: Mon, 14 Sep 2026 09:31:58 -0300 Subject: [PATCH 7/7] lint --- src/atomdb/auth/Keychain.cc | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/atomdb/auth/Keychain.cc b/src/atomdb/auth/Keychain.cc index bbe954b37..896338fd5 100644 --- a/src/atomdb/auth/Keychain.cc +++ b/src/atomdb/auth/Keychain.cc @@ -6,9 +6,7 @@ using namespace atomdb; // ------------------------------------------------------------------------------------------------- // Constructor -Keychain::Keychain(const map& keys) { - this->keys_ = keys; -} +Keychain::Keychain(const map& keys) { this->keys_ = keys; } // ------------------------------------------------------------------------------------------------- // Public methods