Skip to content

Commit 4635576

Browse files
timothyF95timothyF95
authored
Remove org owned feature flag (#441)
1 parent 6aa5160 commit 4635576

4 files changed

Lines changed: 19 additions & 92 deletions

File tree

‎cmd/secrets/common/handler.go‎

Lines changed: 4 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -277,16 +277,8 @@ func (h *Handler) fetchVaultMasterPublicKeyHex() (string, error) {
277277
return rpcResp.Result.PublicKey, nil
278278
}
279279

280-
// ResolveEffectiveOwner returns the owner string to use for vault secret identifiers.
281-
// When SecretsOrgOwned is enabled, the org ID (from auth validation) is used;
282-
// otherwise, the workflow owner address is used and must be a valid hex address.
280+
// ResolveEffectiveOwner returns the checksummed workflow owner address for owner-key vault operations.
283281
func (h *Handler) ResolveEffectiveOwner() (string, error) {
284-
if h.EnvironmentSet != nil && h.EnvironmentSet.SecretsOrgOwned {
285-
if h.Credentials == nil || h.Credentials.OrgID == "" {
286-
return "", fmt.Errorf("org ID required when CRE_CLI_SECRETS_ORG_OWNED is enabled; ensure auth validation succeeds")
287-
}
288-
return h.Credentials.OrgID, nil
289-
}
290282
if !common.IsHexAddress(h.OwnerAddress) {
291283
return "", fmt.Errorf("owner address %q is not a valid hex address", h.OwnerAddress)
292284
}
@@ -296,7 +288,7 @@ func (h *Handler) ResolveEffectiveOwner() (string, error) {
296288
// ResolveVaultIdentifierOwnerForAuth returns the owner string used in vault JSON-RPC payloads
297289
// (SecretIdentifier.Owner and list request Owner). Browser auth always uses the signed-in
298290
// organization ID so digests and identifiers align with JWT AuthorizedOwner() on the gateway;
299-
// owner-key auth uses ResolveEffectiveOwner() (workflow address unless CRE_CLI_SECRETS_ORG_OWNED).
291+
// onchain auth uses ResolveEffectiveOwner() (linked workflow owner address).
300292
func (h *Handler) ResolveVaultIdentifierOwnerForAuth(secretsAuth string) (string, error) {
301293
if IsBrowserFlow(secretsAuth) {
302294
if h.Credentials == nil {
@@ -313,18 +305,9 @@ func (h *Handler) ResolveVaultIdentifierOwnerForAuth(secretsAuth string) (string
313305
return h.ResolveEffectiveOwner()
314306
}
315307

316-
// EncryptSecrets takes the raw secrets and encrypts them, returning pointers.
317-
// When SecretsOrgOwned is enabled, uses SHA256(orgID) as the TDH2 label and orgID as the owner.
318-
// Otherwise, uses the workflow owner address left-padded to 32 bytes as the TDH2 label.
308+
// EncryptSecrets takes the raw secrets and encrypts them for the owner-key (onchain) flow.
309+
// TDH2 label is the workflow owner address left-padded to 32 bytes; SecretIdentifier.Owner is the same hex address string.
319310
func (h *Handler) EncryptSecrets(rawSecrets UpsertSecretsInputs) ([]*vault.EncryptedSecret, error) {
320-
if h.EnvironmentSet != nil && h.EnvironmentSet.SecretsOrgOwned {
321-
owner, err := h.ResolveEffectiveOwner()
322-
if err != nil {
323-
return nil, err
324-
}
325-
return h.EncryptSecretsForBrowserOrg(rawSecrets, owner)
326-
}
327-
328311
pubKeyHex, err := h.fetchVaultMasterPublicKeyHex()
329312
if err != nil {
330313
return nil, err

‎cmd/secrets/common/handler_test.go‎

Lines changed: 15 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -134,64 +134,38 @@ func TestEncryptSecrets(t *testing.T) {
134134
}
135135

136136
func TestResolveEffectiveOwner(t *testing.T) {
137-
t.Run("returns canonicalized address when SecretsOrgOwned is false", func(t *testing.T) {
137+
t.Run("returns canonicalized workflow owner address", func(t *testing.T) {
138138
h, _, _ := newMockHandler(t)
139139
h.OwnerAddress = "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266"
140-
h.EnvironmentSet.SecretsOrgOwned = false
141140

142141
owner, err := h.ResolveEffectiveOwner()
143142
require.NoError(t, err)
144143
require.Equal(t, "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266", owner)
145144
})
146145

147-
t.Run("errors when SecretsOrgOwned is false and owner address is empty", func(t *testing.T) {
146+
t.Run("errors when owner address is empty", func(t *testing.T) {
148147
h, _, _ := newMockHandler(t)
149148
h.OwnerAddress = ""
150-
h.EnvironmentSet.SecretsOrgOwned = false
151149

152150
_, err := h.ResolveEffectiveOwner()
153151
require.Error(t, err)
154152
require.Contains(t, err.Error(), "not a valid hex address")
155153
})
156154

157-
t.Run("errors when SecretsOrgOwned is false and owner address is malformed", func(t *testing.T) {
155+
t.Run("errors when owner address is malformed", func(t *testing.T) {
158156
h, _, _ := newMockHandler(t)
159157
h.OwnerAddress = "not-an-address"
160-
h.EnvironmentSet.SecretsOrgOwned = false
161158

162159
_, err := h.ResolveEffectiveOwner()
163160
require.Error(t, err)
164161
require.Contains(t, err.Error(), "not a valid hex address")
165162
})
166-
167-
t.Run("returns org ID when SecretsOrgOwned is true and org ID is set", func(t *testing.T) {
168-
h, _, _ := newMockHandler(t)
169-
h.OwnerAddress = "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266"
170-
h.EnvironmentSet.SecretsOrgOwned = true
171-
h.Credentials.OrgID = "org-123"
172-
173-
owner, err := h.ResolveEffectiveOwner()
174-
require.NoError(t, err)
175-
require.Equal(t, "org-123", owner)
176-
})
177-
178-
t.Run("errors when SecretsOrgOwned is true but org ID is empty", func(t *testing.T) {
179-
h, _, _ := newMockHandler(t)
180-
h.OwnerAddress = "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266"
181-
h.EnvironmentSet.SecretsOrgOwned = true
182-
h.Credentials.OrgID = ""
183-
184-
_, err := h.ResolveEffectiveOwner()
185-
require.Error(t, err)
186-
require.Contains(t, err.Error(), "org ID required")
187-
})
188163
}
189164

190165
func TestResolveVaultIdentifierOwnerForAuth(t *testing.T) {
191-
t.Run("browser returns org ID when SecretsOrgOwned is false", func(t *testing.T) {
166+
t.Run("browser returns org ID", func(t *testing.T) {
192167
h, _, _ := newMockHandler(t)
193168
h.OwnerAddress = "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266"
194-
h.EnvironmentSet.SecretsOrgOwned = false
195169
h.Credentials.AuthType = credentials.AuthTypeBearer
196170
h.Credentials.OrgID = "org-browser"
197171

@@ -220,18 +194,17 @@ func TestResolveVaultIdentifierOwnerForAuth(t *testing.T) {
220194
require.Contains(t, err.Error(), "organization information is missing")
221195
})
222196

223-
t.Run("owner-key delegates to ResolveEffectiveOwner", func(t *testing.T) {
197+
t.Run("onchain delegates to ResolveEffectiveOwner", func(t *testing.T) {
224198
h, _, _ := newMockHandler(t)
225199
h.OwnerAddress = "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266"
226-
h.EnvironmentSet.SecretsOrgOwned = false
227200

228201
owner, err := h.ResolveVaultIdentifierOwnerForAuth(SecretsAuthOnchain)
229202
require.NoError(t, err)
230203
require.Equal(t, "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266", owner)
231204
})
232205
}
233206

234-
func TestEncryptSecrets_OrgOwned(t *testing.T) {
207+
func TestEncryptSecrets_UsesWorkflowOwnerAddress(t *testing.T) {
235208
mockGw := &mockGatewayClient{
236209
post: func(body []byte) ([]byte, int, error) {
237210
var req jsonrpc2.Request[vaultcommon.GetPublicKeyRequest]
@@ -247,34 +220,17 @@ func TestEncryptSecrets_OrgOwned(t *testing.T) {
247220
},
248221
}
249222

250-
raw := UpsertSecretsInputs{
251-
{ID: "secret-1", Value: "val1", Namespace: "main"},
252-
}
253-
254-
t.Run("uses orgID as owner when SecretsOrgOwned is true", func(t *testing.T) {
255-
h, _, _ := newMockHandler(t)
256-
h.Gw = mockGw
257-
h.EnvironmentSet.SecretsOrgOwned = true
258-
h.Credentials.OrgID = "org-456"
259-
260-
enc, err := h.EncryptSecrets(raw)
261-
require.NoError(t, err)
262-
require.Len(t, enc, 1)
263-
require.Equal(t, "org-456", enc[0].Id.Owner)
264-
require.Equal(t, "secret-1", enc[0].Id.Key)
265-
})
266-
267-
t.Run("uses address as owner when SecretsOrgOwned is false", func(t *testing.T) {
268-
h, _, _ := newMockHandler(t)
269-
h.Gw = mockGw
270-
h.OwnerAddress = "0xabc"
271-
h.EnvironmentSet.SecretsOrgOwned = false
223+
h, _, _ := newMockHandler(t)
224+
h.Gw = mockGw
225+
h.OwnerAddress = "0xabc"
272226

273-
enc, err := h.EncryptSecrets(raw)
274-
require.NoError(t, err)
275-
require.Len(t, enc, 1)
276-
require.Equal(t, "0xabc", enc[0].Id.Owner)
227+
enc, err := h.EncryptSecrets(UpsertSecretsInputs{
228+
{ID: "secret-1", Value: "val1", Namespace: "main"},
277229
})
230+
require.NoError(t, err)
231+
require.Len(t, enc, 1)
232+
require.Equal(t, "0xabc", enc[0].Id.Owner)
233+
require.Equal(t, "secret-1", enc[0].Id.Key)
278234
}
279235

280236
func TestPackAllowlistRequestTxData_Success_With0x(t *testing.T) {

‎internal/environments/environments.go‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@ const (
2525
EnvVarWorkflowRegistryChainName = "CRE_CLI_WORKFLOW_REGISTRY_CHAIN_NAME"
2626
EnvVarWorkflowRegistryChainExplorerURL = "CRE_CLI_WORKFLOW_REGISTRY_CHAIN_EXPLORER_URL"
2727
EnvVarDonFamily = "CRE_CLI_DON_FAMILY"
28-
EnvVarSecretsOrgOwned = "CRE_CLI_SECRETS_ORG_OWNED"
2928

3029
DefaultEnv = "PRODUCTION"
3130
StagingEnv = "STAGING"
@@ -48,7 +47,6 @@ type EnvironmentSet struct {
4847
WorkflowRegistryChainName string `yaml:"CRE_CLI_WORKFLOW_REGISTRY_CHAIN_NAME"`
4948
WorkflowRegistryChainExplorerURL string `yaml:"CRE_CLI_WORKFLOW_REGISTRY_CHAIN_EXPLORER_URL"`
5049
DonFamily string `yaml:"CRE_CLI_DON_FAMILY"`
51-
SecretsOrgOwned bool `yaml:"CRE_CLI_SECRETS_ORG_OWNED"`
5250
}
5351

5452
// RequiresVPN returns true if the GraphQL endpoint is on a private network
@@ -101,7 +99,6 @@ func NewEnvironmentSet(ff *fileFormat, envName string) *EnvironmentSet {
10199
wrAddress := os.Getenv(EnvVarWorkflowRegistryAddress)
102100
wrChainName := os.Getenv(EnvVarWorkflowRegistryChainName)
103101
donFamily := os.Getenv(EnvVarDonFamily)
104-
secretsOrgOwned := os.Getenv(EnvVarSecretsOrgOwned)
105102

106103
set.EnvName = envName
107104
if authBase != "" {
@@ -131,9 +128,6 @@ func NewEnvironmentSet(ff *fileFormat, envName string) *EnvironmentSet {
131128
if donFamily != "" {
132129
set.DonFamily = donFamily
133130
}
134-
if secretsOrgOwned != "" {
135-
set.SecretsOrgOwned = strings.EqualFold(secretsOrgOwned, "true")
136-
}
137131

138132
newEnvironmentSetWarningsOnce.Do(func() {
139133
switch envName {
@@ -170,9 +164,6 @@ func NewEnvironmentSet(ff *fileFormat, envName string) *EnvironmentSet {
170164
if donFamily != "" {
171165
ui.Warning(fmt.Sprintf("%s set, using %s", EnvVarDonFamily, donFamily))
172166
}
173-
if secretsOrgOwned != "" {
174-
ui.Warning(fmt.Sprintf("%s set, using %s", EnvVarSecretsOrgOwned, secretsOrgOwned))
175-
}
176167
})
177168

178169
return &set

‎internal/environments/environments.yaml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ ENVIRONMENTS:
66
CRE_CLI_GRAPHQL_URL: https://graphql-cre-dev.tailf8f749.ts.net/graphql
77
CRE_VAULT_DON_GATEWAY_URL: https://cre-gateway-one-zone-a.main.stage.cldev.sh/
88
CRE_CLI_DON_FAMILY: "zone-a"
9-
CRE_CLI_SECRETS_ORG_OWNED: false
109

1110
CRE_CLI_WORKFLOW_REGISTRY_ADDRESS: "0x7e69E853D9Ce50C2562a69823c80E01360019Cef"
1211
CRE_CLI_WORKFLOW_REGISTRY_CHAIN_NAME: "ethereum-testnet-sepolia" # eth-sepolia
@@ -19,7 +18,6 @@ ENVIRONMENTS:
1918
CRE_CLI_GRAPHQL_URL: https://graphql-cre-stage.tailf8f749.ts.net/graphql
2019
CRE_VAULT_DON_GATEWAY_URL: https://cre-gateway-one-zone-a.main.stage.cldev.sh/
2120
CRE_CLI_DON_FAMILY: "zone-a"
22-
CRE_CLI_SECRETS_ORG_OWNED: false
2321

2422
CRE_CLI_WORKFLOW_REGISTRY_ADDRESS: "0xaE55eB3EDAc48a1163EE2cbb1205bE1e90Ea1135"
2523
CRE_CLI_WORKFLOW_REGISTRY_CHAIN_NAME: "ethereum-testnet-sepolia" # eth-sepolia
@@ -32,7 +30,6 @@ ENVIRONMENTS:
3230
CRE_CLI_GRAPHQL_URL: https://api.cre.chain.link/graphql
3331
CRE_VAULT_DON_GATEWAY_URL: https://01.gateway.zone-a.cre.chain.link
3432
CRE_CLI_DON_FAMILY: "zone-a"
35-
CRE_CLI_SECRETS_ORG_OWNED: false
3633

3734
CRE_CLI_WORKFLOW_REGISTRY_ADDRESS: "0x4Ac54353FA4Fa961AfcC5ec4B118596d3305E7e5"
3835
CRE_CLI_WORKFLOW_REGISTRY_CHAIN_NAME: "ethereum-mainnet"

0 commit comments

Comments
 (0)